decocms 3.96.0 → 3.96.2

package/dist/server/server.js

@@ -576,7 +576,7 @@ You are the Usage Manager. You analyze how this workspace is actually used \u201
    b. MONITORING_LOGS_LIST with isError true (plus connectionId/toolName/virtualMcpId filters) \u2192 failing calls.
    c. MONITORING_LOG_GET on specific log ids for full input/output when the error message isn't enough.
    d. Report the failing tool/connection, error pattern, and suggest the fix or owner.
-</workflows>`,Ky1;var Uy1=O(()=>{$6();Ky1={id:"studio-usage-manager",title:"Usage Manager",icon:"icon://BarChart10?color=blue",description:"Analyze usage, costs, and clean up idle agents and connections",selectedTools:["MONITORING_STATS","MONITORING_LOGS_LIST","MONITORING_LOG_GET","MONITORING_THREAD_USAGE","COLLECTION_VIRTUAL_MCP_LIST","COLLECTION_VIRTUAL_MCP_GET","COLLECTION_VIRTUAL_MCP_DELETE","VIRTUAL_MCP_LAST_USED_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","COLLECTION_CONNECTIONS_DELETE","ORGANIZATION_MEMBER_LIST"],selectedConnections:null,selectedPrompts:[],instructions:jM8,getId:oX.USAGE_MANAGER}});function Z$0($){return yO.find((Z)=>$.startsWith(`${Z.id}_`))??null}async function wy1($,Z){if("resolveRuntime"in $)return $.resolveRuntime(Z);return{instructions:$.instructions,selectedTools:$.selectedTools}}async function G$0($,Z){if(!("checklist"in $))return[];return Promise.all($.checklist.map(async(G)=>({label:G.label,activeForm:G.activeForm,action:G.action,completed:await G.isCompleted(Z),alwaysSuggest:G.alwaysSuggest})))}async function Fy1($,Z,G){let X={self:w4.SELF($),registry:w4.REGISTRY($),"community-registry":w4.COMMUNITY_REGISTRY($)};await Promise.all(yO.map(async(Y)=>{let Q=Y.getId($);if(await G.findById(Q,$))return;let K=(Y.selectedConnections??["self"]).map((U)=>X[U]);await G.create($,Z,{title:Y.title,description:Y.description,icon:Y.icon,status:"active",pinned:!1,metadata:{instructions:Y.instructions},connections:K.map((U)=>({connection_id:U,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:null,selected_prompts:Y.selectedPrompts?[...Y.selectedPrompts]:null}))},{id:Q})}))}var yO;var fu=O(()=>{$6();av1();ev1();Xy1();Qy1();Wy1();Uy1();yO=[Gy1,ov1,sv1,Yy1,Jy1,Ky1]});import{DBOS as X$0}from"@dbos-inc/dbos-sdk";async function PM8($){let Z=g6(),G=new T_(Z.db);await Fy1($.orgId,$.createdBy,G)}async function AM8($){let Z=g6(),G=new T_(Z.db);for(let X of yO){let Y=X.getId($.orgId),Q=await G.findById(Y,$.orgId);if(!Q)continue;let J=X.selectedPrompts?[...X.selectedPrompts]:null;if(Q.connections.every((K)=>{let U=K.selected_prompts;if(J===null)return U===null;if(U===null)return!1;if(U.length!==J.length)return!1;return U.every((w,F)=>w===J[F])}))continue;await G.update(Y,$.createdBy,{connections:Q.connections.map((K)=>({connection_id:K.connection_id,selected_tools:K.selected_tools,selected_resources:K.selected_resources,selected_prompts:J}))})}}async function TM8($){await X$0.runStep(()=>PM8($),{name:"installStudioPack"}),await X$0.runStep(()=>AM8($),{name:"backfillSelectedPrompts"})}async function Hf0($){await X$0.startWorkflow(IM8,{workflowID:`install-studio-pack:${RM8}:${$.orgId}`})($)}async function Hy1(){let Z=await g6().db.selectFrom("member").select(["organizationId","userId"]).orderBy("createdAt","asc").execute(),G=new Map;for(let X of Z)if(!G.has(X.organizationId))G.set(X.organizationId,X.userId);await Promise.all(Array.from(G).map(async([X,Y])=>{try{await Hf0({orgId:X,createdBy:Y})}catch(Q){console.error("[studio-pack-backfill] enqueue failed",{orgId:X},Q)}}))}var IM8,RM8="v2";var Y$0=O(()=>{LJ();Ff0();fu();IM8=X$0.registerWorkflow(TM8,{name:"installStudioPackWorkflow"})});import{jwtVerify as qM8,SignJWT as Ny1}from"jose";import{randomBytes as MM8}from"crypto";function By1(){if(xu)return xu;let $=L1(),Z=$.meshJwtSecret??$.betterAuthSecret;if(Z)xu=new TextEncoder().encode(Z);else console.warn("MESH_JWT_SECRET not set - generating random secret (not persistent)"),xu=new Uint8Array(MM8(32));return xu}async function Oy1($,Z="5m"){let G=By1();return await new Ny1($).setProtectedHeader({alg:"HS256",typ:"JWT"}).setIssuedAt().setExpirationTime(Z).sign(G)}async function Nf0($){try{let Z=By1(),{payload:G}=await qM8($,Z);return G}catch{return}}async function yF($,Z,G=3600){let X=L1(),Y=X.meshJwtSecret??X.betterAuthSecret;if(!Y)throw Error("A deterministic JWT secret is required to mint gateway JWTs \u2014 set MESH_JWT_SECRET or BETTER_AUTH_SECRET");let Q=new TextEncoder().encode(Y);return await new Ny1({iss:"mesh",sub:$,...Z&&{email:Z}}).setProtectedHeader({alg:"HS256",typ:"JWT"}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1000)+G).sign(Q)}var xu=null;var gO=O(()=>{q8()});class vu{constructor(){this._messageQueue=[]}static createLinkedPair(){let $=new vu,Z=new vu;return $._otherTransport=Z,Z._otherTransport=$,[$,Z]}async start(){while(this._messageQueue.length>0){let $=this._messageQueue.shift();this.onmessage?.($.message,$.extra)}}async close(){let $=this._otherTransport;this._otherTransport=void 0,await $?.close(),this.onclose?.()}async send($,Z){if(!this._otherTransport)throw Error("Not connected");if(this._otherTransport.onmessage)this._otherTransport.onmessage($,{authInfo:Z?.authInfo});else this._otherTransport._messageQueue.push({message:$,extra:{authInfo:Z?.authInfo}})}}import{SpanStatusCode as Ey1}from"@opentelemetry/api";function Q0($){return{...$,execute:async(Z,G)=>{return await G.timings.measure(`tool.${$.name}`,async()=>G.tracer.startActiveSpan(`tool.${$.name}`,{attributes:{"tool.name":$.name,"organization.id":G.organization?.id??"system","user.id":G.auth.user?.id??G.auth.apiKey?.userId??"anonymous"}},async(X)=>{try{G.toolName=$.name,G.access.setToolName?.($.name);let Y=await $.handler(Z,G);return X.setStatus({code:Ey1.OK}),Y}catch(Y){throw X.setStatus({code:Ey1.ERROR,message:Y.message}),X.recordException(Y),Y}finally{X.end()}}))}}}var W1=()=>{};function E0($){if(!$.organization)throw Error("This operation requires organization scope");return $.organization}function l1($){return $.auth.user?.id??$.auth.apiKey?.userId}function kM8($){return!!($.auth.user||$.auth.apiKey)}function b0($){if(!kM8($))throw Error("Authentication required")}import{z as G6}from"zod";var Q$0,Dy1,Ly1,zy1,jy1,Py1,Ay1,Ty1,Iy1,Ry1;var I_=O(()=>{Q$0=G6.record(G6.string(),G6.array(G6.string())),Dy1=G6.object({id:G6.string().describe("Unique identifier for the API key"),name:G6.string().describe("Human-readable name for the API key"),userId:G6.string().describe("ID of the user who owns this API key"),permissions:Q$0.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Example: { "self": ["API_KEY_CREATE"], "conn_abc123": ["SEND_MESSAGE"] }'),expiresAt:G6.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:G6.string().datetime().describe("When the API key was created (ISO 8601)")}),Ly1=G6.object({name:G6.string().min(1).max(64).describe("Human-readable name for the API key"),permissions:Q$0.describe(`Permissions to grant (REQUIRED \u2014 there is no implicit default). Format: { resource: [actions] }. Resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names (e.g., ["ORGANIZATION_GET"]) or ["*"] for all. Example: { "self": ["ORGANIZATION_GET", "COLLECTION_CONNECTIONS_LIST"] }. The key is authorized solely by this allowlist; the creator's role does not widen it.`),expiresIn:G6.number().positive().optional().describe("Expiration time in seconds. If not provided, key never expires."),metadata:G6.record(G6.string(),G6.unknown()).optional().describe("Additional metadata to store with the API key")}),zy1=G6.object({id:G6.string().describe("Unique identifier for the API key"),name:G6.string().describe("Human-readable name for the API key"),key:G6.string().describe("The actual API key value. STORE THIS SECURELY - it will not be shown again!"),permissions:Q$0.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools'),expiresAt:G6.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:G6.string().datetime().describe("When the API key was created (ISO 8601)")}),jy1=G6.object({}),Py1=G6.object({items:G6.array(Dy1).describe("List of API keys (without key values)")}),Ay1=G6.object({keyId:G6.string().describe("ID of the API key to update"),name:G6.string().min(1).max(64).optional().describe("New name for the API key"),permissions:Q$0.optional().describe('New permissions. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names or "*" for all. Example: { "self": ["API_KEY_CREATE"] }. Replaces existing permissions.'),metadata:G6.record(G6.string(),G6.unknown()).optional().describe("New metadata. Replaces existing metadata.")}),Ty1=G6.object({item:Dy1.describe("The updated API key (without key value)")}),Iy1=G6.object({keyId:G6.string().describe("ID of the API key to delete")}),Ry1=G6.object({success:G6.boolean().describe("Whether the deletion was successful"),keyId:G6.string().describe("ID of the deleted API key")})});var Bf0;var qy1=O(()=>{f4();W1();I_();Bf0=Q0({name:"API_KEY_CREATE",description:"Create an API key with scoped permissions. The key value is returned only once \u2014 store it immediately.",annotations:{title:"Create API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Ly1,outputSchema:zy1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=await Z.boundAuth.apiKey.create({name:$.name,permissions:$.permissions,expiresIn:$.expiresIn,metadata:{...$.metadata,organization:Z.organization}}),X=G.expiresAt?G.expiresAt instanceof Date?G.expiresAt.toISOString():G.expiresAt:null,Y=G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,Q=l1(Z);if(Q)p1.capture({distinctId:Q,event:"api_key_created",...Z.organization?.id?{groups:{organization:Z.organization.id}}:{},properties:{key_id:G.id,key_name:G.name??$.name,organization_id:Z.organization?.id,has_expiry:!!X}});return{id:G.id,name:G.name??$.name,key:G.key,permissions:G.permissions??{},expiresAt:X,createdAt:Y}}})});var Of0;var My1=O(()=>{f4();W1();I_();Of0=Q0({name:"API_KEY_DELETE",description:"Delete and instantly revoke an API key. Cannot be undone.",annotations:{title:"Delete API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Iy1,outputSchema:Ry1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=l1(Z);if(!G)throw Error("User ID required to delete API key");let Y=(await Z.boundAuth.apiKey.list())?.find((K)=>K.id===$.keyId);if(!Y)throw Error("API key not found");let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot delete API key from another organization");if(await Z.boundAuth.apiKey.delete($.keyId),W)p1.capture({distinctId:G,event:"api_key_deleted",groups:{organization:W},properties:{key_id:$.keyId,organization_id:W}});return{success:!0,keyId:$.keyId}}})});var Ef0;var ky1=O(()=>{W1();I_();Ef0=Q0({name:"API_KEY_LIST",description:"List API keys for the current user in the current organization. Returns metadata only \u2014 key values are never shown after creation.",annotations:{title:"List API Keys",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jy1,outputSchema:Py1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=await Z.boundAuth.apiKey.list(),X=Z.organization?.id;return{items:(G??[]).filter((Q)=>{return Q.metadata?.organization?.id===X}).map((Q)=>({id:Q.id,name:Q.name??"Unnamed Key",userId:Q.userId,permissions:Q.permissions??{},expiresAt:Q.expiresAt?Q.expiresAt instanceof Date?Q.expiresAt.toISOString():Q.expiresAt:null,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});var Df0;var Sy1=O(()=>{W1();I_();Df0=Q0({name:"API_KEY_UPDATE",description:"Update an API key's name, permissions, or metadata. The key value cannot be changed or retrieved.",annotations:{title:"Update API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ay1,outputSchema:Ty1,handler:async($,Z)=>{if(b0(Z),await Z.access.check(),!l1(Z))throw Error("User ID required to update API key");let Y=(await Z.boundAuth.apiKey.list())?.find((U)=>U.id===$.keyId);if(!Y)throw Error(`API key not found: ${$.keyId}`);let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot update API key from another organization");let K=await Z.boundAuth.apiKey.update({keyId:$.keyId,name:$.name,permissions:$.permissions,metadata:{...$.metadata,organization:Z.organization}});if(!K)throw Error(`Failed to update API key: ${$.keyId}`);return{item:{id:K.id,name:K.name??$.name??"Unnamed Key",userId:K.userId,permissions:K.permissions??{},expiresAt:K.expiresAt?K.expiresAt instanceof Date?K.expiresAt.toISOString():K.expiresAt:null,createdAt:K.createdAt instanceof Date?K.createdAt.toISOString():K.createdAt}}}})});var Vy1=O(()=>{qy1();My1();ky1();Sy1();I_()});function J$0($){let Z=$.trim();if(!Z)return{ok:!1,error:"Enter a website URL."};let G=VM8.test(Z),X=CM8.test(Z),Y=bM8.test(Z);if(G&&!X&&!Y)return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let Q=X?Z:`https://${Z}`,J;try{J=new URL(Q)}catch{return{ok:!1,error:"Enter a valid website URL."}}if(J.protocol!=="http:"&&J.protocol!=="https:")return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let W=J.hostname.split(".");if(W.length<2||W.some((K)=>!K||!_M8.test(K)))return{ok:!1,error:"Enter a valid website URL."};return J.protocol="https:",{ok:!0,value:J.origin}}var VM8,CM8,bM8,_M8;var Lf0=O(()=>{VM8=/^[a-zA-Z][a-zA-Z\d+.-]*:/,CM8=/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//,bM8=/^[^\s/:?#]+\.[^\s/:?#]+:\d+(?:[/?#]|$)/,_M8=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i});import{z as Cy1}from"zod";function by1($){if($.baseUrl)return $.baseUrl.replace(/\/+$/,"");return(($.settings??L1()).commerceDiscoveryInternalApiUrl??fM8).replace(/\/+$/,"")}function _y1($){let Z=$.apiKey??($.settings??L1()).commerceDiscoveryInternalApiKey;if(!Z)throw Error("COMMERCE_DISCOVERY_INTERNAL_API_KEY is required to set up Commerce Discovery.");return Z}function fy1($){return new URL($).hostname}async function xy1($){let Z=`Commerce Discovery auth failed with status ${$.status}.`,G=await $.text().catch(()=>"");if(!G)return Z;try{let X=JSON.parse(G),Y=typeof X.error==="string"?X.error:typeof X.message==="string"?X.message:null;return Y?`Commerce Discovery auth failed: ${Y}.`:Z}catch{return Z}}async function zf0($,Z={}){let G=by1(Z),X=_y1(Z),Y=Z.fetchImpl??fetch,Q=fy1($.siteUrl),J=`${G}/api/v2/internal/diagnostics/${encodeURIComponent(Q)}/upgrade`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${X}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.orgName?{name:$.orgName}:{}})});if(!W.ok)throw Error(await xy1(W));let K=xM8.safeParse(await W.json());if(!K.success)throw Error("Commerce Discovery auth response did not include a token.");return{authorizationToken:K.data.token}}async function vy1($,Z={}){let G=by1(Z),X=_y1(Z),Y=Z.fetchImpl??fetch,Q=fy1($.siteUrl),J=`${G}/api/v2/internal/diagnostics/${encodeURIComponent(Q)}/run`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${X}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId})});if(W.status===409)return{triggered:!1,reason:"not_upgraded"};if(!W.ok)throw Error(await xy1(W));return{triggered:!0}}var fM8,xM8;var jf0=O(()=>{$6();q8();fM8=new URL(BC0).origin,xM8=Cy1.object({token:Cy1.string().min(1)})});import{z as yu}from"zod";var vM8,yM8,Pf0;var yy1=O(()=>{Lf0();W1();jf0();vM8=yu.object({siteUrl:yu.string().min(1).describe("Website URL to run the diagnostic for.")}),yM8=yu.object({triggered:yu.boolean(),reason:yu.string().optional()}),Pf0=Q0({name:"COMMERCE_DISCOVERY_RUN",description:"Trigger the Commerce Discovery diagnostic run for the current organization's store. Call once the data sources (GA4/GSC/VTEX) are connected \u2014 this run resolves credentials and produces the enriched report.",annotations:{title:"Run Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:vM8,outputSchema:yM8,handler:async($,Z)=>{b0(Z);let G=E0(Z);await Z.access.check();let X=J$0($.siteUrl);if(!X.ok)throw Error(X.error);return vy1({siteUrl:X.value,orgId:G.id})}})});var gF=O(()=>{t00()});import{z as o3}from"zod";function cM8($){return!$.connection_token}async function uM8($,Z,G,X){let Y=await $.storage.connections.findById(Z,G);if(Y)return Y;throw X}async function dM8($,Z,G,X){let Y=await $.storage.virtualMcps.findById(Z,G);if(Y)return Y;throw X}var gy1,gM8,hM8,Af0;var hy1=O(()=>{$6();Lf0();W1();r3();gF();jf0();gy1=OC0,gM8=o3.object({siteUrl:o3.string().min(1).describe("Website URL to configure.")}),hM8=o3.object({connection:mZ,virtualMcp:iZ,reportApp:o3.object({connectionId:o3.string(),virtualMcpId:o3.string(),toolName:o3.literal(gy1)}),created:o3.object({connection:o3.boolean(),virtualMcp:o3.boolean()})});Af0=Q0({name:"COMMERCE_DISCOVERY_SETUP",description:"Create or return the Commerce Discovery connection and virtual MCP for the current organization.",annotations:{title:"Set Up Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gM8,outputSchema:hM8,handler:async($,Z)=>{b0(Z);let G=E0(Z);await Z.access.check("COLLECTION_CONNECTIONS_CREATE");let X=l1(Z);if(!X)throw Error("User ID required to set up Commerce Discovery");let Y=J$0($.siteUrl);if(!Y.ok)throw Error(Y.error);let Q=w4.COMMERCE_DISCOVERY(G.id),J=TC0(G.id),W=await Z.storage.connections.findById(Q,G.id),K={connection:!1,virtualMcp:!1};if(W&&cM8(W)){let w=await zf0({siteUrl:Y.value,orgId:G.id,orgName:G.name});if(w.authorizationToken)console.log("[commerce-discovery] repairing missing auth token",{orgId:G.id,siteUrl:Y.value,connectionId:Q}),W=await Z.storage.connections.update(W.id,{connection_token:w.authorizationToken})}if(!W){let w=await zf0({siteUrl:Y.value,orgId:G.id,orgName:G.name});console.log("[commerce-discovery] creating connection",{orgId:G.id,siteUrl:Y.value,connectionId:Q});try{let F=IC0(G.id,w.authorizationToken);W=await Z.storage.connections.create({...F,metadata:{...F.metadata??{},siteUrl:Y.value},organization_id:G.id,created_by:X}),K.connection=!0}catch(F){W=await uM8(Z,Q,G.id,F)}}let U=await Z.storage.virtualMcps.findById(J,G.id);if(!U){console.log("[commerce-discovery] creating virtual MCP",{orgId:G.id,siteUrl:Y.value,connectionId:W.id,virtualMcpId:J});try{U=await Z.storage.virtualMcps.create(G.id,X,RC0(G.id,W.id),{id:J}),K.virtualMcp=!0}catch(w){U=await dM8(Z,J,G.id,w)}}if(!U.pinned)U=await Z.storage.virtualMcps.update(U.id,X,{pinned:!0});return{connection:W,virtualMcp:U,reportApp:{connectionId:W.id,virtualMcpId:U.id,toolName:gy1},created:K}}})});var cy1=O(()=>{yy1();hy1()});var Tf0=b((uy1)=>{Object.defineProperty(uy1,"__esModule",{value:!0});uy1.kvPrefix=uy1.KvWatchInclude=void 0;uy1.KvWatchInclude={LastValue:"",AllHistory:"history",UpdatesOnly:"updates"};uy1.kvPrefix="KV_"});var ey1=b((ay1)=>{Object.defineProperty(ay1,"__esModule",{value:!0});ay1.KvStatusImpl=ay1.Bucket=ay1.Kvm=ay1.kvOperationHdr=void 0;ay1.Base64KeyCodec=iM8;ay1.NoopKvCodecs=If0;ay1.defaultBucketOpts=my1;ay1.validateKey=iy1;ay1.validateSearchKey=ny1;ay1.hasWildcards=py1;ay1.validateBucket=W$0;var k5=hX(),p4=zr(),M5=Tf0();function iM8(){let $=(Z,G)=>{let X=[];for(let Y of Z.split("."))switch(Y){case">":case"*":X.push(Y);break;default:X.push(G(Y));break}return X.join(".")};return{encode(Z){return $(Z,btoa)},decode(Z){return $(Z,atob)}}}function If0(){return{key:{encode($){return $},decode($){return $}},value:{encode($){return typeof $==="string"?new TextEncoder().encode($):$},decode($){return $}}}}function my1(){return{replicas:1,history:1,timeout:2000,max_bytes:-1,maxValueSize:-1,codec:If0(),storage:p4.StorageType.File}}ay1.kvOperationHdr="KV-Operation";var ly1="$KV",nM8=/^[-/=.\w]+$/,pM8=/^[-/=.>*\w]+$/,tM8=/^[-\w]+$/;function iy1($){if($.startsWith(".")||$.endsWith(".")||!nM8.test($))throw Error(`invalid key: ${$}`)}function ny1($){if($.startsWith(".")||$.endsWith(".")||$.includes("..")||!pM8.test($))throw Error(`invalid key: ${$}`)}function py1($){if($.startsWith(".")||$.endsWith("."))throw Error(`invalid key: ${$}`);let Z=$.split("."),G=!1;for(let X=0;X<Z.length;X++)switch(Z[X]){case"*":G=!0;break;case">":if(X!==Z.length-1)throw Error(`invalid key: ${$}`);G=!0;break;default:}return G}function W$0($){if(!tM8.test($))throw Error(`invalid bucket name: ${$}`)}class ty1{js;constructor($){this.js=(0,p4.toJetStreamClient)($)}create($,Z={}){return this.#$($,Z)}open($,Z={}){return Z.bindOnly=!0,this.#$($,Z)}#$($,Z={}){let{ok:G,min:X}=this.js.nc.features.get(k5.Feature.JS_KV);if(!G)return Promise.reject(Error(`kv is only supported on servers ${X} or better`));if(Z.bindOnly)return R_.bind(this.js,$,Z);return R_.create(this.js,$,Z)}list(){let $=(G)=>{let Y=G.streams.filter((J)=>{return J.config.name.startsWith(M5.kvPrefix)});Y.forEach((J)=>{J.config.sealed=J.config.sealed||!1,J.config.deny_delete=J.config.deny_delete||!1,J.config.deny_purge=J.config.deny_purge||!1,J.config.allow_rollup_hdrs=J.config.allow_rollup_hdrs||!1});let Q="";if(Y.length)Q=this.js.nc.info?.cluster??"";return Y.map((J)=>{return new K$0(J,Q)})},Z=`${this.js.prefix}.STREAM.LIST`;return new p4.ListerImpl(Z,$,this.js)}}ay1.Kvm=ty1;class R_{js;jsm;stream;bucket;direct;codec;prefix;editPrefix;useJsPrefix;_prefixLen;constructor($,Z,G){W$0($),this.js=Z,this.jsm=G,this.bucket=$,this.prefix=ly1,this.editPrefix="",this.useJsPrefix=!1,this._prefixLen=0}static async create($,Z,G={}){W$0(Z);let X=await $.jetstreamManager(),Y=new R_(Z,$,X);return await Y.init(G),Y}static async bind($,Z,G={}){let X=$.getOptions()?.checkAPI||G.bindOnly===!1,Y=await $.jetstreamManager(X),Q={config:{allow_direct:G.allow_direct}};W$0(Z);let J=new R_(Z,$,Y);return Q.config.name=G.streamName??J.bucketName(),Object.assign(J,Q),J.stream=Q.config.name,J.codec=G.codec||If0(),J.direct=Q.config.allow_direct??!1,J.initializePrefixes(Q),J}async init($={}){let Z=Object.assign(my1(),$);this.codec=Z.codec;let G={};if(this.stream=G.name=$.streamName??this.bucketName(),G.retention=p4.RetentionPolicy.Limits,G.max_msgs_per_subject=Z.history,Z.max_bytes)G.max_bytes=Z.max_bytes;if(G.max_msg_size=Z.maxValueSize,G.storage=Z.storage,$.placement)G.placement=$.placement;if($.republish)G.republish=$.republish;if($.description)G.description=$.description;if($.markerTTL)G.allow_msg_ttl=!0,G.subject_delete_marker_ttl=(0,k5.nanos)(Z.markerTTL);if($.mirror){let U=Object.assign({},$.mirror);if(!U.name.startsWith(M5.kvPrefix))U.name=`${M5.kvPrefix}${U.name}`;G.mirror=U,G.mirror_direct=!0}else if($.sources){let U=$.sources.map((w)=>{let F=Object.assign({},w),H=F.name.startsWith(M5.kvPrefix)?F.name.substring(M5.kvPrefix.length):F.name;if(!F.name.startsWith(M5.kvPrefix))F.name=`${M5.kvPrefix}${F.name}`;if(!w.external&&H!==this.bucket)F.subject_transforms=[{src:`$KV.${H}.>`,dest:`$KV.${this.bucket}.>`}];return F});G.sources=U,G.subjects=[this.subjectForBucket()]}else G.subjects=[this.subjectForBucket()];if($.metadata)G.metadata=$.metadata;if(typeof $.compression==="boolean")G.compression=$.compression?p4.StoreCompression.S2:p4.StoreCompression.None;let X=this.js.nc,Y=X.getServerVersion(),Q=Y?(0,k5.compare)(Y,(0,k5.parseSemVer)("2.7.2"))>=0:!1;G.discard=Q?p4.DiscardPolicy.New:p4.DiscardPolicy.Old;let{ok:J,min:W}=X.features.get(k5.Feature.JS_ALLOW_DIRECT);if(!J&&$.allow_direct===!0){let U=Y?`${Y.major}.${Y.minor}.${Y.micro}`:"unknown";return Promise.reject(Error(`allow_direct is not available on server version ${U} - requires ${W}`))}if($.allow_direct=typeof $.allow_direct==="boolean"?$.allow_direct:J,G.allow_direct=$.allow_direct,this.direct=G.allow_direct,G.num_replicas=Z.replicas,Z.ttl)G.max_age=(0,k5.nanos)(Z.ttl);G.allow_rollup_hdrs=!0;let K;try{if(K=await this.jsm.streams.info(G.name),!K.config.allow_direct&&this.direct===!0)this.direct=!1}catch(U){if(U.message==="stream not found")K=await this.jsm.streams.add(G);else throw U}this.initializePrefixes(K)}initializePrefixes($){this._prefixLen=0,this.prefix=`$KV.${this.bucket}`,this.useJsPrefix=this.js.apiPrefix!=="$JS.API";let{mirror:Z}=$.config;if(Z){let G=Z.name;if(G.startsWith(M5.kvPrefix))G=G.substring(M5.kvPrefix.length);if(Z.external&&Z.external.api!==""){let X=Z.name.substring(M5.kvPrefix.length);this.useJsPrefix=!1,this.prefix=`$KV.${X}`,this.editPrefix=`${Z.external.api}.$KV.${G}`}else this.editPrefix=this.prefix}}bucketName(){return this.stream??`${M5.kvPrefix}${this.bucket}`}subjectForBucket(){return`${this.prefix}.${this.bucket}.>`}subjectForKey($,Z=!1){let G=[];if(Z){if(this.useJsPrefix)G.push(this.js.apiPrefix);if(this.editPrefix!=="")G.push(this.editPrefix);else G.push(this.prefix)}else if(this.prefix)G.push(this.prefix);return G.push($),G.join(".")}fullKeyName($){if(this.prefix!=="")return`${this.prefix}.${$}`;return`${ly1}.${this.bucket}.${$}`}get prefixLen(){if(this._prefixLen===0)this._prefixLen=this.prefix.length+1;return this._prefixLen}encodeKey($){let Z=[];for(let G of $.split("."))switch(G){case">":case"*":Z.push(G);break;default:Z.push(this.codec.key.encode(G));break}return Z.join(".")}decodeKey($){let Z=[];for(let G of $.split("."))switch(G){case">":case"*":Z.push(G);break;default:Z.push(this.codec.key.decode(G));break}return Z.join(".")}validateKey=iy1;validateSearchKey=ny1;hasWildcards=py1;close(){return Promise.resolve()}dataLen($,Z){let G=Z?Z.get(p4.JsHeaders.MessageSizeHdr)||"":"";if(G!=="")return parseInt(G,10);return $.length}smToEntry($){return new ry1(this.bucket,this.prefixLen,$,this.codec)}jmToWatchEntry($,Z){return new oy1(this.bucket,this.prefixLen,$,Z,this.codec)}async create($,Z,G){let X;try{let Q={previousSeq:0},J=await this._put($,Z,Q,G);return Promise.resolve(J)}catch(Q){if(X=Q,Q instanceof p4.JetStreamApiError){let J=Q;if(J.code!==p4.JetStreamApiCodes.StreamWrongLastSequence&&J.code!==p4.JetStreamApiCodes.StreamWrongLastSequenceUnknown)return Promise.reject(Q)}}let Y=0;try{let Q=await this.get($);if(Q?.operation==="DEL"||Q?.operation==="PURGE")return Y=Q!==null?Q.revision:0,this._put($,Z,{previousSeq:Y},G);else return Promise.reject(X)}catch(Q){return Promise.reject(Q)}}update($,Z,G,X){if(G<=0)throw Error("version must be greater than 0");return this.put($,Z,{previousSeq:G,timeout:X})}async _put($,Z,G={},X){let Y=this.encodeKey($);this.validateKey(Y),Z=this.codec.value.encode(Z);let Q={timeout:G?.timeout};if(G.previousSeq!==void 0){let J=(0,k5.headers)();Q.headers=J,J.set(p4.PubHeaders.ExpectedLastSubjectSequenceHdr,`${G.previousSeq}`)}if(X)(Q.headers||(0,k5.headers)()).set(p4.PubHeaders.MessageTTL,X);try{return(await this.js.publish(this.subjectForKey(Y,!0),Z,Q)).seq}catch(J){return Promise.reject(J)}}put($,Z,G={}){return this._put($,Z,G)}async get($,Z){let G=this.encodeKey($);this.validateKey(G);let X={last_by_subj:this.subjectForKey(G)};if(Z&&Z.revision>0)X={seq:Z.revision};let Y=null;try{if(this.direct)Y=await this.jsm.direct.getMessage(this.bucketName(),X);else Y=await this.jsm.streams.getMessage(this.bucketName(),X);if(Y===null)return null;let Q=this.smToEntry(Y);if(Q.rawKey!==G)return null;return Q}catch(Q){throw Q}}purge($,Z){return this._deleteOrPurge($,"PURGE",Z)}delete($,Z){return this._deleteOrPurge($,"DEL",Z)}async purgeDeletes($=1800000){let Z=[],G=await this.history({key:">"});await(async()=>{for await(let J of G)if(J.operation==="DEL"||J.operation==="PURGE")Z.push(J)})().then(),G.stop();let X=Date.now()-$,Y=Z.map((J)=>{let W=this.subjectForKey(J.key);if(J.created.getTime()>=X)return this.jsm.streams.purge(this.stream,{filter:W,keep:1});else return this.jsm.streams.purge(this.stream,{filter:W,keep:0})}),Q=await Promise.all(Y);return Q.unshift({success:!0,purged:0}),Q.reduce((J,W)=>{return J.purged+=W.purged,J})}async _deleteOrPurge($,Z,G){if(!this.hasWildcards($))return this._doDeleteOrPurge($,Z,G);let X=await this.keys($),Y=[];for await(let Q of X)if(Y.push(this._doDeleteOrPurge(Q,Z)),Y.length===100)await Promise.all(Y),Y.length=0;if(Y.length>0)await Promise.all(Y)}async _doDeleteOrPurge($,Z,G){let X=this.encodeKey($);this.validateKey(X);let Y=(0,k5.headers)();if(Y.set(ay1.kvOperationHdr,Z),Z==="PURGE"){let Q=G;if(Y.set(p4.JsHeaders.RollupHdr,p4.JsHeaders.RollupValueSubject),typeof Q?.ttl==="string"&&Q.ttl!=="")Y.set(p4.PubHeaders.MessageTTL,`${Q.ttl}`)}if(G?.previousSeq)Y.set(p4.PubHeaders.ExpectedLastSubjectSequenceHdr,`${G.previousSeq}`);await this.js.publish(this.subjectForKey(X,!0),k5.Empty,{headers:Y})}_buildCC($,Z,G={}){let Y=(!Array.isArray($)?[$]:$).map((W)=>{let K=this.encodeKey(W);return this.validateSearchKey(W),this.fullKeyName(K)}),Q=p4.DeliverPolicy.LastPerSubject;if(Z===M5.KvWatchInclude.AllHistory)Q=p4.DeliverPolicy.All;if(Z===M5.KvWatchInclude.UpdatesOnly)Q=p4.DeliverPolicy.New;let J=void 0;if(Y.length===1)J=Y[0],Y=void 0;return Object.assign({deliver_policy:Q,ack_policy:p4.AckPolicy.None,filter_subjects:Y,filter_subject:J,flow_control:!0,idle_heartbeat:(0,k5.nanos)(5000)},G)}remove($){return this.purge($)}async history($={}){let Z=$.key??">",G={};G.headers_only=$.headers_only||!1;let X=new k5.QueuedIteratorImpl,Y=()=>{X.stop()},Q=this._buildCC(Z,M5.KvWatchInclude.AllHistory,G),J=await this.js.consumers.getPushConsumer(this.stream,Q);if(X._data=J,(await J.info(!0)).num_pending===0)return X.push(Y),X;let K=await J.consume({callback:(U)=>{let w=this.jmToWatchEntry(U,!1);if(X.push(w),X.received++,U.info.pending===0)X.push(Y)}});return K.closed().then(()=>{X.push(Y)}),(async()=>{for await(let U of K.status())switch(U.type){case"heartbeat":X.push(()=>{X.stop()});break}})().then(),X.iterClosed.then(()=>{K.stop()}),X}canSetWatcherName(){let $=this.js.nc,{ok:Z}=$.features.get(k5.Feature.JS_NEW_CONSUMER_CREATE_API);return Z}async watch($={}){let Z=$.key??">",G=new k5.QueuedIteratorImpl,X={};X.headers_only=$.headers_only||!1;let Y=M5.KvWatchInclude.LastValue;if($.include===M5.KvWatchInclude.AllHistory)Y=M5.KvWatchInclude.AllHistory;else if($.include===M5.KvWatchInclude.UpdatesOnly)Y=M5.KvWatchInclude.UpdatesOnly;let Q=$.ignoreDeletes===!0,J=this._buildCC(Z,Y,X);if(J.name=`KV_WATCHER_${k5.nuid.next()}`,$.resumeFromRevision&&$.resumeFromRevision>0)J.deliver_policy=p4.DeliverPolicy.StartSequence,J.opt_start_seq=$.resumeFromRevision;let W=await this.js.consumers.getPushConsumer(this.stream,J),U=(await W.info(!0)).num_pending,w=Y===M5.KvWatchInclude.UpdatesOnly||U===0;G._data=W;let F=0,H=await W.consume({callback:(N)=>{if(!w)F++,w=F>=U;let B=this.jmToWatchEntry(N,w);if(Q&&B.operation==="DEL")return;G.push(B),G.received++}});return G.iterClosed.then(()=>{H.stop()}),H.closed().then(()=>{G.push(()=>{G.stop()})}),G}async keys($=">"){let Z=new k5.QueuedIteratorImpl,G=this._buildCC($,M5.KvWatchInclude.LastValue,{headers_only:!0}),X=await this.js.consumers.getPushConsumer(this.stream,G);if((await X.info()).num_pending===0)return Z.stop(),Z;Z._data=X;let Q=await X.consume({callback:(J)=>{let W=J.headers?.get(ay1.kvOperationHdr);if(W!=="DEL"&&W!=="PURGE"){let K=this.decodeKey(J.subject.substring(this.prefixLen));Z.push(K)}if(J.info.pending===0)Q.stop()}});return(async()=>{for await(let J of Q.status())switch(J.type){case"heartbeat":Z.push(()=>{Z.stop()});break}})().then(),Q.closed().then(()=>{Z.push(()=>{Z.stop()})}),Z.iterClosed.then(()=>{Q.stop()}),Z}purgeBucket($){return this.jsm.streams.purge(this.bucketName(),$)}destroy(){return this.jsm.streams.delete(this.bucketName())}async status(){let Z=this.js.nc.info?.cluster??"",G=this.bucketName(),X=await this.jsm.streams.info(G);return new K$0(X,Z)}}ay1.Bucket=R_;class K$0{si;cluster;constructor($,Z=""){this.si=$,this.cluster=Z}get bucket(){return this.si.config.name.startsWith(M5.kvPrefix)?this.si.config.name.substring(M5.kvPrefix.length):this.si.config.name}get values(){return this.si.state.messages}get history(){return this.si.config.max_msgs_per_subject}get ttl(){return(0,k5.millis)(this.si.config.max_age)}get markerTTL(){if(typeof this.si.config.subject_delete_marker_ttl==="number")return(0,k5.millis)(this.si.config.subject_delete_marker_ttl);return 0}get bucket_location(){return this.cluster}get backingStore(){return this.si.config.storage}get storage(){return this.si.config.storage}get replicas(){return this.si.config.num_replicas}get description(){return this.si.config.description??""}get maxBucketSize(){return this.si.config.max_bytes}get maxValueSize(){return this.si.config.max_msg_size}get max_bytes(){return this.si.config.max_bytes}get placement(){return this.si.config.placement||{cluster:"",tags:[]}}get placementCluster(){return this.si.config.placement?.cluster??""}get republish(){return this.si.config.republish??{src:"",dest:""}}get streamInfo(){return this.si}get size(){return this.si.state.bytes}get metadata(){return this.si.config.metadata??{}}get compression(){if(this.si.config.compression)return this.si.config.compression!==p4.StoreCompression.None;return!1}}ay1.KvStatusImpl=K$0;class ry1{bucket;sm;prefixLen;codec;constructor($,Z,G,X){this.bucket=$,this.prefixLen=Z,this.sm=G,this.codec=X}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get delta(){return 0}get created(){return this.sm.time}get revision(){return this.sm.seq}get operation(){if(this.sm.header?.has("Nats-Marker-Reason")){if(this.sm.header?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.header?.get(ay1.kvOperationHdr)||"PUT"}get length(){let $=this.sm.header.get(p4.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}json($){return JSON.parse(k5.TD.decode(this.value),$)}string(){return k5.TD.decode(this.value)}}class oy1{bucket;sm;prefixLen;update;codec;constructor($,Z,G,X,Y){this.bucket=$,this.prefixLen=Z,this.sm=G,this.update=X,this.codec=Y}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get created(){return new Date((0,k5.millis)(this.sm.info.timestampNanos))}get revision(){return this.sm.seq}get operation(){if(this.sm.headers?.has("Nats-Marker-Reason")){if(this.sm.headers?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.headers?.get(ay1.kvOperationHdr)||"PUT"}get delta(){return this.sm.info.pending}get length(){let $=this.sm.headers?.get(p4.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}get isUpdate(){return this.update}json($){return JSON.parse(k5.TD.decode(this.value),$)}string(){return k5.TD.decode(this.value)}}});var Rf0=b((AJ)=>{Object.defineProperty(AJ,"__esModule",{value:!0});AJ.validateKey=AJ.validateBucket=AJ.NoopKvCodecs=AJ.Kvm=AJ.defaultBucketOpts=AJ.Bucket=AJ.Base64KeyCodec=AJ.KvWatchInclude=AJ.kvPrefix=void 0;var $g1=Tf0();Object.defineProperty(AJ,"kvPrefix",{enumerable:!0,get:function(){return $g1.kvPrefix}});Object.defineProperty(AJ,"KvWatchInclude",{enumerable:!0,get:function(){return $g1.KvWatchInclude}});var hO=ey1();Object.defineProperty(AJ,"Base64KeyCodec",{enumerable:!0,get:function(){return hO.Base64KeyCodec}});Object.defineProperty(AJ,"Bucket",{enumerable:!0,get:function(){return hO.Bucket}});Object.defineProperty(AJ,"defaultBucketOpts",{enumerable:!0,get:function(){return hO.defaultBucketOpts}});Object.defineProperty(AJ,"Kvm",{enumerable:!0,get:function(){return hO.Kvm}});Object.defineProperty(AJ,"NoopKvCodecs",{enumerable:!0,get:function(){return hO.NoopKvCodecs}});Object.defineProperty(AJ,"validateBucket",{enumerable:!0,get:function(){return hO.validateBucket}});Object.defineProperty(AJ,"validateKey",{enumerable:!0,get:function(){return hO.validateKey}})});var qf0=b((hF)=>{Object.defineProperty(hF,"__esModule",{value:!0});hF.NoopKvCodecs=hF.Kvm=hF.defaultBucketOpts=hF.Bucket=hF.Base64KeyCodec=hF.KvWatchInclude=void 0;var Qk8=Rf0();Object.defineProperty(hF,"KvWatchInclude",{enumerable:!0,get:function(){return Qk8.KvWatchInclude}});var hu=Rf0();Object.defineProperty(hF,"Base64KeyCodec",{enumerable:!0,get:function(){return hu.Base64KeyCodec}});Object.defineProperty(hF,"Bucket",{enumerable:!0,get:function(){return hu.Bucket}});Object.defineProperty(hF,"defaultBucketOpts",{enumerable:!0,get:function(){return hu.defaultBucketOpts}});Object.defineProperty(hF,"Kvm",{enumerable:!0,get:function(){return hu.Kvm}});Object.defineProperty(hF,"NoopKvCodecs",{enumerable:!0,get:function(){return hu.NoopKvCodecs}})});function U$0(){let $=new TextEncoder,Z=new TextDecoder;return{encode:(G)=>$.encode(JSON.stringify(G)),decode:(G)=>JSON.parse(Z.decode(G))}}class kf0{options;kv=null;codec=U$0();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new Gg1.Kvm($).create(Wk8,{storage:Zg1.StorageType.Memory})}async get($,Z){if(!this.kv)return null;try{let G=await this.kv.get(`${$}.${Z}`);if(!G?.value?.length)return null;if(G.operation==="DEL"||G.operation==="PURGE")return null;return this.codec.decode(G.value)}catch{return null}}async set($,Z,G){if(!this.kv)return;try{await this.kv.put(`${$}.${Z}`,this.codec.encode(G))}catch{}}async invalidate($){if(!this.kv)return;await Promise.all(["tools","resources","prompts"].map(async(G)=>{try{await this.kv.delete(`${G}.${$}`)}catch{}}))}teardown(){this.kv=null}}function Kk8($,Z,G){if(G<=0)return!0;if($===void 0)return!0;return Z-$>=G}function w$0($){return $ instanceof k1&&$.code===v1.MethodNotFound}function Uk8($){return $ instanceof k1&&$.code===-32000&&/connection closed/i.test($.message)}async function uF($,Z,G,X,Y,Q=0){if(!X)try{return await G()}catch(U){if(w$0(U))return[];return cu.add(1,{type:$,outcome:"error",stage:"no_cache"}),null}let J=`${$}:${Z}`,W=await X.get($,Z);if(W===null)try{let U=await G();return X.set($,Z,U).catch(()=>{}),Mf0.set(J,Date.now()),cu.add(1,{type:$,outcome:"miss",stage:"miss"}),U}catch(U){if(w$0(U))return X.set($,Z,[]).catch(()=>{}),[];return cu.add(1,{type:$,outcome:"error",stage:"miss"}),null}if(cu.add(1,{type:$,outcome:"hit",stage:"hit"}),Kk8(Mf0.get(J),Date.now(),Q)&&!F$0.has(J)){F$0.add(J),Mf0.set(J,Date.now());let U=G().then((w)=>X.set($,Z,w)).catch((w)=>{if(w$0(w)||Uk8(w)){if(w$0(w))X.set($,Z,[]).catch(()=>{});return}cu.add(1,{type:$,outcome:"error",stage:"revalidation"})}).finally(()=>F$0.delete(J));Y?.(U)}return W}function Sf0($){Xg1=$}function J9(){return Xg1}var Zg1,Gg1,cu,Wk8="DECOCMS_MCP_LISTS",F$0,Mf0,cF=30000,Xg1=null;var eX=O(()=>{l5();I5();Zg1=k(OB(),1),Gg1=k(qf0(),1),cu=y8.createCounter("mcp_list_cache.fetches",{description:"MCP list cache fetch outcomes (hit, miss, error)",unit:"{fetches}"});F$0=new Set;y8.createObservableGauge("mcp_list_cache.pending_revalidations",{description:"In-flight background MCP list revalidations on this pod",unit:"{revalidations}"}).addCallback(($)=>$.observe(F$0.size));Mf0=new Map});var uu=($,Z)=>{if(Z===null||Z===void 0)return;let G=$.replace(/\[(\w+)\]/g,".$1").split(".").filter(Boolean),X=Z;for(let Y of G){if(X===null||X===void 0||typeof X!=="object")return;X=X[Y]}return X};function H$0($){let Z=$.split("::");if(Z.length!==2||!Z[0]||!Z[1])throw Error(`Invalid scope format: ${$}. Expected format: "KEY::SCOPE"`);return Z}function wk8($){try{return H$0($)}catch{return null}}function Fk8($){if(typeof $==="object"&&$!==null&&"value"in $){let Z=$.value;if(typeof Z==="string")return Z}return null}function Vf0($,Z){let G={};if(!$||!Z)return G;for(let X of Z){if(X==="*"){G["*"]=["*"];continue}let Y=wk8(X);if(!Y)continue;let[Q,J]=Y,W=uu(Q,$),K=Fk8(W);if(K){if(!G[K])G[K]=[];G[K].push(J)}}return G}function Yg1($,Z){let G=Vf0($,Z);return new Set(Object.keys(G).filter((X)=>X!=="*"))}var Cf0=()=>{};async function Qg1($){if(!$.refreshToken)return{success:!1,permanent:!1,error:"No refresh token available"};if(!$.tokenEndpoint)return{success:!1,permanent:!1,error:"No token endpoint available"};if(!$.clientId)return{success:!1,permanent:!1,error:"No client ID available"};try{let Z=new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:$.clientId});if($.clientSecret)Z.set("client_secret",$.clientSecret);if($.scope)Z.set("scope",$.scope);let G=await fetch($.tokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()});if(!G.ok){let Y=await G.text(),Q,J;try{let K=JSON.parse(Y);Q=K.error,J=K.error_description}catch{}let W=G.status===400&&!!Q&&Hk8.has(Q);return(W?console.error:console.warn)("[TokenRefresh] refresh failed",{connectionId:$.connectionId,tokenEndpoint:$.tokenEndpoint,status:G.status,errorCode:Q,errorDescription:J,permanent:W}),{success:!1,permanent:W,status:G.status,errorCode:Q,error:J||Q||`Token refresh failed: ${G.status}`}}let X=await G.json();return{success:!0,accessToken:X.access_token,refreshToken:X.refresh_token||$.refreshToken,expiresIn:X.expires_in,scope:X.scope}}catch(Z){return console.warn("[TokenRefresh] network/parse error",{connectionId:$.connectionId,tokenEndpoint:$.tokenEndpoint,message:Z instanceof Error?Z.message:String(Z)}),{success:!1,permanent:!1,error:Z instanceof Error?Z.message:"Token refresh failed"}}}var Hk8;var Jg1=O(()=>{Hk8=new Set(["invalid_grant","bad_refresh_token"])});import{createHash as Nk8,randomBytes as Bk8,timingSafeEqual as Kh4}from"crypto";function Ek8($){return $.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function _f0($){return Nk8("sha256").update($).digest("hex")}function Ug1($){let Z=bf0.length+1,G=Z+Kg1;if(!$.startsWith(`${bf0}_`)||$.length<=G+1||$[G]!=="_")return null;let X=$.slice(Z,G),Y=$.slice(G+1);if(!Wg1.test(X)||!Wg1.test(Y))return null;return X}function wg1(){let $=Ek8(Bk8(Ok8)),Z=$.slice(0,Kg1),G=`${bf0}_${Z}_${$}`;return{plaintext:G,prefix:Z,hash:_f0(G)}}var bf0="stv",Ok8=32,Kg1=12,Wg1;var Fg1=O(()=>{Wg1=/^[A-Za-z0-9_-]+$/});function Hg1($){return{id:$.id,organizationId:$.organization_id,subjectConnectionId:$.subject_connection_id,tokenHash:$.token_hash,tokenPrefix:$.token_prefix,name:$.name,revokedAt:$.revoked_at,lastUsedAt:$.last_used_at,createdAt:$.created_at,updatedAt:$.updated_at}}class ff0{db;constructor($){this.db=$}async createOrRotateWorkloadToken($){let Z=$.name??"default";return await this.db.transaction().execute(async(X)=>{if(!await X.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Subject connection not found in organization");let Q=wg1(),J=new Date().toISOString();await X.updateTable("connection_workload_tokens").set({revoked_at:J,updated_at:J}).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",Z).where("revoked_at","is",null).execute();let W=await X.insertInto("connection_workload_tokens").values({id:h6("cwt"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,token_hash:Q.hash,token_prefix:Q.prefix,name:Z,revoked_at:null,last_used_at:null,created_at:J,updated_at:J}).returningAll().executeTakeFirstOrThrow();return{plaintextToken:Q.plaintext,record:Hg1(W)}})}async findActiveWorkloadToken($){let Z=await this.db.selectFrom("connection_workload_tokens").selectAll().where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",$.name??"default").where("revoked_at","is",null).executeTakeFirst();return Z?Hg1(Z):null}async revokeWorkloadToken($){let Z=new Date().toISOString();await this.db.updateTable("connection_workload_tokens").set({revoked_at:Z,updated_at:Z}).where("id","=",$.tokenId).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("revoked_at","is",null).execute()}async authenticateWorkloadToken($){let Z=Ug1($);if(!Z)return null;let G=_f0($),X=await this.db.selectFrom("connection_workload_tokens").select(["id","organization_id","subject_connection_id","token_prefix"]).where("token_prefix","=",Z).where("token_hash","=",G).where("revoked_at","is",null).executeTakeFirst();if(!X)return null;let Y=new Date().toISOString();return await this.db.updateTable("connection_workload_tokens").set({last_used_at:Y,updated_at:Y}).where("id","=",X.id).execute(),{tokenId:X.id,tokenPrefix:X.token_prefix,organizationId:X.organization_id,subjectConnectionId:X.subject_connection_id}}async replaceGrantsForSubject($){await this.db.transaction().execute(async(Z)=>{if(!await Z.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Referenced connection not found in organization");let X=[...new Set($.grants.map((J)=>J.targetConnectionId))];if(X.length>0){if((await Z.selectFrom("connections").select("id").where("organization_id","=",$.organizationId).where("id","in",X).execute()).length!==X.length)throw Error("Referenced connection not found in organization")}if(await Z.deleteFrom("connection_credential_grants").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).execute(),$.grants.length===0)return;let Y=new Date().toISOString(),Q=$.grants.map((J)=>({id:h6("ccg"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,target_connection_id:J.targetConnectionId,scope:J.scope,created_by:$.createdBy,created_at:Y,updated_at:Y}));await Z.insertInto("connection_credential_grants").values(Q).execute()})}async hasGrant($){return!!await this.db.selectFrom("connection_credential_grants").select("id").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("target_connection_id","=",$.targetConnectionId).where("scope","=",$.scope).executeTakeFirst()}}var N$0="credential:access-token:read",B$0="credential:configuration:read";var O$0=O(()=>{s7();Fg1()});function cO($){let Z=String($??"");if(Z&&!Z.includes("T"))return Z.replace(" ","T")+"Z";return Z}function I$($){return $.replace(/\0/g,"").replace(/\\/g,"\\\\").replace(/'/g,"''")}function g8($){let Z=Number($??0);return Number.isFinite(Z)?Z:0}function Lk8($){if(!Dk8.has($))throw Error(`Invalid groupByColumn: ${$}`);return $}function xf0($){if(!zk8.test($))throw Error(`Invalid JSONPath: ${$}`);if($.startsWith("$."))return $;if($.startsWith("."))return`$${$}`;return`$.${$}`}function hf0($){return $.replace(/^\$\./,"").split(".").map((G)=>`'${I$(G)}'`).join(", ")}function Ak8($){let Z=jk8.exec($);if(!Z||!Z[1]||!Z[2])throw Error(`Invalid interval: ${$}`);let G=parseInt(Z[1],10),X=Z[2],Y=Pk8[X];if(G<1||G>Y)throw Error(`Invalid interval amount: ${G}${X} (max ${Y}${X})`);return{amount:G,unit:X}}function dF($,Z,G="timestamp"){let{amount:X,unit:Y}=Ak8($),J={m:"MINUTE",h:"HOUR",d:"DAY"}[Y];if(Z==="duckdb")return`time_bucket(INTERVAL '${X} ${J}', CAST(${G} AS TIMESTAMP))`;return`toStartOfInterval(${G}, INTERVAL ${X} ${J})`}function du($,Z,G){if(G==="duckdb")return`json_extract_string(${$}, '${Z}')`;let X=hf0(Z);return`JSONExtractString(${$}, ${X})`}function Tk8($,Z,G){if(G==="duckdb")return`CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let X=hf0(Z);return`JSONExtractFloat(${$}, ${X})`}function Ng1($,Z,G){if(G==="duckdb")return`TRY_CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let X=hf0(Z);return`toFloat64OrZero(JSONExtractString(${$}, ${X}))`}function vf0($){if($===null||$===void 0)return{};if(typeof $==="object")return $;let Z=String($);try{return JSON.parse(Z)}catch{return{_decocms_truncated:Z}}}function yf0($){return{id:String($.id??""),organizationId:String($.organization_id??""),connectionId:String($.connection_id??""),toolName:String($.tool_name??""),input:vf0($.input),output:vf0($.output),isError:$.is_error===1||$.is_error===!0||$.is_error==="1"||typeof $.is_error==="bigint"&&$.is_error===1n,errorMessage:$.error_message!=null?String($.error_message):null,durationMs:Number($.duration_ms??0),timestamp:(()=>{if($.timestamp instanceof Date)return $.timestamp.toISOString();let Z=String($.timestamp??""),G=new Date(Z.includes("T")?Z:Z.replace(" ","T")+"Z");return Number.isNaN(G.getTime())?Z:G.toISOString()})(),userId:$.user_id!=null?String($.user_id):null,requestId:String($.request_id??""),userAgent:$.user_agent!=null?String($.user_agent):null,virtualMcpId:$.virtual_mcp_id!=null?String($.virtual_mcp_id):null,properties:$.properties?vf0($.properties):null}}function Dg1($,Z){let G=[];if($.properties)for(let[X,Y]of Object.entries($.properties)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Q}') = '${J}'`);else G.push(`JSONExtractString(properties, '${Q}') = '${J}'`)}if($.propertyKeys)for(let X of $.propertyKeys){let Y=I$(X);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Y}') IS NOT NULL AND json_extract_string(properties, '$.${Y}') != ''`);else G.push(`JSONExtractString(properties, '${Y}') IS NOT NULL AND JSONExtractString(properties, '${Y}') != ''`)}if($.propertyPatterns)for(let[X,Y]of Object.entries($.propertyPatterns)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Q}') ILIKE '${J}'`);else G.push(`JSONExtractString(properties, '${Q}') ILIKE '${J}'`)}if($.propertyInValues)for(let[X,Y]of Object.entries($.propertyInValues)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`list_contains(string_split(json_extract_string(properties, '$.${Q}'), ','), '${J}')`);else G.push(`has(splitByChar(',', JSONExtractString(properties, '${Q}')), '${J}')`)}return G}function Og1($,Z){let G=[];if(IJ(G,Z?.startDate,$),!Z)return G;if(Z.connectionIds?.length){let X=Z.connectionIds.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`connection_id IN (${X})`)}if(Z.toolNames?.length){let X=Z.toolNames.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`tool_name IN (${X})`)}if(Z.virtualMcpIds?.length){let X=Z.virtualMcpIds.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`virtual_mcp_id IN (${X})`)}if(Z.endDate)G.push(TJ(Z.endDate,$));if(Z.propertyFilters)G.push(...Dg1(Z.propertyFilters,$));return G}function Eg1($,Z,G="timestamp"){if(Z==="duckdb")return`CAST(${G} AS TIMESTAMP) >= TIMESTAMP '${$.toISOString()}'`;if(G==="bucket")return`${G} >= parseDateTimeBestEffort('${$.toISOString()}')`;return`${G} >= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function TJ($,Z,G="timestamp"){if(Z==="duckdb")return`CAST(${G} AS TIMESTAMP) <= TIMESTAMP '${$.toISOString()}'`;if(G==="bucket")return`${G} <= parseDateTimeBestEffort('${$.toISOString()}')`;return`${G} <= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function IJ($,Z,G,X="timestamp"){if(Z)$.push(Eg1(Z,G,X));else if(G==="clickhouse")$.push(Eg1(new Date(Date.now()-Ik8),G,X))}class cf0{engine;sourceFactory;metricEngine;metricSourceFactory;dialect;metricsFromLogs;constructor($,Z,G,X,Y="clickhouse",Q=!1){this.engine=$;this.sourceFactory=Z;this.metricEngine=G;this.metricSourceFactory=X;this.dialect=Y;this.metricsFromLogs=Q}async query($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),G=[`organization_id = '${I$($.organizationId)}'`];if($.connectionId)G.push(`connection_id = '${I$($.connectionId)}'`);if($.excludeConnectionIds?.length){let H=$.excludeConnectionIds.map((N)=>`'${I$(N)}'`).join(",");G.push(`connection_id NOT IN (${H})`)}if($.virtualMcpId)G.push(`virtual_mcp_id = '${I$($.virtualMcpId)}'`);if($.toolName)G.push(`tool_name = '${I$($.toolName)}'`);if($.isError!==void 0)G.push(`is_error = ${$.isError?1:0}`);if(IJ(G,$.startDate,this.dialect),$.endDate)G.push(TJ($.endDate,this.dialect));if($.propertyFilters)G.push(...Dg1($.propertyFilters,this.dialect));let X=1000,Y=Math.min(Math.max(1,Math.floor($.limit??50)),X),Q=Math.max(0,Math.floor($.offset??0)),J=G.join(" AND ");if(this.dialect==="duckdb"){let H=`SELECT ${Bg1}, count(*) OVER () AS _total FROM ${Z} WHERE ${J} ORDER BY timestamp DESC LIMIT ${Y} OFFSET ${Q}`,N=await this.engine.query(H);if(N.length===0)return{logs:[],total:0};let B=Number(N[0]._total??0);return{logs:N.map(yf0),total:B}}let W=`SELECT count(*) AS total FROM ${Z} WHERE ${J}`,K=`SELECT ${Bg1} FROM ${Z} WHERE ${J} ORDER BY timestamp DESC LIMIT ${Y} OFFSET ${Q}`,[U,w]=await Promise.all([this.engine.query(W),this.engine.query(K)]),F=Number(U[0]?.total??0);return{logs:w.map(yf0),total:F}}async getById($,Z){if(!$||!Z)return null;let X=`SELECT * FROM ${this.sourceFactory($)} WHERE organization_id = '${I$($)}' AND id = '${I$(Z)}' LIMIT 1`,Y=await this.engine.query(X);if(Y.length===0)return null;return yf0(Y[0])}async getStats($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),G=[`organization_id = '${I$($.organizationId)}'`];if(IJ(G,$.startDate,this.dialect),$.endDate)G.push(TJ($.endDate,this.dialect));let X=`SELECT count(*) AS total_calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1.0 ELSE 0.0 END) / NULLIF(count(*), 0), 0) AS error_rate, coalesce(avg(duration_ms), 0) AS avg_duration_ms FROM ${Z} WHERE ${G.join(" AND ")}`,Q=(await this.engine.query(X))[0]??{};return{totalCalls:Number(Q.total_calls??0),errorRate:Number(Q.error_rate??0),avgDurationMs:Number(Q.avg_duration_ms??0)}}async queryLlmUsageStats($){let Z={totalCalls:0,totalErrors:0,avgDurationMs:0,p50DurationMs:0,p95DurationMs:0,totalInputTokens:0,totalOutputTokens:0,totalTokens:0,totalCostUsd:0,topTools:[],timeseries:[]};if(!$.organizationId||!$.connectionId)return Z;let G=this.dialect,X=G==="clickhouse",Y=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=dF($.interval,G,"timestamp"),J=(L)=>`coalesce(${Ng1("properties",`$.${L}`,G)}, 0)`,W=X?"count()":"count(*)",K=X?"countIf(is_error = 1)":"count(*) FILTER (WHERE is_error = 1)",U=(L)=>X?`quantile(${L})(duration_ms)`:`quantile_cont(duration_ms, ${L})`,w=[`organization_id = '${I$($.organizationId)}'`,`connection_id = '${I$($.connectionId)}'`];if(IJ(w,$.startDate,G),$.endDate)w.push(TJ($.endDate,G));if($.userIds?.length){let L=$.userIds.slice(0,100).map((z)=>`'${I$(z)}'`).join(",");w.push(`user_id IN (${L})`)}let F=w.join(" AND "),H=Math.min(Math.max(1,Math.floor($.topN??5)),20),N=`${W} AS calls,
+</workflows>`,Ky1;var Uy1=O(()=>{$6();Ky1={id:"studio-usage-manager",title:"Usage Manager",icon:"icon://BarChart10?color=blue",description:"Analyze usage, costs, and clean up idle agents and connections",selectedTools:["MONITORING_STATS","MONITORING_LOGS_LIST","MONITORING_LOG_GET","MONITORING_THREAD_USAGE","COLLECTION_VIRTUAL_MCP_LIST","COLLECTION_VIRTUAL_MCP_GET","COLLECTION_VIRTUAL_MCP_DELETE","VIRTUAL_MCP_LAST_USED_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","COLLECTION_CONNECTIONS_DELETE","ORGANIZATION_MEMBER_LIST"],selectedConnections:null,selectedPrompts:[],instructions:jM8,getId:oX.USAGE_MANAGER}});function Z$0($){return yO.find((Z)=>$.startsWith(`${Z.id}_`))??null}async function wy1($,Z){if("resolveRuntime"in $)return $.resolveRuntime(Z);return{instructions:$.instructions,selectedTools:$.selectedTools}}async function G$0($,Z){if(!("checklist"in $))return[];return Promise.all($.checklist.map(async(G)=>({label:G.label,activeForm:G.activeForm,action:G.action,completed:await G.isCompleted(Z),alwaysSuggest:G.alwaysSuggest})))}async function Fy1($,Z,G){let X={self:w4.SELF($),registry:w4.REGISTRY($),"community-registry":w4.COMMUNITY_REGISTRY($)};await Promise.all(yO.map(async(Y)=>{let Q=Y.getId($);if(await G.findById(Q,$))return;let K=(Y.selectedConnections??["self"]).map((U)=>X[U]);await G.create($,Z,{title:Y.title,description:Y.description,icon:Y.icon,status:"active",pinned:!1,metadata:{instructions:Y.instructions},connections:K.map((U)=>({connection_id:U,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:null,selected_prompts:Y.selectedPrompts?[...Y.selectedPrompts]:null}))},{id:Q})}))}var yO;var fu=O(()=>{$6();av1();ev1();Xy1();Qy1();Wy1();Uy1();yO=[Gy1,ov1,sv1,Yy1,Jy1,Ky1]});import{DBOS as X$0}from"@dbos-inc/dbos-sdk";async function PM8($){let Z=g6(),G=new T_(Z.db);await Fy1($.orgId,$.createdBy,G)}async function AM8($){let Z=g6(),G=new T_(Z.db);for(let X of yO){let Y=X.getId($.orgId),Q=await G.findById(Y,$.orgId);if(!Q)continue;let J=X.selectedPrompts?[...X.selectedPrompts]:null;if(Q.connections.every((K)=>{let U=K.selected_prompts;if(J===null)return U===null;if(U===null)return!1;if(U.length!==J.length)return!1;return U.every((w,F)=>w===J[F])}))continue;await G.update(Y,$.createdBy,{connections:Q.connections.map((K)=>({connection_id:K.connection_id,selected_tools:K.selected_tools,selected_resources:K.selected_resources,selected_prompts:J}))})}}async function TM8($){await X$0.runStep(()=>PM8($),{name:"installStudioPack"}),await X$0.runStep(()=>AM8($),{name:"backfillSelectedPrompts"})}async function Hf0($){await X$0.startWorkflow(IM8,{workflowID:`install-studio-pack:${RM8}:${$.orgId}`})($)}async function Hy1(){let Z=await g6().db.selectFrom("member").select(["organizationId","userId"]).orderBy("createdAt","asc").execute(),G=new Map;for(let X of Z)if(!G.has(X.organizationId))G.set(X.organizationId,X.userId);await Promise.all(Array.from(G).map(async([X,Y])=>{try{await Hf0({orgId:X,createdBy:Y})}catch(Q){console.error("[studio-pack-backfill] enqueue failed",{orgId:X},Q)}}))}var IM8,RM8="v2";var Y$0=O(()=>{LJ();Ff0();fu();IM8=X$0.registerWorkflow(TM8,{name:"installStudioPackWorkflow"})});import{jwtVerify as qM8,SignJWT as Ny1}from"jose";import{randomBytes as MM8}from"crypto";function By1(){if(xu)return xu;let $=L1(),Z=$.meshJwtSecret??$.betterAuthSecret;if(Z)xu=new TextEncoder().encode(Z);else console.warn("MESH_JWT_SECRET not set - generating random secret (not persistent)"),xu=new Uint8Array(MM8(32));return xu}async function Oy1($,Z="5m"){let G=By1();return await new Ny1($).setProtectedHeader({alg:"HS256",typ:"JWT"}).setIssuedAt().setExpirationTime(Z).sign(G)}async function Nf0($){try{let Z=By1(),{payload:G}=await qM8($,Z);return G}catch{return}}async function yF($,Z,G=3600){let X=L1(),Y=X.meshJwtSecret??X.betterAuthSecret;if(!Y)throw Error("A deterministic JWT secret is required to mint gateway JWTs \u2014 set MESH_JWT_SECRET or BETTER_AUTH_SECRET");let Q=new TextEncoder().encode(Y);return await new Ny1({iss:"mesh",sub:$,...Z&&{email:Z}}).setProtectedHeader({alg:"HS256",typ:"JWT"}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1000)+G).sign(Q)}var xu=null;var gO=O(()=>{q8()});class vu{constructor(){this._messageQueue=[]}static createLinkedPair(){let $=new vu,Z=new vu;return $._otherTransport=Z,Z._otherTransport=$,[$,Z]}async start(){while(this._messageQueue.length>0){let $=this._messageQueue.shift();this.onmessage?.($.message,$.extra)}}async close(){let $=this._otherTransport;this._otherTransport=void 0,await $?.close(),this.onclose?.()}async send($,Z){if(!this._otherTransport)throw Error("Not connected");if(this._otherTransport.onmessage)this._otherTransport.onmessage($,{authInfo:Z?.authInfo});else this._otherTransport._messageQueue.push({message:$,extra:{authInfo:Z?.authInfo}})}}import{SpanStatusCode as Ey1}from"@opentelemetry/api";function Q0($){return{...$,execute:async(Z,G)=>{return await G.timings.measure(`tool.${$.name}`,async()=>G.tracer.startActiveSpan(`tool.${$.name}`,{attributes:{"tool.name":$.name,"organization.id":G.organization?.id??"system","user.id":G.auth.user?.id??G.auth.apiKey?.userId??"anonymous"}},async(X)=>{try{G.toolName=$.name,G.access.setToolName?.($.name);let Y=await $.handler(Z,G);return X.setStatus({code:Ey1.OK}),Y}catch(Y){throw X.setStatus({code:Ey1.ERROR,message:Y.message}),X.recordException(Y),Y}finally{X.end()}}))}}}var W1=()=>{};function E0($){if(!$.organization)throw Error("This operation requires organization scope");return $.organization}function l1($){return $.auth.user?.id??$.auth.apiKey?.userId}function kM8($){return!!($.auth.user||$.auth.apiKey)}function b0($){if(!kM8($))throw Error("Authentication required")}import{z as G6}from"zod";var Q$0,Dy1,Ly1,zy1,jy1,Py1,Ay1,Ty1,Iy1,Ry1;var I_=O(()=>{Q$0=G6.record(G6.string(),G6.array(G6.string())),Dy1=G6.object({id:G6.string().describe("Unique identifier for the API key"),name:G6.string().describe("Human-readable name for the API key"),userId:G6.string().describe("ID of the user who owns this API key"),permissions:Q$0.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Example: { "self": ["API_KEY_CREATE"], "conn_abc123": ["SEND_MESSAGE"] }'),expiresAt:G6.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:G6.string().datetime().describe("When the API key was created (ISO 8601)")}),Ly1=G6.object({name:G6.string().min(1).max(64).describe("Human-readable name for the API key"),permissions:Q$0.describe(`Permissions to grant (REQUIRED \u2014 there is no implicit default). Format: { resource: [actions] }. Resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names (e.g., ["ORGANIZATION_GET"]) or ["*"] for all. Example: { "self": ["ORGANIZATION_GET", "COLLECTION_CONNECTIONS_LIST"] }. The key is authorized solely by this allowlist; the creator's role does not widen it.`),expiresIn:G6.number().positive().optional().describe("Expiration time in seconds. If not provided, key never expires."),metadata:G6.record(G6.string(),G6.unknown()).optional().describe("Additional metadata to store with the API key")}),zy1=G6.object({id:G6.string().describe("Unique identifier for the API key"),name:G6.string().describe("Human-readable name for the API key"),key:G6.string().describe("The actual API key value. STORE THIS SECURELY - it will not be shown again!"),permissions:Q$0.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools'),expiresAt:G6.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:G6.string().datetime().describe("When the API key was created (ISO 8601)")}),jy1=G6.object({}),Py1=G6.object({items:G6.array(Dy1).describe("List of API keys (without key values)")}),Ay1=G6.object({keyId:G6.string().describe("ID of the API key to update"),name:G6.string().min(1).max(64).optional().describe("New name for the API key"),permissions:Q$0.optional().describe('New permissions. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names or "*" for all. Example: { "self": ["API_KEY_CREATE"] }. Replaces existing permissions.'),metadata:G6.record(G6.string(),G6.unknown()).optional().describe("New metadata. Replaces existing metadata.")}),Ty1=G6.object({item:Dy1.describe("The updated API key (without key value)")}),Iy1=G6.object({keyId:G6.string().describe("ID of the API key to delete")}),Ry1=G6.object({success:G6.boolean().describe("Whether the deletion was successful"),keyId:G6.string().describe("ID of the deleted API key")})});var Bf0;var qy1=O(()=>{f4();W1();I_();Bf0=Q0({name:"API_KEY_CREATE",description:"Create an API key with scoped permissions. The key value is returned only once \u2014 store it immediately.",annotations:{title:"Create API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Ly1,outputSchema:zy1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=await Z.boundAuth.apiKey.create({name:$.name,permissions:$.permissions,expiresIn:$.expiresIn,metadata:{...$.metadata,organization:Z.organization}}),X=G.expiresAt?G.expiresAt instanceof Date?G.expiresAt.toISOString():G.expiresAt:null,Y=G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,Q=l1(Z);if(Q)p1.capture({distinctId:Q,event:"api_key_created",...Z.organization?.id?{groups:{organization:Z.organization.id}}:{},properties:{key_id:G.id,key_name:G.name??$.name,organization_id:Z.organization?.id,has_expiry:!!X}});return{id:G.id,name:G.name??$.name,key:G.key,permissions:G.permissions??{},expiresAt:X,createdAt:Y}}})});var Of0;var My1=O(()=>{f4();W1();I_();Of0=Q0({name:"API_KEY_DELETE",description:"Delete and instantly revoke an API key. Cannot be undone.",annotations:{title:"Delete API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Iy1,outputSchema:Ry1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=l1(Z);if(!G)throw Error("User ID required to delete API key");let Y=(await Z.boundAuth.apiKey.list())?.find((K)=>K.id===$.keyId);if(!Y)throw Error("API key not found");let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot delete API key from another organization");if(await Z.boundAuth.apiKey.delete($.keyId),W)p1.capture({distinctId:G,event:"api_key_deleted",groups:{organization:W},properties:{key_id:$.keyId,organization_id:W}});return{success:!0,keyId:$.keyId}}})});var Ef0;var ky1=O(()=>{W1();I_();Ef0=Q0({name:"API_KEY_LIST",description:"List API keys for the current user in the current organization. Returns metadata only \u2014 key values are never shown after creation.",annotations:{title:"List API Keys",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jy1,outputSchema:Py1,handler:async($,Z)=>{b0(Z),await Z.access.check();let G=await Z.boundAuth.apiKey.list(),X=Z.organization?.id;return{items:(G??[]).filter((Q)=>{return Q.metadata?.organization?.id===X}).map((Q)=>({id:Q.id,name:Q.name??"Unnamed Key",userId:Q.userId,permissions:Q.permissions??{},expiresAt:Q.expiresAt?Q.expiresAt instanceof Date?Q.expiresAt.toISOString():Q.expiresAt:null,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});var Df0;var Sy1=O(()=>{W1();I_();Df0=Q0({name:"API_KEY_UPDATE",description:"Update an API key's name, permissions, or metadata. The key value cannot be changed or retrieved.",annotations:{title:"Update API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ay1,outputSchema:Ty1,handler:async($,Z)=>{if(b0(Z),await Z.access.check(),!l1(Z))throw Error("User ID required to update API key");let Y=(await Z.boundAuth.apiKey.list())?.find((U)=>U.id===$.keyId);if(!Y)throw Error(`API key not found: ${$.keyId}`);let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot update API key from another organization");let K=await Z.boundAuth.apiKey.update({keyId:$.keyId,name:$.name,permissions:$.permissions,metadata:{...$.metadata,organization:Z.organization}});if(!K)throw Error(`Failed to update API key: ${$.keyId}`);return{item:{id:K.id,name:K.name??$.name??"Unnamed Key",userId:K.userId,permissions:K.permissions??{},expiresAt:K.expiresAt?K.expiresAt instanceof Date?K.expiresAt.toISOString():K.expiresAt:null,createdAt:K.createdAt instanceof Date?K.createdAt.toISOString():K.createdAt}}}})});var Vy1=O(()=>{qy1();My1();ky1();Sy1();I_()});function J$0($){let Z=$.trim();if(!Z)return{ok:!1,error:"Enter a website URL."};let G=VM8.test(Z),X=CM8.test(Z),Y=bM8.test(Z);if(G&&!X&&!Y)return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let Q=X?Z:`https://${Z}`,J;try{J=new URL(Q)}catch{return{ok:!1,error:"Enter a valid website URL."}}if(J.protocol!=="http:"&&J.protocol!=="https:")return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let W=J.hostname.split(".");if(W.length<2||W.some((K)=>!K||!_M8.test(K)))return{ok:!1,error:"Enter a valid website URL."};return J.protocol="https:",{ok:!0,value:J.origin}}var VM8,CM8,bM8,_M8;var Lf0=O(()=>{VM8=/^[a-zA-Z][a-zA-Z\d+.-]*:/,CM8=/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//,bM8=/^[^\s/:?#]+\.[^\s/:?#]+:\d+(?:[/?#]|$)/,_M8=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i});import{z as Cy1}from"zod";function by1($){if($.baseUrl)return $.baseUrl.replace(/\/+$/,"");return(($.settings??L1()).commerceDiscoveryInternalApiUrl??fM8).replace(/\/+$/,"")}function _y1($){let Z=$.apiKey??($.settings??L1()).commerceDiscoveryInternalApiKey;if(!Z)throw Error("COMMERCE_DISCOVERY_INTERNAL_API_KEY is required to set up Commerce Discovery.");return Z}function fy1($){return new URL($).hostname}async function xy1($){let Z=`Commerce Discovery auth failed with status ${$.status}.`,G=await $.text().catch(()=>"");if(!G)return Z;try{let X=JSON.parse(G),Y=typeof X.error==="string"?X.error:typeof X.message==="string"?X.message:null;return Y?`Commerce Discovery auth failed: ${Y}.`:Z}catch{return Z}}async function zf0($,Z={}){let G=by1(Z),X=_y1(Z),Y=Z.fetchImpl??fetch,Q=fy1($.siteUrl),J=`${G}/api/v2/internal/diagnostics/${encodeURIComponent(Q)}/upgrade`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${X}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.orgName?{name:$.orgName}:{},...$.email?{email:$.email}:{},...$.reportUrl?{report_url:$.reportUrl}:{}})});if(!W.ok)throw Error(await xy1(W));let K=xM8.safeParse(await W.json());if(!K.success)throw Error("Commerce Discovery auth response did not include a token.");return{authorizationToken:K.data.token}}async function vy1($,Z={}){let G=by1(Z),X=_y1(Z),Y=Z.fetchImpl??fetch,Q=fy1($.siteUrl),J=`${G}/api/v2/internal/diagnostics/${encodeURIComponent(Q)}/run`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${X}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId})});if(W.status===409)return{triggered:!1,reason:"not_upgraded"};if(!W.ok)throw Error(await xy1(W));return{triggered:!0}}var fM8,xM8;var jf0=O(()=>{$6();q8();fM8=new URL(BC0).origin,xM8=Cy1.object({token:Cy1.string().min(1)})});import{z as yu}from"zod";var vM8,yM8,Pf0;var yy1=O(()=>{Lf0();W1();jf0();vM8=yu.object({siteUrl:yu.string().min(1).describe("Website URL to run the diagnostic for.")}),yM8=yu.object({triggered:yu.boolean(),reason:yu.string().optional()}),Pf0=Q0({name:"COMMERCE_DISCOVERY_RUN",description:"Trigger the Commerce Discovery diagnostic run for the current organization's store. Call once the data sources (GA4/GSC/VTEX) are connected \u2014 this run resolves credentials and produces the enriched report.",annotations:{title:"Run Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:vM8,outputSchema:yM8,handler:async($,Z)=>{b0(Z);let G=E0(Z);await Z.access.check();let X=J$0($.siteUrl);if(!X.ok)throw Error(X.error);return vy1({siteUrl:X.value,orgId:G.id})}})});var gF=O(()=>{t00()});import{z as o3}from"zod";function cM8($){return!$.connection_token}async function uM8($,Z,G,X){let Y=await $.storage.connections.findById(Z,G);if(Y)return Y;throw X}async function dM8($,Z,G,X){let Y=await $.storage.virtualMcps.findById(Z,G);if(Y)return Y;throw X}var gy1,gM8,hM8,Af0;var hy1=O(()=>{$6();Lf0();W1();r3();gF();jf0();gy1=OC0,gM8=o3.object({siteUrl:o3.string().min(1).describe("Website URL to configure.")}),hM8=o3.object({connection:mZ,virtualMcp:iZ,reportApp:o3.object({connectionId:o3.string(),virtualMcpId:o3.string(),toolName:o3.literal(gy1)}),created:o3.object({connection:o3.boolean(),virtualMcp:o3.boolean()})});Af0=Q0({name:"COMMERCE_DISCOVERY_SETUP",description:"Create or return the Commerce Discovery connection and virtual MCP for the current organization.",annotations:{title:"Set Up Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gM8,outputSchema:hM8,handler:async($,Z)=>{b0(Z);let G=E0(Z);await Z.access.check("COLLECTION_CONNECTIONS_CREATE");let X=l1(Z);if(!X)throw Error("User ID required to set up Commerce Discovery");let Y=J$0($.siteUrl);if(!Y.ok)throw Error(Y.error);let Q=w4.COMMERCE_DISCOVERY(G.id),J=TC0(G.id),W={email:Z.auth.user?.email,reportUrl:`${Z.baseUrl}/commerce-onboarding?org=${encodeURIComponent(G.slug??G.id)}&siteUrl=${encodeURIComponent(Y.value)}`},K=await Z.storage.connections.findById(Q,G.id),U={connection:!1,virtualMcp:!1};if(K&&cM8(K)){let F=await zf0({siteUrl:Y.value,orgId:G.id,orgName:G.name,...W});if(F.authorizationToken)console.log("[commerce-discovery] repairing missing auth token",{orgId:G.id,siteUrl:Y.value,connectionId:Q}),K=await Z.storage.connections.update(K.id,{connection_token:F.authorizationToken})}if(!K){let F=await zf0({siteUrl:Y.value,orgId:G.id,orgName:G.name,...W});console.log("[commerce-discovery] creating connection",{orgId:G.id,siteUrl:Y.value,connectionId:Q});try{let H=IC0(G.id,F.authorizationToken);K=await Z.storage.connections.create({...H,metadata:{...H.metadata??{},siteUrl:Y.value},organization_id:G.id,created_by:X}),U.connection=!0}catch(H){K=await uM8(Z,Q,G.id,H)}}let w=await Z.storage.virtualMcps.findById(J,G.id);if(!w){console.log("[commerce-discovery] creating virtual MCP",{orgId:G.id,siteUrl:Y.value,connectionId:K.id,virtualMcpId:J});try{w=await Z.storage.virtualMcps.create(G.id,X,RC0(G.id,K.id),{id:J}),U.virtualMcp=!0}catch(F){w=await dM8(Z,J,G.id,F)}}if(!w.pinned)w=await Z.storage.virtualMcps.update(w.id,X,{pinned:!0});return{connection:K,virtualMcp:w,reportApp:{connectionId:K.id,virtualMcpId:w.id,toolName:gy1},created:U}}})});var cy1=O(()=>{yy1();hy1()});var Tf0=b((uy1)=>{Object.defineProperty(uy1,"__esModule",{value:!0});uy1.kvPrefix=uy1.KvWatchInclude=void 0;uy1.KvWatchInclude={LastValue:"",AllHistory:"history",UpdatesOnly:"updates"};uy1.kvPrefix="KV_"});var ey1=b((ay1)=>{Object.defineProperty(ay1,"__esModule",{value:!0});ay1.KvStatusImpl=ay1.Bucket=ay1.Kvm=ay1.kvOperationHdr=void 0;ay1.Base64KeyCodec=iM8;ay1.NoopKvCodecs=If0;ay1.defaultBucketOpts=my1;ay1.validateKey=iy1;ay1.validateSearchKey=ny1;ay1.hasWildcards=py1;ay1.validateBucket=W$0;var k5=hX(),p4=zr(),M5=Tf0();function iM8(){let $=(Z,G)=>{let X=[];for(let Y of Z.split("."))switch(Y){case">":case"*":X.push(Y);break;default:X.push(G(Y));break}return X.join(".")};return{encode(Z){return $(Z,btoa)},decode(Z){return $(Z,atob)}}}function If0(){return{key:{encode($){return $},decode($){return $}},value:{encode($){return typeof $==="string"?new TextEncoder().encode($):$},decode($){return $}}}}function my1(){return{replicas:1,history:1,timeout:2000,max_bytes:-1,maxValueSize:-1,codec:If0(),storage:p4.StorageType.File}}ay1.kvOperationHdr="KV-Operation";var ly1="$KV",nM8=/^[-/=.\w]+$/,pM8=/^[-/=.>*\w]+$/,tM8=/^[-\w]+$/;function iy1($){if($.startsWith(".")||$.endsWith(".")||!nM8.test($))throw Error(`invalid key: ${$}`)}function ny1($){if($.startsWith(".")||$.endsWith(".")||$.includes("..")||!pM8.test($))throw Error(`invalid key: ${$}`)}function py1($){if($.startsWith(".")||$.endsWith("."))throw Error(`invalid key: ${$}`);let Z=$.split("."),G=!1;for(let X=0;X<Z.length;X++)switch(Z[X]){case"*":G=!0;break;case">":if(X!==Z.length-1)throw Error(`invalid key: ${$}`);G=!0;break;default:}return G}function W$0($){if(!tM8.test($))throw Error(`invalid bucket name: ${$}`)}class ty1{js;constructor($){this.js=(0,p4.toJetStreamClient)($)}create($,Z={}){return this.#$($,Z)}open($,Z={}){return Z.bindOnly=!0,this.#$($,Z)}#$($,Z={}){let{ok:G,min:X}=this.js.nc.features.get(k5.Feature.JS_KV);if(!G)return Promise.reject(Error(`kv is only supported on servers ${X} or better`));if(Z.bindOnly)return R_.bind(this.js,$,Z);return R_.create(this.js,$,Z)}list(){let $=(G)=>{let Y=G.streams.filter((J)=>{return J.config.name.startsWith(M5.kvPrefix)});Y.forEach((J)=>{J.config.sealed=J.config.sealed||!1,J.config.deny_delete=J.config.deny_delete||!1,J.config.deny_purge=J.config.deny_purge||!1,J.config.allow_rollup_hdrs=J.config.allow_rollup_hdrs||!1});let Q="";if(Y.length)Q=this.js.nc.info?.cluster??"";return Y.map((J)=>{return new K$0(J,Q)})},Z=`${this.js.prefix}.STREAM.LIST`;return new p4.ListerImpl(Z,$,this.js)}}ay1.Kvm=ty1;class R_{js;jsm;stream;bucket;direct;codec;prefix;editPrefix;useJsPrefix;_prefixLen;constructor($,Z,G){W$0($),this.js=Z,this.jsm=G,this.bucket=$,this.prefix=ly1,this.editPrefix="",this.useJsPrefix=!1,this._prefixLen=0}static async create($,Z,G={}){W$0(Z);let X=await $.jetstreamManager(),Y=new R_(Z,$,X);return await Y.init(G),Y}static async bind($,Z,G={}){let X=$.getOptions()?.checkAPI||G.bindOnly===!1,Y=await $.jetstreamManager(X),Q={config:{allow_direct:G.allow_direct}};W$0(Z);let J=new R_(Z,$,Y);return Q.config.name=G.streamName??J.bucketName(),Object.assign(J,Q),J.stream=Q.config.name,J.codec=G.codec||If0(),J.direct=Q.config.allow_direct??!1,J.initializePrefixes(Q),J}async init($={}){let Z=Object.assign(my1(),$);this.codec=Z.codec;let G={};if(this.stream=G.name=$.streamName??this.bucketName(),G.retention=p4.RetentionPolicy.Limits,G.max_msgs_per_subject=Z.history,Z.max_bytes)G.max_bytes=Z.max_bytes;if(G.max_msg_size=Z.maxValueSize,G.storage=Z.storage,$.placement)G.placement=$.placement;if($.republish)G.republish=$.republish;if($.description)G.description=$.description;if($.markerTTL)G.allow_msg_ttl=!0,G.subject_delete_marker_ttl=(0,k5.nanos)(Z.markerTTL);if($.mirror){let U=Object.assign({},$.mirror);if(!U.name.startsWith(M5.kvPrefix))U.name=`${M5.kvPrefix}${U.name}`;G.mirror=U,G.mirror_direct=!0}else if($.sources){let U=$.sources.map((w)=>{let F=Object.assign({},w),H=F.name.startsWith(M5.kvPrefix)?F.name.substring(M5.kvPrefix.length):F.name;if(!F.name.startsWith(M5.kvPrefix))F.name=`${M5.kvPrefix}${F.name}`;if(!w.external&&H!==this.bucket)F.subject_transforms=[{src:`$KV.${H}.>`,dest:`$KV.${this.bucket}.>`}];return F});G.sources=U,G.subjects=[this.subjectForBucket()]}else G.subjects=[this.subjectForBucket()];if($.metadata)G.metadata=$.metadata;if(typeof $.compression==="boolean")G.compression=$.compression?p4.StoreCompression.S2:p4.StoreCompression.None;let X=this.js.nc,Y=X.getServerVersion(),Q=Y?(0,k5.compare)(Y,(0,k5.parseSemVer)("2.7.2"))>=0:!1;G.discard=Q?p4.DiscardPolicy.New:p4.DiscardPolicy.Old;let{ok:J,min:W}=X.features.get(k5.Feature.JS_ALLOW_DIRECT);if(!J&&$.allow_direct===!0){let U=Y?`${Y.major}.${Y.minor}.${Y.micro}`:"unknown";return Promise.reject(Error(`allow_direct is not available on server version ${U} - requires ${W}`))}if($.allow_direct=typeof $.allow_direct==="boolean"?$.allow_direct:J,G.allow_direct=$.allow_direct,this.direct=G.allow_direct,G.num_replicas=Z.replicas,Z.ttl)G.max_age=(0,k5.nanos)(Z.ttl);G.allow_rollup_hdrs=!0;let K;try{if(K=await this.jsm.streams.info(G.name),!K.config.allow_direct&&this.direct===!0)this.direct=!1}catch(U){if(U.message==="stream not found")K=await this.jsm.streams.add(G);else throw U}this.initializePrefixes(K)}initializePrefixes($){this._prefixLen=0,this.prefix=`$KV.${this.bucket}`,this.useJsPrefix=this.js.apiPrefix!=="$JS.API";let{mirror:Z}=$.config;if(Z){let G=Z.name;if(G.startsWith(M5.kvPrefix))G=G.substring(M5.kvPrefix.length);if(Z.external&&Z.external.api!==""){let X=Z.name.substring(M5.kvPrefix.length);this.useJsPrefix=!1,this.prefix=`$KV.${X}`,this.editPrefix=`${Z.external.api}.$KV.${G}`}else this.editPrefix=this.prefix}}bucketName(){return this.stream??`${M5.kvPrefix}${this.bucket}`}subjectForBucket(){return`${this.prefix}.${this.bucket}.>`}subjectForKey($,Z=!1){let G=[];if(Z){if(this.useJsPrefix)G.push(this.js.apiPrefix);if(this.editPrefix!=="")G.push(this.editPrefix);else G.push(this.prefix)}else if(this.prefix)G.push(this.prefix);return G.push($),G.join(".")}fullKeyName($){if(this.prefix!=="")return`${this.prefix}.${$}`;return`${ly1}.${this.bucket}.${$}`}get prefixLen(){if(this._prefixLen===0)this._prefixLen=this.prefix.length+1;return this._prefixLen}encodeKey($){let Z=[];for(let G of $.split("."))switch(G){case">":case"*":Z.push(G);break;default:Z.push(this.codec.key.encode(G));break}return Z.join(".")}decodeKey($){let Z=[];for(let G of $.split("."))switch(G){case">":case"*":Z.push(G);break;default:Z.push(this.codec.key.decode(G));break}return Z.join(".")}validateKey=iy1;validateSearchKey=ny1;hasWildcards=py1;close(){return Promise.resolve()}dataLen($,Z){let G=Z?Z.get(p4.JsHeaders.MessageSizeHdr)||"":"";if(G!=="")return parseInt(G,10);return $.length}smToEntry($){return new ry1(this.bucket,this.prefixLen,$,this.codec)}jmToWatchEntry($,Z){return new oy1(this.bucket,this.prefixLen,$,Z,this.codec)}async create($,Z,G){let X;try{let Q={previousSeq:0},J=await this._put($,Z,Q,G);return Promise.resolve(J)}catch(Q){if(X=Q,Q instanceof p4.JetStreamApiError){let J=Q;if(J.code!==p4.JetStreamApiCodes.StreamWrongLastSequence&&J.code!==p4.JetStreamApiCodes.StreamWrongLastSequenceUnknown)return Promise.reject(Q)}}let Y=0;try{let Q=await this.get($);if(Q?.operation==="DEL"||Q?.operation==="PURGE")return Y=Q!==null?Q.revision:0,this._put($,Z,{previousSeq:Y},G);else return Promise.reject(X)}catch(Q){return Promise.reject(Q)}}update($,Z,G,X){if(G<=0)throw Error("version must be greater than 0");return this.put($,Z,{previousSeq:G,timeout:X})}async _put($,Z,G={},X){let Y=this.encodeKey($);this.validateKey(Y),Z=this.codec.value.encode(Z);let Q={timeout:G?.timeout};if(G.previousSeq!==void 0){let J=(0,k5.headers)();Q.headers=J,J.set(p4.PubHeaders.ExpectedLastSubjectSequenceHdr,`${G.previousSeq}`)}if(X)(Q.headers||(0,k5.headers)()).set(p4.PubHeaders.MessageTTL,X);try{return(await this.js.publish(this.subjectForKey(Y,!0),Z,Q)).seq}catch(J){return Promise.reject(J)}}put($,Z,G={}){return this._put($,Z,G)}async get($,Z){let G=this.encodeKey($);this.validateKey(G);let X={last_by_subj:this.subjectForKey(G)};if(Z&&Z.revision>0)X={seq:Z.revision};let Y=null;try{if(this.direct)Y=await this.jsm.direct.getMessage(this.bucketName(),X);else Y=await this.jsm.streams.getMessage(this.bucketName(),X);if(Y===null)return null;let Q=this.smToEntry(Y);if(Q.rawKey!==G)return null;return Q}catch(Q){throw Q}}purge($,Z){return this._deleteOrPurge($,"PURGE",Z)}delete($,Z){return this._deleteOrPurge($,"DEL",Z)}async purgeDeletes($=1800000){let Z=[],G=await this.history({key:">"});await(async()=>{for await(let J of G)if(J.operation==="DEL"||J.operation==="PURGE")Z.push(J)})().then(),G.stop();let X=Date.now()-$,Y=Z.map((J)=>{let W=this.subjectForKey(J.key);if(J.created.getTime()>=X)return this.jsm.streams.purge(this.stream,{filter:W,keep:1});else return this.jsm.streams.purge(this.stream,{filter:W,keep:0})}),Q=await Promise.all(Y);return Q.unshift({success:!0,purged:0}),Q.reduce((J,W)=>{return J.purged+=W.purged,J})}async _deleteOrPurge($,Z,G){if(!this.hasWildcards($))return this._doDeleteOrPurge($,Z,G);let X=await this.keys($),Y=[];for await(let Q of X)if(Y.push(this._doDeleteOrPurge(Q,Z)),Y.length===100)await Promise.all(Y),Y.length=0;if(Y.length>0)await Promise.all(Y)}async _doDeleteOrPurge($,Z,G){let X=this.encodeKey($);this.validateKey(X);let Y=(0,k5.headers)();if(Y.set(ay1.kvOperationHdr,Z),Z==="PURGE"){let Q=G;if(Y.set(p4.JsHeaders.RollupHdr,p4.JsHeaders.RollupValueSubject),typeof Q?.ttl==="string"&&Q.ttl!=="")Y.set(p4.PubHeaders.MessageTTL,`${Q.ttl}`)}if(G?.previousSeq)Y.set(p4.PubHeaders.ExpectedLastSubjectSequenceHdr,`${G.previousSeq}`);await this.js.publish(this.subjectForKey(X,!0),k5.Empty,{headers:Y})}_buildCC($,Z,G={}){let Y=(!Array.isArray($)?[$]:$).map((W)=>{let K=this.encodeKey(W);return this.validateSearchKey(W),this.fullKeyName(K)}),Q=p4.DeliverPolicy.LastPerSubject;if(Z===M5.KvWatchInclude.AllHistory)Q=p4.DeliverPolicy.All;if(Z===M5.KvWatchInclude.UpdatesOnly)Q=p4.DeliverPolicy.New;let J=void 0;if(Y.length===1)J=Y[0],Y=void 0;return Object.assign({deliver_policy:Q,ack_policy:p4.AckPolicy.None,filter_subjects:Y,filter_subject:J,flow_control:!0,idle_heartbeat:(0,k5.nanos)(5000)},G)}remove($){return this.purge($)}async history($={}){let Z=$.key??">",G={};G.headers_only=$.headers_only||!1;let X=new k5.QueuedIteratorImpl,Y=()=>{X.stop()},Q=this._buildCC(Z,M5.KvWatchInclude.AllHistory,G),J=await this.js.consumers.getPushConsumer(this.stream,Q);if(X._data=J,(await J.info(!0)).num_pending===0)return X.push(Y),X;let K=await J.consume({callback:(U)=>{let w=this.jmToWatchEntry(U,!1);if(X.push(w),X.received++,U.info.pending===0)X.push(Y)}});return K.closed().then(()=>{X.push(Y)}),(async()=>{for await(let U of K.status())switch(U.type){case"heartbeat":X.push(()=>{X.stop()});break}})().then(),X.iterClosed.then(()=>{K.stop()}),X}canSetWatcherName(){let $=this.js.nc,{ok:Z}=$.features.get(k5.Feature.JS_NEW_CONSUMER_CREATE_API);return Z}async watch($={}){let Z=$.key??">",G=new k5.QueuedIteratorImpl,X={};X.headers_only=$.headers_only||!1;let Y=M5.KvWatchInclude.LastValue;if($.include===M5.KvWatchInclude.AllHistory)Y=M5.KvWatchInclude.AllHistory;else if($.include===M5.KvWatchInclude.UpdatesOnly)Y=M5.KvWatchInclude.UpdatesOnly;let Q=$.ignoreDeletes===!0,J=this._buildCC(Z,Y,X);if(J.name=`KV_WATCHER_${k5.nuid.next()}`,$.resumeFromRevision&&$.resumeFromRevision>0)J.deliver_policy=p4.DeliverPolicy.StartSequence,J.opt_start_seq=$.resumeFromRevision;let W=await this.js.consumers.getPushConsumer(this.stream,J),U=(await W.info(!0)).num_pending,w=Y===M5.KvWatchInclude.UpdatesOnly||U===0;G._data=W;let F=0,H=await W.consume({callback:(N)=>{if(!w)F++,w=F>=U;let B=this.jmToWatchEntry(N,w);if(Q&&B.operation==="DEL")return;G.push(B),G.received++}});return G.iterClosed.then(()=>{H.stop()}),H.closed().then(()=>{G.push(()=>{G.stop()})}),G}async keys($=">"){let Z=new k5.QueuedIteratorImpl,G=this._buildCC($,M5.KvWatchInclude.LastValue,{headers_only:!0}),X=await this.js.consumers.getPushConsumer(this.stream,G);if((await X.info()).num_pending===0)return Z.stop(),Z;Z._data=X;let Q=await X.consume({callback:(J)=>{let W=J.headers?.get(ay1.kvOperationHdr);if(W!=="DEL"&&W!=="PURGE"){let K=this.decodeKey(J.subject.substring(this.prefixLen));Z.push(K)}if(J.info.pending===0)Q.stop()}});return(async()=>{for await(let J of Q.status())switch(J.type){case"heartbeat":Z.push(()=>{Z.stop()});break}})().then(),Q.closed().then(()=>{Z.push(()=>{Z.stop()})}),Z.iterClosed.then(()=>{Q.stop()}),Z}purgeBucket($){return this.jsm.streams.purge(this.bucketName(),$)}destroy(){return this.jsm.streams.delete(this.bucketName())}async status(){let Z=this.js.nc.info?.cluster??"",G=this.bucketName(),X=await this.jsm.streams.info(G);return new K$0(X,Z)}}ay1.Bucket=R_;class K$0{si;cluster;constructor($,Z=""){this.si=$,this.cluster=Z}get bucket(){return this.si.config.name.startsWith(M5.kvPrefix)?this.si.config.name.substring(M5.kvPrefix.length):this.si.config.name}get values(){return this.si.state.messages}get history(){return this.si.config.max_msgs_per_subject}get ttl(){return(0,k5.millis)(this.si.config.max_age)}get markerTTL(){if(typeof this.si.config.subject_delete_marker_ttl==="number")return(0,k5.millis)(this.si.config.subject_delete_marker_ttl);return 0}get bucket_location(){return this.cluster}get backingStore(){return this.si.config.storage}get storage(){return this.si.config.storage}get replicas(){return this.si.config.num_replicas}get description(){return this.si.config.description??""}get maxBucketSize(){return this.si.config.max_bytes}get maxValueSize(){return this.si.config.max_msg_size}get max_bytes(){return this.si.config.max_bytes}get placement(){return this.si.config.placement||{cluster:"",tags:[]}}get placementCluster(){return this.si.config.placement?.cluster??""}get republish(){return this.si.config.republish??{src:"",dest:""}}get streamInfo(){return this.si}get size(){return this.si.state.bytes}get metadata(){return this.si.config.metadata??{}}get compression(){if(this.si.config.compression)return this.si.config.compression!==p4.StoreCompression.None;return!1}}ay1.KvStatusImpl=K$0;class ry1{bucket;sm;prefixLen;codec;constructor($,Z,G,X){this.bucket=$,this.prefixLen=Z,this.sm=G,this.codec=X}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get delta(){return 0}get created(){return this.sm.time}get revision(){return this.sm.seq}get operation(){if(this.sm.header?.has("Nats-Marker-Reason")){if(this.sm.header?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.header?.get(ay1.kvOperationHdr)||"PUT"}get length(){let $=this.sm.header.get(p4.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}json($){return JSON.parse(k5.TD.decode(this.value),$)}string(){return k5.TD.decode(this.value)}}class oy1{bucket;sm;prefixLen;update;codec;constructor($,Z,G,X,Y){this.bucket=$,this.prefixLen=Z,this.sm=G,this.update=X,this.codec=Y}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get created(){return new Date((0,k5.millis)(this.sm.info.timestampNanos))}get revision(){return this.sm.seq}get operation(){if(this.sm.headers?.has("Nats-Marker-Reason")){if(this.sm.headers?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.headers?.get(ay1.kvOperationHdr)||"PUT"}get delta(){return this.sm.info.pending}get length(){let $=this.sm.headers?.get(p4.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}get isUpdate(){return this.update}json($){return JSON.parse(k5.TD.decode(this.value),$)}string(){return k5.TD.decode(this.value)}}});var Rf0=b((AJ)=>{Object.defineProperty(AJ,"__esModule",{value:!0});AJ.validateKey=AJ.validateBucket=AJ.NoopKvCodecs=AJ.Kvm=AJ.defaultBucketOpts=AJ.Bucket=AJ.Base64KeyCodec=AJ.KvWatchInclude=AJ.kvPrefix=void 0;var $g1=Tf0();Object.defineProperty(AJ,"kvPrefix",{enumerable:!0,get:function(){return $g1.kvPrefix}});Object.defineProperty(AJ,"KvWatchInclude",{enumerable:!0,get:function(){return $g1.KvWatchInclude}});var hO=ey1();Object.defineProperty(AJ,"Base64KeyCodec",{enumerable:!0,get:function(){return hO.Base64KeyCodec}});Object.defineProperty(AJ,"Bucket",{enumerable:!0,get:function(){return hO.Bucket}});Object.defineProperty(AJ,"defaultBucketOpts",{enumerable:!0,get:function(){return hO.defaultBucketOpts}});Object.defineProperty(AJ,"Kvm",{enumerable:!0,get:function(){return hO.Kvm}});Object.defineProperty(AJ,"NoopKvCodecs",{enumerable:!0,get:function(){return hO.NoopKvCodecs}});Object.defineProperty(AJ,"validateBucket",{enumerable:!0,get:function(){return hO.validateBucket}});Object.defineProperty(AJ,"validateKey",{enumerable:!0,get:function(){return hO.validateKey}})});var qf0=b((hF)=>{Object.defineProperty(hF,"__esModule",{value:!0});hF.NoopKvCodecs=hF.Kvm=hF.defaultBucketOpts=hF.Bucket=hF.Base64KeyCodec=hF.KvWatchInclude=void 0;var Qk8=Rf0();Object.defineProperty(hF,"KvWatchInclude",{enumerable:!0,get:function(){return Qk8.KvWatchInclude}});var hu=Rf0();Object.defineProperty(hF,"Base64KeyCodec",{enumerable:!0,get:function(){return hu.Base64KeyCodec}});Object.defineProperty(hF,"Bucket",{enumerable:!0,get:function(){return hu.Bucket}});Object.defineProperty(hF,"defaultBucketOpts",{enumerable:!0,get:function(){return hu.defaultBucketOpts}});Object.defineProperty(hF,"Kvm",{enumerable:!0,get:function(){return hu.Kvm}});Object.defineProperty(hF,"NoopKvCodecs",{enumerable:!0,get:function(){return hu.NoopKvCodecs}})});function U$0(){let $=new TextEncoder,Z=new TextDecoder;return{encode:(G)=>$.encode(JSON.stringify(G)),decode:(G)=>JSON.parse(Z.decode(G))}}class kf0{options;kv=null;codec=U$0();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new Gg1.Kvm($).create(Wk8,{storage:Zg1.StorageType.Memory})}async get($,Z){if(!this.kv)return null;try{let G=await this.kv.get(`${$}.${Z}`);if(!G?.value?.length)return null;if(G.operation==="DEL"||G.operation==="PURGE")return null;return this.codec.decode(G.value)}catch{return null}}async set($,Z,G){if(!this.kv)return;try{await this.kv.put(`${$}.${Z}`,this.codec.encode(G))}catch{}}async invalidate($){if(!this.kv)return;await Promise.all(["tools","resources","prompts"].map(async(G)=>{try{await this.kv.delete(`${G}.${$}`)}catch{}}))}teardown(){this.kv=null}}function Kk8($,Z,G){if(G<=0)return!0;if($===void 0)return!0;return Z-$>=G}function w$0($){return $ instanceof k1&&$.code===v1.MethodNotFound}function Uk8($){return $ instanceof k1&&$.code===-32000&&/connection closed/i.test($.message)}async function uF($,Z,G,X,Y,Q=0){if(!X)try{return await G()}catch(U){if(w$0(U))return[];return cu.add(1,{type:$,outcome:"error",stage:"no_cache"}),null}let J=`${$}:${Z}`,W=await X.get($,Z);if(W===null)try{let U=await G();return X.set($,Z,U).catch(()=>{}),Mf0.set(J,Date.now()),cu.add(1,{type:$,outcome:"miss",stage:"miss"}),U}catch(U){if(w$0(U))return X.set($,Z,[]).catch(()=>{}),[];return cu.add(1,{type:$,outcome:"error",stage:"miss"}),null}if(cu.add(1,{type:$,outcome:"hit",stage:"hit"}),Kk8(Mf0.get(J),Date.now(),Q)&&!F$0.has(J)){F$0.add(J),Mf0.set(J,Date.now());let U=G().then((w)=>X.set($,Z,w)).catch((w)=>{if(w$0(w)||Uk8(w)){if(w$0(w))X.set($,Z,[]).catch(()=>{});return}cu.add(1,{type:$,outcome:"error",stage:"revalidation"})}).finally(()=>F$0.delete(J));Y?.(U)}return W}function Sf0($){Xg1=$}function J9(){return Xg1}var Zg1,Gg1,cu,Wk8="DECOCMS_MCP_LISTS",F$0,Mf0,cF=30000,Xg1=null;var eX=O(()=>{l5();I5();Zg1=k(OB(),1),Gg1=k(qf0(),1),cu=y8.createCounter("mcp_list_cache.fetches",{description:"MCP list cache fetch outcomes (hit, miss, error)",unit:"{fetches}"});F$0=new Set;y8.createObservableGauge("mcp_list_cache.pending_revalidations",{description:"In-flight background MCP list revalidations on this pod",unit:"{revalidations}"}).addCallback(($)=>$.observe(F$0.size));Mf0=new Map});var uu=($,Z)=>{if(Z===null||Z===void 0)return;let G=$.replace(/\[(\w+)\]/g,".$1").split(".").filter(Boolean),X=Z;for(let Y of G){if(X===null||X===void 0||typeof X!=="object")return;X=X[Y]}return X};function H$0($){let Z=$.split("::");if(Z.length!==2||!Z[0]||!Z[1])throw Error(`Invalid scope format: ${$}. Expected format: "KEY::SCOPE"`);return Z}function wk8($){try{return H$0($)}catch{return null}}function Fk8($){if(typeof $==="object"&&$!==null&&"value"in $){let Z=$.value;if(typeof Z==="string")return Z}return null}function Vf0($,Z){let G={};if(!$||!Z)return G;for(let X of Z){if(X==="*"){G["*"]=["*"];continue}let Y=wk8(X);if(!Y)continue;let[Q,J]=Y,W=uu(Q,$),K=Fk8(W);if(K){if(!G[K])G[K]=[];G[K].push(J)}}return G}function Yg1($,Z){let G=Vf0($,Z);return new Set(Object.keys(G).filter((X)=>X!=="*"))}var Cf0=()=>{};async function Qg1($){if(!$.refreshToken)return{success:!1,permanent:!1,error:"No refresh token available"};if(!$.tokenEndpoint)return{success:!1,permanent:!1,error:"No token endpoint available"};if(!$.clientId)return{success:!1,permanent:!1,error:"No client ID available"};try{let Z=new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:$.clientId});if($.clientSecret)Z.set("client_secret",$.clientSecret);if($.scope)Z.set("scope",$.scope);let G=await fetch($.tokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()});if(!G.ok){let Y=await G.text(),Q,J;try{let K=JSON.parse(Y);Q=K.error,J=K.error_description}catch{}let W=G.status===400&&!!Q&&Hk8.has(Q);return(W?console.error:console.warn)("[TokenRefresh] refresh failed",{connectionId:$.connectionId,tokenEndpoint:$.tokenEndpoint,status:G.status,errorCode:Q,errorDescription:J,permanent:W}),{success:!1,permanent:W,status:G.status,errorCode:Q,error:J||Q||`Token refresh failed: ${G.status}`}}let X=await G.json();return{success:!0,accessToken:X.access_token,refreshToken:X.refresh_token||$.refreshToken,expiresIn:X.expires_in,scope:X.scope}}catch(Z){return console.warn("[TokenRefresh] network/parse error",{connectionId:$.connectionId,tokenEndpoint:$.tokenEndpoint,message:Z instanceof Error?Z.message:String(Z)}),{success:!1,permanent:!1,error:Z instanceof Error?Z.message:"Token refresh failed"}}}var Hk8;var Jg1=O(()=>{Hk8=new Set(["invalid_grant","bad_refresh_token"])});import{createHash as Nk8,randomBytes as Bk8,timingSafeEqual as Kh4}from"crypto";function Ek8($){return $.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function _f0($){return Nk8("sha256").update($).digest("hex")}function Ug1($){let Z=bf0.length+1,G=Z+Kg1;if(!$.startsWith(`${bf0}_`)||$.length<=G+1||$[G]!=="_")return null;let X=$.slice(Z,G),Y=$.slice(G+1);if(!Wg1.test(X)||!Wg1.test(Y))return null;return X}function wg1(){let $=Ek8(Bk8(Ok8)),Z=$.slice(0,Kg1),G=`${bf0}_${Z}_${$}`;return{plaintext:G,prefix:Z,hash:_f0(G)}}var bf0="stv",Ok8=32,Kg1=12,Wg1;var Fg1=O(()=>{Wg1=/^[A-Za-z0-9_-]+$/});function Hg1($){return{id:$.id,organizationId:$.organization_id,subjectConnectionId:$.subject_connection_id,tokenHash:$.token_hash,tokenPrefix:$.token_prefix,name:$.name,revokedAt:$.revoked_at,lastUsedAt:$.last_used_at,createdAt:$.created_at,updatedAt:$.updated_at}}class ff0{db;constructor($){this.db=$}async createOrRotateWorkloadToken($){let Z=$.name??"default";return await this.db.transaction().execute(async(X)=>{if(!await X.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Subject connection not found in organization");let Q=wg1(),J=new Date().toISOString();await X.updateTable("connection_workload_tokens").set({revoked_at:J,updated_at:J}).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",Z).where("revoked_at","is",null).execute();let W=await X.insertInto("connection_workload_tokens").values({id:h6("cwt"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,token_hash:Q.hash,token_prefix:Q.prefix,name:Z,revoked_at:null,last_used_at:null,created_at:J,updated_at:J}).returningAll().executeTakeFirstOrThrow();return{plaintextToken:Q.plaintext,record:Hg1(W)}})}async findActiveWorkloadToken($){let Z=await this.db.selectFrom("connection_workload_tokens").selectAll().where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",$.name??"default").where("revoked_at","is",null).executeTakeFirst();return Z?Hg1(Z):null}async revokeWorkloadToken($){let Z=new Date().toISOString();await this.db.updateTable("connection_workload_tokens").set({revoked_at:Z,updated_at:Z}).where("id","=",$.tokenId).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("revoked_at","is",null).execute()}async authenticateWorkloadToken($){let Z=Ug1($);if(!Z)return null;let G=_f0($),X=await this.db.selectFrom("connection_workload_tokens").select(["id","organization_id","subject_connection_id","token_prefix"]).where("token_prefix","=",Z).where("token_hash","=",G).where("revoked_at","is",null).executeTakeFirst();if(!X)return null;let Y=new Date().toISOString();return await this.db.updateTable("connection_workload_tokens").set({last_used_at:Y,updated_at:Y}).where("id","=",X.id).execute(),{tokenId:X.id,tokenPrefix:X.token_prefix,organizationId:X.organization_id,subjectConnectionId:X.subject_connection_id}}async replaceGrantsForSubject($){await this.db.transaction().execute(async(Z)=>{if(!await Z.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Referenced connection not found in organization");let X=[...new Set($.grants.map((J)=>J.targetConnectionId))];if(X.length>0){if((await Z.selectFrom("connections").select("id").where("organization_id","=",$.organizationId).where("id","in",X).execute()).length!==X.length)throw Error("Referenced connection not found in organization")}if(await Z.deleteFrom("connection_credential_grants").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).execute(),$.grants.length===0)return;let Y=new Date().toISOString(),Q=$.grants.map((J)=>({id:h6("ccg"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,target_connection_id:J.targetConnectionId,scope:J.scope,created_by:$.createdBy,created_at:Y,updated_at:Y}));await Z.insertInto("connection_credential_grants").values(Q).execute()})}async hasGrant($){return!!await this.db.selectFrom("connection_credential_grants").select("id").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("target_connection_id","=",$.targetConnectionId).where("scope","=",$.scope).executeTakeFirst()}}var N$0="credential:access-token:read",B$0="credential:configuration:read";var O$0=O(()=>{s7();Fg1()});function cO($){let Z=String($??"");if(Z&&!Z.includes("T"))return Z.replace(" ","T")+"Z";return Z}function I$($){return $.replace(/\0/g,"").replace(/\\/g,"\\\\").replace(/'/g,"''")}function g8($){let Z=Number($??0);return Number.isFinite(Z)?Z:0}function Lk8($){if(!Dk8.has($))throw Error(`Invalid groupByColumn: ${$}`);return $}function xf0($){if(!zk8.test($))throw Error(`Invalid JSONPath: ${$}`);if($.startsWith("$."))return $;if($.startsWith("."))return`$${$}`;return`$.${$}`}function hf0($){return $.replace(/^\$\./,"").split(".").map((G)=>`'${I$(G)}'`).join(", ")}function Ak8($){let Z=jk8.exec($);if(!Z||!Z[1]||!Z[2])throw Error(`Invalid interval: ${$}`);let G=parseInt(Z[1],10),X=Z[2],Y=Pk8[X];if(G<1||G>Y)throw Error(`Invalid interval amount: ${G}${X} (max ${Y}${X})`);return{amount:G,unit:X}}function dF($,Z,G="timestamp"){let{amount:X,unit:Y}=Ak8($),J={m:"MINUTE",h:"HOUR",d:"DAY"}[Y];if(Z==="duckdb")return`time_bucket(INTERVAL '${X} ${J}', CAST(${G} AS TIMESTAMP))`;return`toStartOfInterval(${G}, INTERVAL ${X} ${J})`}function du($,Z,G){if(G==="duckdb")return`json_extract_string(${$}, '${Z}')`;let X=hf0(Z);return`JSONExtractString(${$}, ${X})`}function Tk8($,Z,G){if(G==="duckdb")return`CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let X=hf0(Z);return`JSONExtractFloat(${$}, ${X})`}function Ng1($,Z,G){if(G==="duckdb")return`TRY_CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let X=hf0(Z);return`toFloat64OrZero(JSONExtractString(${$}, ${X}))`}function vf0($){if($===null||$===void 0)return{};if(typeof $==="object")return $;let Z=String($);try{return JSON.parse(Z)}catch{return{_decocms_truncated:Z}}}function yf0($){return{id:String($.id??""),organizationId:String($.organization_id??""),connectionId:String($.connection_id??""),toolName:String($.tool_name??""),input:vf0($.input),output:vf0($.output),isError:$.is_error===1||$.is_error===!0||$.is_error==="1"||typeof $.is_error==="bigint"&&$.is_error===1n,errorMessage:$.error_message!=null?String($.error_message):null,durationMs:Number($.duration_ms??0),timestamp:(()=>{if($.timestamp instanceof Date)return $.timestamp.toISOString();let Z=String($.timestamp??""),G=new Date(Z.includes("T")?Z:Z.replace(" ","T")+"Z");return Number.isNaN(G.getTime())?Z:G.toISOString()})(),userId:$.user_id!=null?String($.user_id):null,requestId:String($.request_id??""),userAgent:$.user_agent!=null?String($.user_agent):null,virtualMcpId:$.virtual_mcp_id!=null?String($.virtual_mcp_id):null,properties:$.properties?vf0($.properties):null}}function Dg1($,Z){let G=[];if($.properties)for(let[X,Y]of Object.entries($.properties)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Q}') = '${J}'`);else G.push(`JSONExtractString(properties, '${Q}') = '${J}'`)}if($.propertyKeys)for(let X of $.propertyKeys){let Y=I$(X);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Y}') IS NOT NULL AND json_extract_string(properties, '$.${Y}') != ''`);else G.push(`JSONExtractString(properties, '${Y}') IS NOT NULL AND JSONExtractString(properties, '${Y}') != ''`)}if($.propertyPatterns)for(let[X,Y]of Object.entries($.propertyPatterns)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`json_extract_string(properties, '$.${Q}') ILIKE '${J}'`);else G.push(`JSONExtractString(properties, '${Q}') ILIKE '${J}'`)}if($.propertyInValues)for(let[X,Y]of Object.entries($.propertyInValues)){let Q=I$(X),J=I$(Y);if(Z==="duckdb")G.push(`list_contains(string_split(json_extract_string(properties, '$.${Q}'), ','), '${J}')`);else G.push(`has(splitByChar(',', JSONExtractString(properties, '${Q}')), '${J}')`)}return G}function Og1($,Z){let G=[];if(IJ(G,Z?.startDate,$),!Z)return G;if(Z.connectionIds?.length){let X=Z.connectionIds.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`connection_id IN (${X})`)}if(Z.toolNames?.length){let X=Z.toolNames.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`tool_name IN (${X})`)}if(Z.virtualMcpIds?.length){let X=Z.virtualMcpIds.map((Y)=>`'${I$(Y)}'`).join(",");G.push(`virtual_mcp_id IN (${X})`)}if(Z.endDate)G.push(TJ(Z.endDate,$));if(Z.propertyFilters)G.push(...Dg1(Z.propertyFilters,$));return G}function Eg1($,Z,G="timestamp"){if(Z==="duckdb")return`CAST(${G} AS TIMESTAMP) >= TIMESTAMP '${$.toISOString()}'`;if(G==="bucket")return`${G} >= parseDateTimeBestEffort('${$.toISOString()}')`;return`${G} >= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function TJ($,Z,G="timestamp"){if(Z==="duckdb")return`CAST(${G} AS TIMESTAMP) <= TIMESTAMP '${$.toISOString()}'`;if(G==="bucket")return`${G} <= parseDateTimeBestEffort('${$.toISOString()}')`;return`${G} <= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function IJ($,Z,G,X="timestamp"){if(Z)$.push(Eg1(Z,G,X));else if(G==="clickhouse")$.push(Eg1(new Date(Date.now()-Ik8),G,X))}class cf0{engine;sourceFactory;metricEngine;metricSourceFactory;dialect;metricsFromLogs;constructor($,Z,G,X,Y="clickhouse",Q=!1){this.engine=$;this.sourceFactory=Z;this.metricEngine=G;this.metricSourceFactory=X;this.dialect=Y;this.metricsFromLogs=Q}async query($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),G=[`organization_id = '${I$($.organizationId)}'`];if($.connectionId)G.push(`connection_id = '${I$($.connectionId)}'`);if($.excludeConnectionIds?.length){let H=$.excludeConnectionIds.map((N)=>`'${I$(N)}'`).join(",");G.push(`connection_id NOT IN (${H})`)}if($.virtualMcpId)G.push(`virtual_mcp_id = '${I$($.virtualMcpId)}'`);if($.toolName)G.push(`tool_name = '${I$($.toolName)}'`);if($.isError!==void 0)G.push(`is_error = ${$.isError?1:0}`);if(IJ(G,$.startDate,this.dialect),$.endDate)G.push(TJ($.endDate,this.dialect));if($.propertyFilters)G.push(...Dg1($.propertyFilters,this.dialect));let X=1000,Y=Math.min(Math.max(1,Math.floor($.limit??50)),X),Q=Math.max(0,Math.floor($.offset??0)),J=G.join(" AND ");if(this.dialect==="duckdb"){let H=`SELECT ${Bg1}, count(*) OVER () AS _total FROM ${Z} WHERE ${J} ORDER BY timestamp DESC LIMIT ${Y} OFFSET ${Q}`,N=await this.engine.query(H);if(N.length===0)return{logs:[],total:0};let B=Number(N[0]._total??0);return{logs:N.map(yf0),total:B}}let W=`SELECT count(*) AS total FROM ${Z} WHERE ${J}`,K=`SELECT ${Bg1} FROM ${Z} WHERE ${J} ORDER BY timestamp DESC LIMIT ${Y} OFFSET ${Q}`,[U,w]=await Promise.all([this.engine.query(W),this.engine.query(K)]),F=Number(U[0]?.total??0);return{logs:w.map(yf0),total:F}}async getById($,Z){if(!$||!Z)return null;let X=`SELECT * FROM ${this.sourceFactory($)} WHERE organization_id = '${I$($)}' AND id = '${I$(Z)}' LIMIT 1`,Y=await this.engine.query(X);if(Y.length===0)return null;return yf0(Y[0])}async getStats($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),G=[`organization_id = '${I$($.organizationId)}'`];if(IJ(G,$.startDate,this.dialect),$.endDate)G.push(TJ($.endDate,this.dialect));let X=`SELECT count(*) AS total_calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1.0 ELSE 0.0 END) / NULLIF(count(*), 0), 0) AS error_rate, coalesce(avg(duration_ms), 0) AS avg_duration_ms FROM ${Z} WHERE ${G.join(" AND ")}`,Q=(await this.engine.query(X))[0]??{};return{totalCalls:Number(Q.total_calls??0),errorRate:Number(Q.error_rate??0),avgDurationMs:Number(Q.avg_duration_ms??0)}}async queryLlmUsageStats($){let Z={totalCalls:0,totalErrors:0,avgDurationMs:0,p50DurationMs:0,p95DurationMs:0,totalInputTokens:0,totalOutputTokens:0,totalTokens:0,totalCostUsd:0,topTools:[],timeseries:[]};if(!$.organizationId||!$.connectionId)return Z;let G=this.dialect,X=G==="clickhouse",Y=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=dF($.interval,G,"timestamp"),J=(L)=>`coalesce(${Ng1("properties",`$.${L}`,G)}, 0)`,W=X?"count()":"count(*)",K=X?"countIf(is_error = 1)":"count(*) FILTER (WHERE is_error = 1)",U=(L)=>X?`quantile(${L})(duration_ms)`:`quantile_cont(duration_ms, ${L})`,w=[`organization_id = '${I$($.organizationId)}'`,`connection_id = '${I$($.connectionId)}'`];if(IJ(w,$.startDate,G),$.endDate)w.push(TJ($.endDate,G));if($.userIds?.length){let L=$.userIds.slice(0,100).map((z)=>`'${I$(z)}'`).join(",");w.push(`user_id IN (${L})`)}let F=w.join(" AND "),H=Math.min(Math.max(1,Math.floor($.topN??5)),20),N=`${W} AS calls,
   ${K} AS errors,
   avg(duration_ms) AS avg,
   sum(${J("input_tokens")}) AS in_tok,
@@ -2560,5 +2560,5 @@ NKEYs are sensitive and should be treated as secrets.
 -----BEGIN USER NKEY SEED-----
 ${G}
 ------END USER NKEY SEED------
-`;return new TextEncoder().encode(X)}var Z11,hV,Ge6,MM$,$11="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",Ye6,h$,g$,a8,qM$=24,cV,O3;var fM$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(Z11||(Z11={}));(function($){var Z=function(g,l){this.hi=g|0,this.lo=l|0},G=function(g){var l,h=new Float64Array(16);if(g)for(l=0;l<g.length;l++)h[l]=g[l];return h},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(g,l){return g<<l|g>>>32-l}function E(g,l){var h=g[l+3]&255;return h=h<<8|g[l+2]&255,h=h<<8|g[l+1]&255,h<<8|g[l+0]&255}function D(g,l){var h=g[l]<<24|g[l+1]<<16|g[l+2]<<8|g[l+3],r=g[l+4]<<24|g[l+5]<<16|g[l+6]<<8|g[l+7];return new Z(h,r)}function L(g,l,h){var r;for(r=0;r<4;r++)g[l+r]=h&255,h>>>=8}function z(g,l,h){g[l]=h.hi>>24&255,g[l+1]=h.hi>>16&255,g[l+2]=h.hi>>8&255,g[l+3]=h.hi&255,g[l+4]=h.lo>>24&255,g[l+5]=h.lo>>16&255,g[l+6]=h.lo>>8&255,g[l+7]=h.lo&255}function j(g,l,h,r,X0){var W0,_0=0;for(W0=0;W0<X0;W0++)_0|=g[l+W0]^h[r+W0];return(1&_0-1>>>8)-1}function P(g,l,h,r){return j(g,l,h,r,16)}function A(g,l,h,r){return j(g,l,h,r,32)}function M(g,l,h,r,X0){var W0=new Uint32Array(16),_0=new Uint32Array(16),l0=new Uint32Array(16),P0=new Uint32Array(4),M0,j0,g0;for(M0=0;M0<4;M0++)_0[5*M0]=E(r,4*M0),_0[1+M0]=E(h,4*M0),_0[6+M0]=E(l,4*M0),_0[11+M0]=E(h,16+4*M0);for(M0=0;M0<16;M0++)l0[M0]=_0[M0];for(M0=0;M0<20;M0++){for(j0=0;j0<4;j0++){for(g0=0;g0<4;g0++)P0[g0]=_0[(5*j0+4*g0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(g0=0;g0<4;g0++)W0[4*j0+(j0+g0)%4]=P0[g0]}for(g0=0;g0<16;g0++)_0[g0]=W0[g0]}if(X0){for(M0=0;M0<16;M0++)_0[M0]=_0[M0]+l0[M0]|0;for(M0=0;M0<4;M0++)_0[5*M0]=_0[5*M0]-E(r,4*M0)|0,_0[6+M0]=_0[6+M0]-E(l,4*M0)|0;for(M0=0;M0<4;M0++)L(g,4*M0,_0[5*M0]),L(g,16+4*M0,_0[6+M0])}else for(M0=0;M0<16;M0++)L(g,4*M0,_0[M0]+l0[M0]|0)}function S(g,l,h,r){return M(g,l,h,r,!1),0}function q(g,l,h,r){return M(g,l,h,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function t(g,l,h,r,X0,W0,_0){var l0=new Uint8Array(16),P0=new Uint8Array(64),M0,j0;if(!X0)return 0;for(j0=0;j0<16;j0++)l0[j0]=0;for(j0=0;j0<8;j0++)l0[j0]=W0[j0];while(X0>=64){S(P0,l0,_0,V);for(j0=0;j0<64;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0];M0=1;for(j0=8;j0<16;j0++)M0=M0+(l0[j0]&255)|0,l0[j0]=M0&255,M0>>>=8;if(X0-=64,l+=64,h)r+=64}if(X0>0){S(P0,l0,_0,V);for(j0=0;j0<X0;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0]}return 0}function f(g,l,h,r,X0){return t(g,l,null,0,h,r,X0)}function v(g,l,h,r,X0){var W0=new Uint8Array(32);return q(W0,r,X0,V),f(g,l,h,r.subarray(16),W0)}function e(g,l,h,r,X0,W0,_0){var l0=new Uint8Array(32);return q(l0,W0,_0,V),t(g,l,h,r,X0,W0.subarray(16),l0)}function o(g,l){var h,r=0;for(h=0;h<17;h++)r=r+(g[h]+l[h]|0)|0,g[h]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function O0(g,l,h,r,X0,W0){var _0,l0,P0,M0,j0=new Uint32Array(17),g0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),K1=new Uint32Array(17);for(P0=0;P0<17;P0++)g0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)g0[P0]=W0[P0];g0[3]&=15,g0[4]&=252,g0[7]&=15,g0[8]&=252,g0[11]&=15,g0[12]&=252,g0[15]&=15;while(X0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<X0;++P0)Z1[P0]=h[r+P0];Z1[P0]=1,r+=P0,X0-=P0,o(o0,Z1);for(l0=0;l0<17;l0++){j0[l0]=0;for(P0=0;P0<17;P0++)j0[l0]=j0[l0]+o0[P0]*(P0<=l0?g0[l0-P0]:320*g0[l0+17-P0]|0)|0|0}for(l0=0;l0<17;l0++)o0[l0]=j0[l0];M0=0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0&3,M0=5*(M0>>>2)|0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0}for(P0=0;P0<17;P0++)K1[P0]=o0[P0];o(o0,B0),_0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=_0&(K1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)g[l+P0]=o0[P0];return 0}function K0(g,l,h,r,X0,W0){var _0=new Uint8Array(16);return O0(_0,0,h,r,X0,W0),P(g,l,_0,0)}function J0(g,l,h,r,X0){var W0;if(h<32)return-1;e(g,0,l,0,h,r,X0),O0(g,16,g,32,h-32,g);for(W0=0;W0<16;W0++)g[W0]=0;return 0}function s(g,l,h,r,X0){var W0,_0=new Uint8Array(32);if(h<32)return-1;if(v(_0,0,32,r,X0),K0(l,16,l,32,h-32,_0)!==0)return-1;e(g,0,l,0,h,r,X0);for(W0=0;W0<32;W0++)g[W0]=0;return 0}function T0(g,l){var h;for(h=0;h<16;h++)g[h]=l[h]|0}function F0(g){var l,h;for(h=0;h<16;h++)g[h]+=65536,l=Math.floor(g[h]/65536),g[(h+1)*(h<15?1:0)]+=l-1+37*(l-1)*(h===15?1:0),g[h]-=l*65536}function f0(g,l,h){var r,X0=~(h-1);for(var W0=0;W0<16;W0++)r=X0&(g[W0]^l[W0]),g[W0]^=r,l[W0]^=r}function m0(g,l){var h,r,X0,W0=G(),_0=G();for(h=0;h<16;h++)_0[h]=l[h];F0(_0),F0(_0),F0(_0);for(r=0;r<2;r++){W0[0]=_0[0]-65517;for(h=1;h<15;h++)W0[h]=_0[h]-65535-(W0[h-1]>>16&1),W0[h-1]&=65535;W0[15]=_0[15]-32767-(W0[14]>>16&1),X0=W0[15]>>16&1,W0[14]&=65535,f0(_0,W0,1-X0)}for(h=0;h<16;h++)g[2*h]=_0[h]&255,g[2*h+1]=_0[h]>>8}function x0(g,l){var h=new Uint8Array(32),r=new Uint8Array(32);return m0(h,g),m0(r,l),A(h,0,r,0)}function i0(g){var l=new Uint8Array(32);return m0(l,g),l[0]&1}function H0(g,l){var h;for(h=0;h<16;h++)g[h]=l[2*h]+(l[2*h+1]<<8);g[15]&=32767}function S0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]+h[r]|0}function R0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]-h[r]|0}function w0(g,l,h){var r,X0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(X0=0;X0<16;X0++)W0[r+X0]+=l[r]*h[X0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)g[r]=W0[r];F0(g),F0(g)}function Y0(g,l){w0(g,l,l)}function G0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=253;r>=0;r--)if(Y0(h,h),r!==2&&r!==4)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function k0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=250;r>=0;r--)if(Y0(h,h),r!==1)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function i(g,l,h){var r=new Uint8Array(32),X0=new Float64Array(80),W0,_0,l0=G(),P0=G(),M0=G(),j0=G(),g0=G(),o0=G();for(_0=0;_0<31;_0++)r[_0]=l[_0];r[31]=l[31]&127|64,r[0]&=248,H0(X0,h);for(_0=0;_0<16;_0++)P0[_0]=X0[_0],j0[_0]=l0[_0]=M0[_0]=0;l0[0]=j0[0]=1;for(_0=254;_0>=0;--_0)W0=r[_0>>>3]>>>(_0&7)&1,f0(l0,P0,W0),f0(M0,j0,W0),S0(g0,l0,M0),R0(l0,l0,M0),S0(M0,P0,j0),R0(P0,P0,j0),Y0(j0,g0),Y0(o0,l0),w0(l0,M0,l0),w0(M0,P0,g0),S0(g0,l0,M0),R0(l0,l0,M0),Y0(P0,l0),R0(M0,j0,o0),w0(l0,M0,K),S0(l0,l0,j0),w0(M0,M0,l0),w0(l0,j0,o0),w0(j0,P0,X0),Y0(P0,g0),f0(l0,P0,W0),f0(M0,j0,W0);for(_0=0;_0<16;_0++)X0[_0+16]=l0[_0],X0[_0+32]=M0[_0],X0[_0+48]=P0[_0],X0[_0+64]=j0[_0];var Z1=X0.subarray(32),K1=X0.subarray(16);return G0(Z1,Z1),w0(K1,K1,Z1),m0(g,K1),0}function $0(g,l){return i(g,l,Q)}function p0(g,l){return X(l,32),$0(g,l)}function I0(g,l,h){var r=new Uint8Array(32);return i(r,h,l),q(g,Y,r,V)}var d=J0,m=s;function V0(g,l,h,r,X0,W0){var _0=new Uint8Array(32);return I0(_0,X0,W0),d(g,l,h,r,_0)}function v0(g,l,h,r,X0,W0){var _0=new Uint8Array(32);return I0(_0,X0,W0),m(g,l,h,r,_0)}function r0(){var g=0,l=0,h=0,r=0,X0=65535,W0,_0,l0;for(l0=0;l0<arguments.length;l0++)W0=arguments[l0].lo,_0=arguments[l0].hi,g+=W0&X0,l+=W0>>>16,h+=_0&X0,r+=_0>>>16;return l+=g>>>16,h+=l>>>16,r+=h>>>16,new Z(h&X0|r<<16,g&X0|l<<16)}function s0(g,l){return new Z(g.hi>>>l,g.lo>>>l|g.hi<<32-l)}function x1(){var g=0,l=0,h;for(h=0;h<arguments.length;h++)g^=arguments[h].lo,l^=arguments[h].hi;return new Z(l,g)}function W8(g,l){var h,r,X0=32-l;if(l<32)h=g.hi>>>l|g.lo<<X0,r=g.lo>>>l|g.hi<<X0;else if(l<64)h=g.lo>>>l|g.hi<<X0,r=g.hi>>>l|g.lo<<X0;return new Z(h,r)}function z4(g,l,h){var r=g.hi&l.hi^~g.hi&h.hi,X0=g.lo&l.lo^~g.lo&h.lo;return new Z(r,X0)}function l4(g,l,h){var r=g.hi&l.hi^g.hi&h.hi^l.hi&h.hi,X0=g.lo&l.lo^g.lo&h.lo^l.lo&h.lo;return new Z(r,X0)}function F5(g){return x1(W8(g,28),W8(g,34),W8(g,39))}function Z0(g){return x1(W8(g,14),W8(g,18),W8(g,41))}function J1(g){return x1(W8(g,1),W8(g,8),s0(g,7))}function m8(g){return x1(W8(g,19),W8(g,61),s0(g,6))}var t$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function D9(g,l,h){var r=[],X0=[],W0=[],_0=[],l0,P0,M0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=D(g,8*P0);var j0=0;while(h>=128){for(P0=0;P0<16;P0++)_0[P0]=D(l,8*P0+j0);for(P0=0;P0<80;P0++){for(M0=0;M0<8;M0++)X0[M0]=W0[M0];l0=r0(W0[7],Z0(W0[4]),z4(W0[4],W0[5],W0[6]),t$[P0],_0[P0%16]),X0[7]=r0(l0,F5(W0[0]),l4(W0[0],W0[1],W0[2])),X0[3]=r0(X0[3],l0);for(M0=0;M0<8;M0++)W0[(M0+1)%8]=X0[M0];if(P0%16===15)for(M0=0;M0<16;M0++)_0[M0]=r0(_0[M0],_0[(M0+9)%16],J1(_0[(M0+1)%16]),m8(_0[(M0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=r0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,h-=128}for(P0=0;P0<8;P0++)z(g,8*P0,r[P0]);return h}var _7=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function P8(g,l,h){var r=new Uint8Array(64),X0=new Uint8Array(256),W0,_0=h;for(W0=0;W0<64;W0++)r[W0]=_7[W0];D9(r,l,h),h%=128;for(W0=0;W0<256;W0++)X0[W0]=0;for(W0=0;W0<h;W0++)X0[W0]=l[_0-h+W0];X0[h]=128,h=256-128*(h<112?1:0),X0[h-9]=0,z(X0,h-8,new Z(_0/536870912|0,_0<<3)),D9(r,X0,h);for(W0=0;W0<64;W0++)g[W0]=r[W0];return 0}function I6(g,l){var h=G(),r=G(),X0=G(),W0=G(),_0=G(),l0=G(),P0=G(),M0=G(),j0=G();R0(h,g[1],g[0]),R0(j0,l[1],l[0]),w0(h,h,j0),S0(r,g[0],g[1]),S0(j0,l[0],l[1]),w0(r,r,j0),w0(X0,g[3],l[3]),w0(X0,X0,w),w0(W0,g[2],l[2]),S0(W0,W0,W0),R0(_0,r,h),R0(l0,W0,X0),S0(P0,W0,X0),S0(M0,r,h),w0(g[0],_0,l0),w0(g[1],M0,P0),w0(g[2],P0,l0),w0(g[3],_0,M0)}function e4(g,l,h){var r;for(r=0;r<4;r++)f0(g[r],l[r],h)}function A5(g,l){var h=G(),r=G(),X0=G();G0(X0,l[2]),w0(h,l[0],X0),w0(r,l[1],X0),m0(g,r),g[31]^=i0(h)<<7}function $9(g,l,h){var r,X0;T0(g[0],J),T0(g[1],W),T0(g[2],W),T0(g[3],J);for(X0=255;X0>=0;--X0)r=h[X0/8|0]>>(X0&7)&1,e4(g,l,r),I6(l,g),I6(g,g),e4(g,l,r)}function L9(g,l){var h=[G(),G(),G(),G()];T0(h[0],F),T0(h[1],H),T0(h[2],W),w0(h[3],F,H),$9(g,h,l)}function b1(g,l,h){var r=new Uint8Array(64),X0=[G(),G(),G(),G()],W0;if(!h)X(l,32);P8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,L9(X0,r),A5(g,X0);for(W0=0;W0<32;W0++)l[W0+32]=g[W0];return 0}var A8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function T8(g,l){var h,r,X0,W0;for(r=63;r>=32;--r){h=0;for(X0=r-32,W0=r-12;X0<W0;++X0)l[X0]+=h-16*l[r]*A8[X0-(r-32)],h=Math.floor((l[X0]+128)/256),l[X0]-=h*256;l[X0]+=h,l[r]=0}h=0;for(X0=0;X0<32;X0++)l[X0]+=h-(l[31]>>4)*A8[X0],h=l[X0]>>8,l[X0]&=255;for(X0=0;X0<32;X0++)l[X0]-=h*A8[X0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,g[r]=l[r]&255}function s8(g){var l=new Float64Array(64),h;for(h=0;h<64;h++)l[h]=g[h];for(h=0;h<64;h++)g[h]=0;T8(g,l)}function b$(g,l,h,r){var X0=new Uint8Array(64),W0=new Uint8Array(64),_0=new Uint8Array(64),l0,P0,M0=new Float64Array(64),j0=[G(),G(),G(),G()];P8(X0,r,32),X0[0]&=248,X0[31]&=127,X0[31]|=64;var g0=h+64;for(l0=0;l0<h;l0++)g[64+l0]=l[l0];for(l0=0;l0<32;l0++)g[32+l0]=X0[32+l0];P8(_0,g.subarray(32),h+32),s8(_0),L9(j0,_0),A5(g,j0);for(l0=32;l0<64;l0++)g[l0]=r[l0];P8(W0,g,h+64),s8(W0);for(l0=0;l0<64;l0++)M0[l0]=0;for(l0=0;l0<32;l0++)M0[l0]=_0[l0];for(l0=0;l0<32;l0++)for(P0=0;P0<32;P0++)M0[l0+P0]+=W0[l0]*X0[P0];return T8(g.subarray(32),M0),g0}function K8(g,l){var h=G(),r=G(),X0=G(),W0=G(),_0=G(),l0=G(),P0=G();if(T0(g[2],W),H0(g[1],l),Y0(X0,g[1]),w0(W0,X0,U),R0(X0,X0,g[2]),S0(W0,g[2],W0),Y0(_0,W0),Y0(l0,_0),w0(P0,l0,_0),w0(h,P0,X0),w0(h,h,W0),k0(h,h),w0(h,h,X0),w0(h,h,W0),w0(h,h,W0),w0(g[0],h,W0),Y0(r,g[0]),w0(r,r,W0),x0(r,X0))w0(g[0],g[0],N);if(Y0(r,g[0]),w0(r,r,W0),x0(r,X0))return-1;if(i0(g[0])===l[31]>>7)R0(g[0],J,g[0]);return w0(g[3],g[0],g[1]),0}function EG(g,l,h,r){var X0,W0=new Uint8Array(32),_0=new Uint8Array(64),l0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(h<64)return-1;if(K8(P0,r))return-1;for(X0=0;X0<h;X0++)g[X0]=l[X0];for(X0=0;X0<32;X0++)g[X0+32]=r[X0];if(P8(_0,g,h),s8(_0),$9(l0,P0,_0),L9(P0,l.subarray(32)),I6(l0,P0),A5(W0,l0),h-=64,A(l,0,W0,0)){for(X0=0;X0<h;X0++)g[X0]=0;return-1}for(X0=0;X0<h;X0++)g[X0]=l[X0+64];return h}var R$=32,c6=24,t6=32,i8=16,$5=32,C=32,u=32,c=32,I=32,p=c6,y0=t6,d0=i8,Q1=64,w1=32,_1=64,V1=32,Z8=64;$.lowlevel={crypto_core_hsalsa20:q,crypto_stream_xor:e,crypto_stream:v,crypto_stream_salsa20_xor:t,crypto_stream_salsa20:f,crypto_onetimeauth:O0,crypto_onetimeauth_verify:K0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:J0,crypto_secretbox_open:s,crypto_scalarmult:i,crypto_scalarmult_base:$0,crypto_box_beforenm:I0,crypto_box_afternm:d,crypto_box:V0,crypto_box_open:v0,crypto_box_keypair:p0,crypto_hash:P8,crypto_sign:b$,crypto_sign_keypair:b1,crypto_sign_open:EG,crypto_secretbox_KEYBYTES:R$,crypto_secretbox_NONCEBYTES:c6,crypto_secretbox_ZEROBYTES:t6,crypto_secretbox_BOXZEROBYTES:i8,crypto_scalarmult_BYTES:$5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:u,crypto_box_SECRETKEYBYTES:c,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:p,crypto_box_ZEROBYTES:y0,crypto_box_BOXZEROBYTES:d0,crypto_sign_BYTES:Q1,crypto_sign_PUBLICKEYBYTES:w1,crypto_sign_SECRETKEYBYTES:_1,crypto_sign_SEEDBYTES:V1,crypto_hash_BYTES:Z8,gf:G,D:U,L:A8,pack25519:m0,unpack25519:H0,M:w0,A:S0,S:Y0,Z:R0,pow2523:k0,add:I6,set25519:T0,modL:T8,scalarmult:$9,scalarbase:L9};function h1(g,l){if(g.length!==R$)throw Error("bad key size");if(l.length!==c6)throw Error("bad nonce size")}function D$(g,l){if(g.length!==u)throw Error("bad public key size");if(l.length!==c)throw Error("bad secret key size")}function G$(){for(var g=0;g<arguments.length;g++)if(!(arguments[g]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function f$(g){for(var l=0;l<g.length;l++)g[l]=0}$.randomBytes=function(g){var l=new Uint8Array(g);return X(l,g),l},$.secretbox=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(t6+g.length),X0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+t6]=g[W0];return J0(X0,r,r.length,l,h),X0.subarray(i8)},$.secretbox.open=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(i8+g.length),X0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+i8]=g[W0];if(r.length<32)return null;if(s(X0,r,r.length,l,h)!==0)return null;return X0.subarray(t6)},$.secretbox.keyLength=R$,$.secretbox.nonceLength=c6,$.secretbox.overheadLength=i8,$.scalarMult=function(g,l){if(G$(g,l),g.length!==C)throw Error("bad n size");if(l.length!==$5)throw Error("bad p size");var h=new Uint8Array($5);return i(h,g,l),h},$.scalarMult.base=function(g){if(G$(g),g.length!==C)throw Error("bad n size");var l=new Uint8Array($5);return $0(l,g),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=$5,$.box=function(g,l,h,r){var X0=$.box.before(h,r);return $.secretbox(g,l,X0)},$.box.before=function(g,l){G$(g,l),D$(g,l);var h=new Uint8Array(I);return I0(h,g,l),h},$.box.after=$.secretbox,$.box.open=function(g,l,h,r){var X0=$.box.before(h,r);return $.secretbox.open(g,l,X0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var g=new Uint8Array(u),l=new Uint8Array(c);return p0(g,l),{publicKey:g,secretKey:l}},$.box.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==c)throw Error("bad secret key size");var l=new Uint8Array(u);return $0(l,g),{publicKey:l,secretKey:new Uint8Array(g)}},$.box.publicKeyLength=u,$.box.secretKeyLength=c,$.box.sharedKeyLength=I,$.box.nonceLength=p,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(g,l){if(G$(g,l),l.length!==_1)throw Error("bad secret key size");var h=new Uint8Array(Q1+g.length);return b$(h,g,g.length,l),h},$.sign.open=function(g,l){if(G$(g,l),l.length!==w1)throw Error("bad public key size");var h=new Uint8Array(g.length),r=EG(h,g,g.length,l);if(r<0)return null;var X0=new Uint8Array(r);for(var W0=0;W0<X0.length;W0++)X0[W0]=h[W0];return X0},$.sign.detached=function(g,l){var h=$.sign(g,l),r=new Uint8Array(Q1);for(var X0=0;X0<r.length;X0++)r[X0]=h[X0];return r},$.sign.detached.verify=function(g,l,h){if(G$(g,l,h),l.length!==Q1)throw Error("bad signature size");if(h.length!==w1)throw Error("bad public key size");var r=new Uint8Array(Q1+g.length),X0=new Uint8Array(Q1+g.length),W0;for(W0=0;W0<Q1;W0++)r[W0]=l[W0];for(W0=0;W0<g.length;W0++)r[W0+Q1]=g[W0];return EG(X0,r,r.length,h)>=0},$.sign.keyPair=function(){var g=new Uint8Array(w1),l=new Uint8Array(_1);return b1(g,l),{publicKey:g,secretKey:l}},$.sign.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==_1)throw Error("bad secret key size");var l=new Uint8Array(w1);for(var h=0;h<l.length;h++)l[h]=g[32+h];return{publicKey:l,secretKey:new Uint8Array(g)}},$.sign.keyPair.fromSeed=function(g){if(G$(g),g.length!==V1)throw Error("bad seed size");var l=new Uint8Array(w1),h=new Uint8Array(_1);for(var r=0;r<32;r++)h[r]=g[r];return b1(l,h,!0),{publicKey:l,secretKey:h}},$.sign.publicKeyLength=w1,$.sign.secretKeyLength=_1,$.sign.seedLength=V1,$.sign.signatureLength=Q1,$.hash=function(g){G$(g);var l=new Uint8Array(Z8);return P8(l,g,g.length),l},$.hash.hashLength=Z8,$.verify=function(g,l){if(G$(g,l),g.length===0||l.length===0)return!1;if(g.length!==l.length)return!1;return j(g,0,l,0,g.length)===0?!0:!1},$.setPRNG=function(g){X=g},function(){var g=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(g&&g.getRandomValues){var l=65536;$.setPRNG(function(h,r){var X0,W0=new Uint8Array(r);for(X0=0;X0<r;X0+=l)g.getRandomValues(W0.subarray(X0,X0+Math.min(r-X0,l)));for(X0=0;X0<r;X0++)h[X0]=W0[X0];f$(W0)})}else if(g=u0("crypto"),g&&g.randomBytes)$.setPRNG(function(h,r){var X0,W0=g.randomBytes(r);for(X0=0;X0<r;X0++)h[X0]=W0[X0];f$(W0)})}()})(typeof ly<"u"&&Fs9?Fs9:globalThis.nacl=globalThis.nacl||{});hV=typeof ly<"u"&&Fs9?Fs9:globalThis.nacl,Ge6={fromSeed:hV.sign.keyPair.fromSeed,sign:hV.sign.detached,verify:hV.sign.detached.verify,randomBytes:hV.randomBytes,scalarBaseMultiply:hV.scalarMult.base,seal:hV.box,open:hV.box.open};Ye6=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);h$=class h$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(g$||(g$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(a8||(a8={}));cV=[120,107,118,49];Xe6(Ge6);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(O3||(O3={}))});function J11($){try{$?.clear?.()}catch{}}async function xM$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=bM$($),W=Y11(J.sub),K=Q11(new TextEncoder().encode(Z)),U=kM$();try{let w=await CM$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:O3.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(_M$(w,U))}finally{J11(U),J11(K),J11(W)}}var vM$=O(()=>{fM$()});function Oe6($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function yM$(){let $=new y1;return $.post("/links/session",async(Z)=>{let X=Z.get("meshContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=L1();if(!Y.natsTunnelPublicEnabled)return Z.json(W11(),503);if(!Y.natsPublicUrl)return Z.json(W11(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(W11(),503)}let Q=B3(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await xM$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:TM$(Q),userId:X,allowedConnectionTypes:Oe6(Y.natsPublicUrl)})}return Z.json(IM$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var W11=()=>({error:"link session unavailable"});var gM$=O(()=>{d6();q8();RM$();vM$()});async function Le6($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function ze6($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new YN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function je6($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},Ee6),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=Gn(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function Pe6($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<hM$){await m4(cM$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<hM$){await m4(cM$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var Ee6=90000,De6=15000,uM$=()=>{let $=new y1;return $.get("/",async(Z)=>{let G=Z.var.meshContext;try{b0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=l1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=E0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=gU({orgId:Y.id,virtualMcpId:Q,branch:J}),U=Hy({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let D=await Z3(G,{userId:X,branch:J,virtualMcpMetadata:w});F=D.provider,H=D.kind}catch(D){N=D instanceof Error?D:Error(String(D)),F=null}let B=H&&uU(e9(w),X,J,H),E=!!B&&B.sandboxHandle===U;if(!F)return _Q(Z,async(D)=>{await D.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this mesh."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),_Q(Z,async(D)=>{let L=new AbortController,z=setInterval(()=>{D.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},De6);D.onAbort(()=>{L.abort(),clearInterval(z)});try{if(E&&H){if(await Le6(F,U)){await ze6({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await D.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await je6({stream:D,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await Pe6({stream:D,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},hM$=60000,cM$=500;var dM$=O(()=>{d6();gV();EY();f7();wE0();Xn();Wv();c50();LQ()});function Te6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function Ie6($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(Ae6)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var Ae6=1e4,Re6=async($,Z)=>{if(!$.get("meshContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},lM$=()=>{let $=new y1;return $.use("*",Re6),$.get("/",async(Z)=>{let G=L1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await Ie6(X,Y);return Z.json({apps:Te6(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var mM$=O(()=>{d6();q8()});import{z as f1}from"zod";function QK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function xe6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function ve6($,Z,G){try{return JSON.parse($)}catch{throw new pM$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function ye6($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:ve6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function ge6($){let Z=$.map((G)=>{let X=G.function.parameters?QY(G.function.parameters):QY({type:"object",properties:{}});return[G.function.name,s$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function he6($){if(!$)return;return{openai:{response_format:$}}}function ce6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function iM$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function nM$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var qe6=256,Me6,ke6,Se6,Ve6,Ce6,be6,_e6,fe6,pM$,tM$,rM$;var oM$=O(()=>{f6();d6();gV();Me6=f1.object({type:f1.literal("function"),function:f1.object({name:f1.string(),description:f1.string().optional(),parameters:f1.record(f1.string(),f1.unknown()).optional()})}),ke6=f1.object({id:f1.string(),type:f1.literal("function"),function:f1.object({name:f1.string(),arguments:f1.string()})}),Se6=f1.discriminatedUnion("role",[f1.object({role:f1.literal("system"),content:f1.string(),name:f1.string().optional()}),f1.object({role:f1.literal("user"),content:f1.union([f1.string(),f1.array(f1.union([f1.object({type:f1.literal("text"),text:f1.string()}),f1.object({type:f1.literal("image_url"),image_url:f1.object({url:f1.string(),detail:f1.string().optional()})})]))]),name:f1.string().optional()}),f1.object({role:f1.literal("assistant"),content:f1.string().nullable().optional(),name:f1.string().optional(),tool_calls:f1.array(ke6).optional()}),f1.object({role:f1.literal("tool"),content:f1.string(),tool_call_id:f1.string()})]),Ve6=f1.object({type:f1.literal("text")}),Ce6=f1.object({type:f1.literal("json_object")}),be6=f1.object({type:f1.literal("json_schema"),json_schema:f1.object({name:f1.string(),description:f1.string().optional(),schema:f1.record(f1.string(),f1.unknown()),strict:f1.boolean().optional()})}),_e6=f1.union([Ve6,Ce6,be6]),fe6=f1.object({model:f1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:f1.array(Se6),stream:f1.boolean().optional().default(!1),temperature:f1.number().min(0).max(2).optional(),max_tokens:f1.number().positive().optional(),top_p:f1.number().min(0).max(1).optional(),frequency_penalty:f1.number().min(-2).max(2).optional(),presence_penalty:f1.number().min(-2).max(2).optional(),stop:f1.union([f1.string(),f1.array(f1.string())]).optional(),tools:f1.array(Me6).optional(),tool_choice:f1.union([f1.literal("auto"),f1.literal("none"),f1.literal("required"),f1.object({type:f1.literal("function"),function:f1.object({name:f1.string()})})]).optional(),response_format:_e6.optional(),user:f1.string().optional()});pM$=class pM$ extends Error{constructor($){super($);this.name="MessageConversionError"}};tM$=new y1;tM$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("meshContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(QK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(QK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(QK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=fe6.safeParse(X);if(!Y.success){let D=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(QK(`Invalid request: ${D.message}`,"invalid_request_error",D.path.length>0?D.path.join("."):null),400)}let Q=Y.data,J=xe6(Q.model);if(!J)return $.json(QK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let D=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(D.length===0)return $.json(QK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=D[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(QK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=ye6(Q.messages),H=Q.tools?ge6(Q.tools):void 0,N=he6(Q.response_format),B=ce6(),E=Math.floor(Date.now()/1000);if(Q.stream)return _Q($,async(D)=>{let L=iM$(w,F,H,Q,N,$.req.raw.signal);try{let z=EQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=qe6)await M()}else if(S.type==="tool-call"){await M();let q=P++;await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{},finish_reason:nM$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await D.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await D.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let D=iM$(w,F,H,Q,N,$.req.raw.signal),L=await aH(D),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:E,model:Q.model,choices:[{index:0,message:z,finish_reason:nM$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(QK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(QK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(QK(Y.message,"server_error"),500)}});rM$=tM$});function de6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??ue6}}var aM$,ue6="https://us.i.posthog.com",sM$;var eM$=O(()=>{d6();_b0();jN();m7();q8();Ds0();aM$=new y1;aM$.get("/",($)=>{let Z={theme:MC1(),...IO().logo&&{logo:IO().logo},...PQ()&&{internalUrl:Je()},...L1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!L1().firecrawlApiKey,auth:fP$(),posthog:de6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!PQ()&&L1().sandboxProviderKind==="agent-sandbox"}};return $.json({success:!0,config:Z})});sM$=aM$});function $k$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals")}var Zk$,le6,me6,Gk$;var Xk$=O(()=>{d6();DJ();Nv();eb();Zk$=new y1,le6=["range","if-none-match","if-modified-since"],me6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Zk$.get("/:org/files/*",async($)=>{let Z=$.get("meshContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(Ay($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new z$(401,{message:"Authentication required"})}if(!G)throw new z$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new z$(400,{message:"Missing file key"});let Y=await Un(X,Z);if(!Y)throw new z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&EJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new z$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return $k$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of le6){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of me6){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),$k$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Gk$=Zk$});var Nt=b((dV)=>{var ie6=dV&&dV.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),ne6=dV&&dV.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))ie6(Z,$,G)};Object.defineProperty(dV,"__esModule",{value:!0});ne6(hX(),dV)});var Jk$=b((Yk$)=>{Object.defineProperty(Yk$,"__esModule",{value:!0});Yk$.version=void 0;Yk$.version="3.4.0"});var Uk$=b((JK)=>{var pe6=JK&&JK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(JK,"__esModule",{value:!0});JK.NodeTransport=JK.VERSION=void 0;JK.nodeResolveHost=ee6;var d4=Nt(),te6=u0("net"),K11=u0("tls"),re6=u0("path"),Wk$=u0("fs"),oe6=pe6(u0("dns")),ae6=Jk$();JK.VERSION=ae6.version;var se6="nats.js";class Kk${socket;version;lang;yields=[];signal=(0,d4.deferred)();closedNotification=(0,d4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=se6,this.version=JK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,d4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw d4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new d4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new d4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,d4.deferred)(),G,X=(0,te6.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,d4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=d4.DataBuffer.concat(...this.yields),Y=(0,d4.extractProtocolMessage)(X);if(Y!=="")try{let Q=d4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,d4.deferred)();try{if($=(0,re6.resolve)($),!(0,Wk$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Wk$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,d4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,d4.deferred)();try{let Y=(0,K11.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,d4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,d4.deferred)();try{let X=(0,K11.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,d4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,d4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof K11.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,d4.render)($)}`);let Z=(0,d4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}JK.NodeTransport=Kk$;function ee6($){let Z=(0,d4.deferred)();return oe6.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Bk$=b((Nk$)=>{Object.defineProperty(Nk$,"__esModule",{value:!0});Nk$.connect=$04;var wk$=Uk$(),Fk$=Nt(),Hk$=Nt();function $04($={}){if((0,Hk$.hasWsProtocol)($))return Promise.reject(Hk$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Fk$.setTransportFactory)({factory:()=>{return new wk$.NodeTransport},dnsResolveFn:wk$.nodeResolveHost}),Fk$.NatsConnectionImpl.connect($)}});var Ok$=b((zw)=>{var G04=zw&&zw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),X04=zw&&zw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))G04(Z,$,G)};Object.defineProperty(zw,"__esModule",{value:!0});zw.connect=void 0;var Y04=Bk$();Object.defineProperty(zw,"connect",{enumerable:!0,get:function(){return Y04.connect}});X04(Nt(),zw)});function zk$($){let Z=$?.connectFn??K04,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:W04,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let E=_X(J04,Q04,B-1,2,0.5);await m4(E)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?Ek$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=Lk$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function K04($){return Dk$.connect($)}var Ek$,Dk$,Lk$,Q04=100,J04=3000,W04=3000;var jk$=O(()=>{f7();Ek$=k(Eg(),1),Dk$=k(Ok$(),1),Lk$=k(OB(),1)});function my($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function U11($,Z){return`${$}.${Z}`}class w11{cache;constructor($){this.cache=my({ttlMs:$?.ttlMs??U04,maxSize:$?.maxSize??w04})}async get($,Z){return this.cache.get(U11($,Z))??null}async set($,Z,G){this.cache.set(U11($,Z),G)}async invalidate($,Z){this.cache.delete(U11($,Z))}teardown(){this.cache.clear()}}var U04=600000,w04=5000;var Pk$=()=>{};function AD0($,Z){return`${$}:${Z}`}function F11($){let Z=my({ttlMs:$?.ttlMs??F04,maxSize:$?.maxSize??H04}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(Ak$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(AD0(K,U))},set(K,U,w){Z.set(AD0(K,U),w)},invalidate(K,U){Z.delete(AD0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(Ak$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(AD0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Ak$="studio.ai-provider-keys.invalidate",F04=30000,H04=5000;var Tk$=()=>{};class H11{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var Ik$=($)=>{let Z;return()=>Z??=$()},N11,B11;var Rk$=O(()=>{I5();N11=Ik$(()=>y8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),B11=Ik$(()=>y8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function z04(){return{name:fU,subjects:[`${nd0}.>`],storage:E3.StorageType.File,max_age:O04,max_bytes:D04,max_msgs_per_subject:L04,discard:E3.DiscardPolicy.Old,retention:E3.RetentionPolicy.Limits,duplicate_window:E04,num_replicas:1}}class kk${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function qk$($){let Z=Mk$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function T04($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,B04().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class O11{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await E3.jetstreamManager($),G=z04();try{await Z.streams.info(fU),await Z.streams.update(fU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(fU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y){console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`);return}let Q=T04(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=E8$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=td0(U,{runId:Z}),H=performance.now()-w;if(N11().record(H),B11().add(1,{"org.id":X??"unknown"}),A04?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?qk$(N.headers):void 0)};(async()=>{let U=$.getReader(),w=0,F=0;try{while(!0){let{done:H,value:N}=await U.read();if(H)break;if(K(N),F++,++w>=64)w=0,await new Promise((B)=>setImmediate(B))}}catch(H){console.warn(`[Decopilot] stream pump error for thread ${Z}:`,H?.message??H)}finally{if(U.releaseLock(),W(),P04)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=td0(Z,{runId:$,dedup:G});if(N11().record(performance.now()-Y),B11().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:qk$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=O8$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?E3.DeliverPolicy.New:E3.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=eH($),W;try{W=await(await X.consumers.get(fU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(E){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",E?.message??E),null}let w=N50({messages:async function*(){try{for await(let E of W)yield{subject:E.subject,data:E.data,headers:E.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(F50()).pipeThrough(H50()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(E){for(;;){let{done:D,value:L}=await w.read();if(D){B(),E.close();return}let z=L;if(z.kind==="done"){if(Q){B(),E.close();return}continue}E.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(fU,{filter:eH($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var E3,Mk$,N04=($)=>{let Z;return()=>Z??=$()},B04,O04=86400000000000,E04=120000000000,D04=4294967296,L04=500000,j04,P04,A04;var Sk$=O(()=>{od0();ad0();rd0();I5();Rk$();E3=k(OB(),1),Mk$=k(Eg(),1),B04=N04(()=>y8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));j04=process.env.STREAM_ENCODE_TRACE==="1",P04=process.env.DECOPILOT_STREAM_TRACE==="1";A04=j04?new kk$:null});import{z as $8}from"zod";var Vk$,Ck$,WK,E11,bk$,_k$,fk$,xk$,I04,vk$,yk$,gk$,hk$,ck$,R04,uk$,je9,q04,M04=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},dk$=($)=>{return new TextEncoder().encode(JSON.stringify($))},lk$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?q04[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${M04(Y.error)}`);return Y.data};var mk$=O(()=>{Vk$=$8.string().regex(/^[A-Za-z0-9_-]*$/u),Ck$=$8.array($8.tuple([$8.string(),$8.string()])),WK=$8.string().regex(/^[A-Za-z0-9_-]+$/u),E11=$8.string().min(1),bk$=$8.object({type:$8.literal("request.start"),protocol:$8.literal("tunnel.v1"),requestId:WK,method:$8.string().min(1),url:$8.string().min(1),headers:Ck$,replySubject:E11,bodySubject:E11.optional(),abortSubject:E11,deadlineUnixMs:$8.number().int().nonnegative().optional()}),_k$=$8.object({type:$8.literal("request.chunk"),requestId:WK,seq:$8.number().int().nonnegative(),data:Vk$}),fk$=$8.object({type:$8.literal("request.end"),requestId:WK,seq:$8.number().int().nonnegative()}),xk$=$8.object({type:$8.literal("request.error"),requestId:WK,code:$8.string().min(1),message:$8.string()}),I04=$8.union([_k$,fk$,xk$]),vk$=$8.object({type:$8.literal("response.ack"),requestId:WK}),yk$=$8.object({type:$8.literal("response.start"),requestId:WK,status:$8.number().int().min(100).max(599),statusText:$8.string().optional(),headers:Ck$}),gk$=$8.object({type:$8.literal("response.chunk"),requestId:WK,seq:$8.number().int().nonnegative(),data:Vk$}),hk$=$8.object({type:$8.literal("response.end"),requestId:WK,seq:$8.number().int().nonnegative()}),ck$=$8.object({type:$8.literal("response.error"),requestId:WK,code:$8.string().min(1),message:$8.string()}),R04=$8.union([vk$,yk$,gk$,hk$,ck$]),uk$=$8.object({type:$8.literal("abort"),requestId:WK,reason:$8.string().optional()}),je9=$8.union([bk$,I04,R04,uk$]),q04={"request.start":bk$,"request.chunk":_k$,"request.end":fk$,"request.error":xk$,"response.ack":vk$,"response.start":yk$,"response.chunk":gk$,"response.end":hk$,"response.error":ck$,abort:uk$}});var k04=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},S04=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},V04=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},C04=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},ik$=($)=>{return k04(btoa(V04($)))},nk$=($)=>{return C04(atob(S04($)))},b04;var pk$=O(()=>{b04=class b04{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*d04($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class o04{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var _04=30000,f04=1000,x04=65536,xQ,v04=($)=>{return"connection"in $},y04=($)=>{let Z=v04($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??_04,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??f04,maxChunkBytes:Z.maxChunkBytes??x04,diagnostics:Z.diagnostics}},tk$=($)=>{return Array.from($.entries())},g04=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},h04=($,Z,G)=>{if(g04(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return tk$(G.headers);return tk$(G.headers)},rk$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},c04=()=>{return crypto.randomUUID().replaceAll("-","")},u04=($)=>{try{$?.unsubscribe()}catch{}},l04=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},m04=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},aN=($,Z,G)=>{$.publish(Z,dk$(G))},i04=($)=>{return $.type.startsWith("response.")},D11=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},n04=($)=>{if($==="idle")return new xQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new xQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},ok$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(n04(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=lk$(W.value.data);if(!i04(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},p04=async($)=>{let Z=!1;while(!0){let G=await ok$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new xQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new xQ(G.value.code,G.value.message);throw new xQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},t04=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){aN($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of d04(J,$.maxChunkBytes)){if(X)return;aN($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:ik$(W)}),G++}}}catch(Q){if(X)return;aN($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},r04=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await ok$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new xQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(nk$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new xQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){aN($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},sN=($)=>{let Z=y04($);return l04(Z.maxChunkBytes),async(G,X)=>{let Y=PM$(G),Q=new Request(G,X),J=c04(),W=AM$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,E=!1,D=(P=new xQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,u04(F),Q.body&&!E)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new xQ("tunnel_aborted",D11(Q.signal));aN(Z.connection,W.abort,{type:"abort",requestId:J,reason:D11(Q.signal)}),K.abort(P),D(P)};if(Q.signal.aborted)throw new xQ("tunnel_aborted",D11(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new xQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);aN(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),D(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:h04(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};aN(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!E)aN(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(E)return;E=!0,(Q.body?t04({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await p04({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(m04(Q.method,P.status))return D(),new Response(null,{status:P.status,statusText:P.statusText,headers:rk$(P.headers)});return new Response(r04({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:D}),{status:P.status,statusText:P.statusText,headers:rk$(P.headers)})}catch(P){throw D(P instanceof Error?P:Error(String(P))),P}}};var ak$=O(()=>{mk$();pk$();LD0();xQ=class xQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var TD0=O(()=>{ak$()});function sk$($){let Z=$.createFetch??a04,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return L11;let Q=B3(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return L11;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return L11}}}var L11,a04=($,Z)=>sN({connection:$,firstFrameTimeoutMs:Z});var ek$=O(()=>{TD0();Ft();L11={online:!1,capabilities:[]}});async function*s04($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function $S$($){let Z=$.createFetch??((G)=>sN({connection:G,idleTimeoutMs:e04}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=B3(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*s04(w)}}var e04=45000;var ZS$=O(()=>{TD0();Ft()});import{z as D3}from"zod";function GS$($){return JSON.stringify($)}var re9;var XS$=O(()=>{re9=D3.discriminatedUnion("type",[D3.object({type:D3.literal("cancel"),runId:D3.string()}),D3.object({type:D3.literal("cancel_req"),reqId:D3.string()}),D3.object({type:D3.literal("keep_alive")}),D3.object({type:D3.literal("shutdown")})])});function YS$($){let Z=$.createFetch??((G)=>sN({connection:G,idleTimeoutMs:$14}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=B3(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function QS$($){let Z=$.createFetch??sN;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=B3(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:GS$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var $14=45000;var JS$=O(()=>{TD0();XS$();Ft()});function WS$($,Z){switch($.type){case"START":{let G={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(Z?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:Z.orgId},G];return[G]}case"STEP_DONE":{if(Z?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:Z.status.stepCount+1}]}case"FINISH":{if(Z==null||Z.status.tag!=="running")return[];let{stepCount:G}=Z.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"error"}]}case"CANCEL":{if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"cancelled"}]}case"RESUME":{if(Z?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z?.orgId??$.orgId,reason:$.reason}];if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:$.reason}]}}}function KS$($,Z,G=new Date){switch(Z.type){case"RUN_STARTED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"RUN_RESUMED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:Z.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function US$($,Z,G,X){let{storage:Y,sseHub:Q}=X,J=await Y.get($,Z);Q.emit(Z,OJ($,G,{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit(Z,ic($,G))}async function Z14($,Z){let{storage:G,streamBuffer:X,sseHub:Y}=Z;switch($.type){case"RUN_STARTED":{await G.update($.taskId,$.orgId,{status:"in_progress",run_config:$.runConfig??null,run_started_at:new Date().toISOString(),last_progress_at:null});let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"in_progress",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at}));return}case"RUN_RESUMED":{await G.update($.taskId,$.orgId,{run_started_at:new Date().toISOString()});let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"in_progress",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at}));return}case"STEP_COMPLETED":Y.emit($.orgId,p00($.taskId,$.stepCount));return;case"RUN_COMPLETED":await US$($.taskId,$.orgId,"completed",Z);return;case"RUN_REQUIRES_ACTION":await US$($.taskId,$.orgId,"requires_action",Z);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await G.forceFailIfInProgress($.taskId,$.orgId))return;await G.update($.taskId,$.orgId,{run_config:null,run_started_at:null})}else await G.update($.taskId,$.orgId,{status:"failed",run_config:null,run_started_at:null});X.purge($.taskId);let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"failed",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at})),Y.emit($.orgId,ic($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function wS$($,Z){for(let{event:G}of $)await Z14(G,Z)}var FS$=O(()=>{$6()});function HS$($){return $.now-$.lastProgressAt>$.idleTimeoutMs}function NS$($){return Math.max($.persistedLastProgressAt??Number.NEGATIVE_INFINITY,$.currentRunStartedAt)}class z11{deps;clock;states=new Map;reaperTimer=null;constructor($,Z=()=>new Date){this.deps=$;this.clock=Z;this.reaperTimer=setInterval(()=>{this.reapStaleRuns().catch((G)=>{console.error("[RunRegistry] Reaper sweep failed",G)})},G14)}async execute($){let Z=this.dispatch($);return await this.react(Z),Z}dispatch($){let Z=this.states.get($.taskId),G=WS$($,Z),X=[];for(let Y of G){let Q=this.states.get(Y.taskId);if(Y.type==="PREVIOUS_RUN_ABORTED"||Y.type==="RUN_FAILED"){if(Q?.status.tag==="running")Q.status.abortController.abort()}let J=KS$(Q,Y,this.clock());if(J===void 0)this.states.delete(Y.taskId);else this.states.set(Y.taskId,J);if(X.push({event:Y,state:J}),X14.has(Y.type))OS$().add(1,{"org.id":Y.orgId});else if(Y14.has(Y.type)&&Q?.status.tag==="running")OS$().add(-1,{"org.id":Y.orgId})}return X}react($){return wS$($,this.deps)}getAbortSignal($){let Z=this.states.get($);if(Z?.status.tag==="running")return Z.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}async reapStaleRuns(){let $=this.clock().getTime(),Z=[...this.states].filter(([,G])=>G.status.tag==="running");for(let[G,X]of Z){if(this.states.get(G)?.status.tag!=="running")continue;let Q;try{let W=await this.deps.storage.getProgress(G,X.orgId);Q=NS$({persistedLastProgressAt:W?.lastProgressAt??null,currentRunStartedAt:X.status.startedAt.getTime()})}catch(W){console.warn(`[RunRegistry] Reaper progress read failed for ${G}; skipping`,W);continue}if(!HS$({lastProgressAt:Q,now:$,idleTimeoutMs:BS$}))continue;let J=await this.deps.storage.get(G,X.orgId).catch(()=>null);if(J&&J.status!=="in_progress"){let W=this.states.get(G);if(W?.status.tag==="running")W.status.abortController.abort();this.states.delete(G);continue}console.warn(`[RunRegistry] Reaping stuck run for thread ${G} (idle > ${BS$/60000}m) ...`),Q14().add(1,{"org.id":X.orgId,reason:"idle_timeout"}),await this.execute({type:"FORCE_FAIL",taskId:G,reason:"reaped"}).catch((W)=>{console.error("[RunRegistry] Reaper execute failed",W)})}}}var G14=300000,BS$=600000,X14,Y14,ES$=($)=>{let Z;return()=>Z??=$()},OS$,Q14;var DS$=O(()=>{FS$();I5();X14=new Set(["RUN_STARTED","RUN_RESUMED"]),Y14=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),OS$=ES$(()=>y8.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})),Q14=ES$(()=>y8.createCounter("decopilot.run.reaped",{description:"Number of decopilot runs force-failed by the progress-based reaper",unit:"{runs}"}))});function ID0($,Z,G,X){if(!X)return!1;return $.emit(Z,OJ(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var LS$=O(()=>{$6()});class j11{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as J14,rm as RD0}from"fs/promises";import{join as qD0}from"path";async function MD0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-W14),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await lV($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await zS$($,Y,Z);else if(!Y.startsWith(".")){let Q=qD0($,Y),J=await lV(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await zS$(Q,K,Z)}if((await lV(Q)).length===0)await RD0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function zS$($,Z,G){let X=0,Y=qD0($,Z),Q=await lV(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=qD0(Y,W),U=await lV(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=qD0(K,F);await RD0(N,{recursive:!0,force:!0}),X++}}if((await lV(K)).length===0)await RD0(K,{recursive:!0,force:!0})}if((await lV(Y)).length===0)await RD0(Y,{recursive:!0,force:!0});return X}async function lV($){try{return(await J14($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var W14=30;var P11=()=>{};import{DBOS as A11,SchedulerMode as K14}from"@dbos-inc/dbos-sdk";async function w14(){let $=[yQ(),iV(),wK()],Z=0;for(let G of $)try{Z+=await MD0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function F14($,Z){await A11.runStep(()=>w14(),{name:"monitoringRetention"})}function PS$(){if(jS$)return;jS$=!0;let $=A11.registerWorkflow(F14,{name:"monitoringRetentionWorkflow"});A11.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:U14,mode:K14.ExactlyOncePerIntervalWhenActive})}var U14="23 4 * * *",jS$=!1;var AS$=O(()=>{fX();P11()});function TS$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await vH.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Xc0($.db,Z,X.role);return Y.boundAuth=Gc0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new wE(G,void 0,Y.boundAuth,X.role,"self"),e60(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var IS$=O(()=>{FE();gm()});function H14(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function B14(){for(let $ of N14)$()}function RS$($){let Z=[...T11.logs,$];T11={...T11,logs:Z.length>500?Z.slice(-500):Z},B14()}function I11(){return O14}var T11,N14,O14=!1;var R11=O(()=>{T11=H14(),N14=new Set});import{EventEmitter as E14}from"events";var q11;var qS$=O(()=>{R11();q11=new E14;q11.on("request",($)=>{RS$($)})});function MS$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=iy(H.params.name),B=H.params.arguments||{},E=Object.keys(B).map((L)=>iy(L)),D=E.length>0?E.slice(0,3).join(",")+(E.length>3?"\u2026":""):"";Q=`${s4.tool}${N}${s4.dim}(${D})${s4.reset}`}else if(H.method)Q=`${s4.dim}${iy(H.method)}${s4.reset}`}}catch{}}let W=iy(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${s4.mcp}${iy(w.slice(0,12))}\u2026${s4.reset}`}else if(Y==="/mcp")W=`${s4.mcp}/mcp${s4.reset}`;else if(Y==="/mcp/registry")W=`${s4.mcp}/mcp/registry${s4.reset}`;let K=L14(X),U=J?"\u25C0":"\u2190";if(!I11())console.log(`${s4.dim}${U}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=D14(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!I11())console.log(`${s4.dim}${B}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${s4.reset} ${s4.duration}${N}${s4.reset}`);q11.emit("request",{method:X,path:iy(Y),status:F,duration:w,timestamp:new Date})}}}var s4,D14=($)=>{if($>=500)return s4.serverError;if($>=400)return s4.clientError;if($>=300)return s4.redirect;return s4.ok},L14=($)=>{return s4[$]||s4.reset},iy=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var kS$=O(()=>{R11();qS$();s4={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as bS$}from"crypto";import{mkdir as z14,readdir as j14,rm as SS$,stat as _S$}from"fs/promises";import{join as k11,relative as P14}from"path";import{z as P$}from"zod";function xS$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return k11(A14,Z)}function vS$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function M11($,Z){let G=xS$($),X=vS$(Z);return k11(G,X)}function T14($,Z,G,X){let Y=L1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return bS$("sha256",Y).update(Q).digest("hex")}function CS$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=T14(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${vS$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function yS$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${bS$("md5","etag").update(X).digest("hex")}"`}async function gS$($,Z,G,X,Y){try{let Q=await j14($,{withFileTypes:!0});for(let J of Q){let W=k11($,J.name),U=P14(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await gS$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await _S$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:yS$(W,w.mtime,w.size)})}catch{}}}}catch{}}function hS$($,Z){let X=E0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=xS$(X);await z14(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await gS$(w,w,J,K,F),F.objects.sort((D,L)=>D.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((D)=>D.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,E=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:E,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=M11(X,Q.key),W=await _S$(J);return{contentType:Ie0(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:yS$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??VS$;return{url:CS$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??VS$;return{url:CS$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let Q=Y,J=M11(X,Q.key);try{return await SS$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=M11(X,K);try{await SS$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function S11($,Z,G){let X=hS$(Z,G),Y=new sK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:O5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new TY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),gW(Y,Q,$,"mcp:dev-assets")}async function cS$($,Z,G,X){let Q=hS$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var A14="./data/assets",VS$=3600,fS$,uS$;var dS$=O(()=>{q8();Nn();d6();pc();Ev();H7();gE0();fS$=new y1;fS$.all("/",async($)=>{let Z=$.get("meshContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return S11($.req.raw,Z,X)});uS$=fS$});var lS$={};e8(lS$,{mountDevRoutes:()=>I14});function I14($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return S11(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await cS$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",uS$);let G=new y1;G.use("*",bQ({mountPath:"/api/dev-assets"})),G.route("/",yE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var mS$=O(()=>{d6();De0();gE0();dS$()});var iS$=O(()=>{Rc0();qc0();iE()});var kD0=O(()=>{iS$()});var pS$={};e8(pS$,{streamAgent:()=>nS$,createDecopilotClient:()=>q14});async function R14($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (f6(),dd0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function nS$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (f6(),dd0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let E=JSON.parse(N);if(E?.error)B=E.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await R14(F.body);return Q({stream:H})}function q14($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return nS$(Y,X,W,Q,J)}}}import{z as bX}from"zod";function tS$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=M14.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:bX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:bX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var M14,X1Z,k14=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},C11=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},SD0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},S14=($,Z,G)=>{let X=SD0($,Z,G);return new Proxy(Tx.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},V14=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => pS$);return J(X,Z.token,$,Y,Q)}}},V11=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>V11(G,Z));if(typeof $==="object"){if(k14($))return V14($,Z);if(C11($))return S14($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=V11(Y,Z);return G}return $},rS$=($)=>{return V11($.state,$)};var ny=O(()=>{kD0();M14=new Map;X1Z=bX.object({id:bX.string(),title:bX.string(),capabilities:bX.object({vision:bX.boolean().optional(),text:bX.boolean().optional(),tools:bX.boolean().optional(),reasoning:bX.boolean().optional()}).passthrough().optional(),provider:bX.string().optional().nullable(),limits:bX.object({contextWindow:bX.number().optional(),maxOutputTokens:bX.number().optional()}).passthrough().optional()})});var C14,oS$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},b14=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=oS$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},aS$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=oS$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??C14;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},sS$=($,Z,G)=>{let X=new Headers($.headers);return b14(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var eS$=O(()=>{C14=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function $V$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function _14($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function ZV$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function GV$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function XV$($){return{handleProtectedResourceMetadata:(U)=>{let w=KK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=KK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=KK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),E=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let D=KK(new URL(`${w.origin}/oauth/callback`)),L=D.toString(),j=ZV$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:E??void 0,oauthCallbackUri:L});D.searchParams.set("state",j);let P=$.authorizationUrl(D.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=KK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?GV$(H):null;if(N){let E=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let D=KK(new URL(B.redirectUri));if(D.searchParams.set("error",N),D.searchParams.set("error_description",E),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}return Response.json({error:N,error_description:E},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let E=B.oauthCallbackUri??KK(new URL(`${w.origin}/oauth/callback`)).toString(),D={code:F,redirect_uri:E},L=await $.exchangeCode(D),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=ZV$(z),P=KK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(E){console.error("OAuth callback error:",E);let D=KK(new URL(B.redirectUri));if(D.searchParams.set("error","server_error"),D.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:E}=F;if(B==="refresh_token"){if(typeof E!=="string"||!E)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(E)}catch(P){if(P instanceof b11)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let D=GV$(H);if(!D||!D.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(D.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(D.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==D.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:D.accessToken,token_type:D.tokenType};if(D.refreshToken)L.refresh_token=D.refreshToken;if(D.expiresIn!==void 0)L.expires_in=D.expiresIn;if(D.scope)L.scope=D.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let E of w.redirect_uris)if(!_14(E))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${E}`},{status:400});let F=$V$(32),H=w.token_endpoint_auth_method!=="none"?$V$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${KK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var b11,KK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var _11=O(()=>{b11=class b11 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as f14}from"async_hooks";var YV$,Bt;var f11=O(()=>{YV$=new f14,Bt={getStore:()=>{return YV$.getStore()},run:($,Z,...G)=>YV$.run($,Z,...G)}});var JV$="SELF",CD0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},WV$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},QV$="::",KV$=($)=>{let Z=$.indexOf(QV$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+QV$.length);return[G,X]},x14=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},UV$=($)=>{if(CD0($))return[];return Object.keys($)},v14=($,Z)=>{if(CD0($))return $.events;let G=$[Z];if(!G)return[];if(WV$(G))return G.events;return Object.keys(G)},VD0=($,Z,G)=>{if($===JV$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!C11(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},y14=($,Z,G)=>{let X=Z;if(CD0($)){let Q=[];for(let J of $.events){let W=KV$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=VD0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of UV$($)){let J=VD0(Q,X,G);if(!J)continue;let W=v14($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},g14=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},h14=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},c14=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},u14=async($,Z,G,X,Y)=>{let Q=X;if(CD0($)){let w=new Set;for(let H of $.events){let N=KV$(H);if(!N)continue;let[B,E]=N,D=VD0(B,Q,Y);if(!D)continue;w.add(`${D}:${E}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of UV$($)){let F=VD0(w,Q,Y);if(F)J.set(F,w)}let W=g14(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(WV$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(D){let L={};for(let z of F)L[z.id]={success:!1,error:D instanceof Error?D.message:String(D)};return{results:L}}})());continue}let B=N,E=h14(F);for(let[D,L]of E){let z=B[D];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return c14(U)},wV$;var x11=O(()=>{ny();wV$={subscriptions:y14,execute:u14,parseCron:x14}});function d14($,Z){let G=SD0("self",{meshUrl:$,token:Z});return Tx.forConnection(G)}function l14($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function FV$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=d14($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(l14(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var v11=O(()=>{ny();kD0()});import{z as JZ}from"zod";function jw($){return{...$,execute:(Z)=>{let G=Ot(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var Ot=($)=>{let Z=Bt.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},HV$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},m14=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?tS$(JZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[jw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:JZ.object({state:Z??JZ.unknown(),scopes:JZ.array(JZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:JZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:JZ.object({baseUrl:JZ.string(),org:JZ.string(),subjectConnectionId:JZ.string(),token:JZ.string()}).optional()}),outputSchema:JZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=HV$(J);await Y(J.runtimeContext.env,{createAgent:FV$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[jw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:P40,outputSchema:A40,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=HV$(J);return wV$.execute($.handlers,J.context.events,W,K,U)}})]:[],jw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:JZ.object({}),outputSchema:JZ.object({stateSchema:JZ.unknown(),scopes:JZ.array(JZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},NV$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(E)=>{if(J(E))return[E];Q();let D=await E(B);if(Array.isArray(D))return D;return[D]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...m14({...$}));let E;if(typeof $.prompts==="function")Q(),E=await $.prompts(N);else E=await W($.prompts,N);let D;if(typeof $.resources==="function")Q(),D=await $.resources(N);else D=await W($.resources,N);let L={tools:B,prompts:E,resources:D};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let E of B.tools)N.registerTool(E.id,{_meta:E._meta,title:E.title,description:E.description,annotations:E.annotations,inputSchema:E.inputSchema&&"shape"in E.inputSchema?E.inputSchema:JZ.object({}),outputSchema:E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0},async(D)=>{let L=Ot(),z=await E.execute({context:D,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let E of B.prompts)N.registerPrompt(E.name,{title:E.title,description:E.description,argsSchema:E.argsSchema?E.argsSchema:JZ.object({}).shape},async(D)=>{let L=Ot();return await E.execute({args:D,runtimeContext:L},L)});for(let E of B.resources)N.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType},async(D)=>{let L=Ot(),z=await E.read({uri:D,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...E}=$.serverInfo??{},D=new sK({...E,name:E.name??"@deco/mcp-api",version:E.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:O5,...B&&{instructions:B}}),L=await K(N);U(D,L);let z="tools/list",j=D.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:D,...L}};return{fetch:async(N,B)=>{let{server:E}=await w(B),D=new TY;await E.connect(D);let L=()=>{try{D.close?.()}catch{}try{E.close?.()}catch{}};try{let z=await D.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let E=Bt.getStore();if(!E)throw Error("Missing state, did you forget to call State.bind?");let D=E?.env,{tools:L}=await K(D),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=Ot();return j({context:B,runtimeContext:P},P)}}};var bD0=O(()=>{Vc0();H7();pc();Ev();ny();x11();f11();v11();x11();v11()});import{decodeJwt as BV$}from"jose";var i14=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},OV$=($)=>()=>{return{...$??{}}},n14=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=BV$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:OV$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=BV$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=OV$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=rS$(W),i14({env:Q,server:Z,url:X}),Q},p14,EV$=($)=>{let Z=NV$($),G=$.cors??p14,X=$.oauth,Y=X?XV$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return aS$(J,G??{});let U=n14({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await Bt.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return sS$(w,J,G??{});return w}}};var DV$=O(()=>{ny();eS$();_11();_11();f11();bD0();bD0();ny();kD0();p14={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as y11}from"zod";function o14($,Z){let G=jw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Wy,outputSchema:Ky,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=LV$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return LV$.set(U,F),F}}),X=jw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:aW,outputSchema:IV,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=jw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:aW,outputSchema:y11.object({versions:y11.array(IV.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=jw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:nO0,outputSchema:pO0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=jw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:y11.object({}),outputSchema:Uy,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function zV$($){let Z=$.db,G=new Tf(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=o14(G,Q.id),W=EV$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,E)=>{F.searchParams.set(E,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var t14=3600000,r14=500,LV$;var jV$=O(()=>{DV$();bD0();Sv0();e5();LV$=my({ttlMs:t14,maxSize:r14,updateRecencyOnGet:!0})});import{sql as a14}from"kysely";import{randomUUID as PV$}from"crypto";import{z as s14}from"zod";async function $$4($){let Z=new Date().toISOString(),G=PV$(),X=w4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:PV$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await a14`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function Z$4($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function G$4($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",RV).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):TV$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?AV$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:AV$,rateLimitWindow:e14,rateLimitMax:TV$}}async function X$4($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function Y$4($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function IV$($){let{db:Z,db:G}=$,X=new If(G),Y=new Rf(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await Z$4(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await G$4(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await X$4(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=yL$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:s14.treeifyError(w.error)},400);let F=await Y$4(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await $$4({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return p1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var AV$=!0,e14="hour",TV$=100;var RV$=O(()=>{f4();$6();wy();Vv0();Cv0();e5()});var qV$={};e8(qV$,{createPublishRequestHandler:()=>IV$,createPublicMCPHandler:()=>zV$});var MV$=O(()=>{jV$();RV$()});var pi0={};e8(pi0,{watchHandler:()=>bV$,getProxyDispatch:()=>K$4,createApp:()=>E$4});import{readFileSync as Q$4}from"fs";import{PrometheusSerializer as J$4}from"@opentelemetry/exporter-prometheus";import{DBOS as Et}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as H$4,oAuthProtectedResourceMetadata as N$4}from"better-auth/plugins";async function W$4($){let Z=$.connect(),G;try{G=await Promise.race([Z,SV$(kV$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),SV$(kV$)]),G.release(),!0}catch{return G.release(!0),!1}}function SV$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function K$4(){if(!g11)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return g11}async function U$4($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${bV1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function w$4($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function E$4($={}){let Z=$.database??g6(),G=!1;YZ.stop().catch((d)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",d)});let X,Y,Q=new w11,J,W,K,U,w,F=null;if($.disableNats)J=F11(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new Bn,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(d)=>{(async()=>{let m=d.getReader();try{while(!0){let{done:V0}=await m.read();if(V0)break}}catch{}finally{m.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=zk$();let d=L1().natsCredsPath,m;if(d)try{m=Q$4(d,"utf8")}catch(x1){console.error(`[app] failed to read NATS_CREDS at ${d}; connecting anonymously`,x1)}F.init(L1().natsUrls,m?{creds:m}:void 0);let V0=yv0()?new kf0({getJetStream:()=>F.getJetStream()}):null;V0?.init().catch(()=>{}),X=V0;let v0=new cn0({getJetStream:()=>F.getJetStream()});v0.init().catch(()=>{}),Y=v0,J=F11({getConnection:()=>F.getConnection()}),W=new H11({getConnection:()=>F.getConnection()}),K=new O11({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=sk$({getConnection:()=>F.getConnection()}),w=YS$({getConnection:()=>F.getConnection()});let r0=QS$({getConnection:()=>F.getConnection()}),s0=W;W={start:(x1)=>s0.start(x1),broadcast:(x1)=>s0.broadcast(x1),publishControlFrame:(x1,W8)=>{r0.publishControlFrame(x1,W8).catch((z4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",z4)})},stop:()=>s0.stop()},BP$(F),F.onReady(()=>{V0?.init().catch((x1)=>{console.error("[McpListCache] Deferred init failed:",x1)}),v0.init().catch((x1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",x1)}),J.start(),Pl1(()=>F.getConnection()),K.init().catch((x1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",x1)})})}if(py)await py();Sf0(X),un0(Y);let N={storage:new Cf(Z.db),streamBuffer:K,sseHub:YZ},B=new z11(N),E=new wl(Z.db),D=new j11(E);D.start(),W.start((d)=>{q50(d),B.execute({type:"CANCEL",taskId:d}).catch((m)=>{console.error("[Decopilot] CancelBroadcast execute failed:",m)})}).catch((d)=>{console.error("[Decopilot] CancelBroadcast start failed:",d)}),F?.onReady(()=>{W.start().catch((d)=>{console.error("[CancelBroadcast] Deferred start failed:",d)})}),K.init().catch((d)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",d)}),py=async()=>{await B.stopAll(),B.dispose(),D.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),Al1(),Y.teardown(),Sf0(null),un0(null)};let L=new y1;if(L.use("*",Mb0({enabled:(d)=>G_(d,"debug")==="1"})),L.use("*",oD0),L.use("/*",DC1({origin:(d)=>{if(d.includes("localhost")||d.includes("127.0.0.1"))return d;return d},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(d,m)=>{if(await m(),d.req.path.includes("/files/"))return;if(d.req.path.includes("/fs/")&&d.req.path.endsWith("/read"))return;d.header("X-Frame-Options","DENY"),d.header("Content-Security-Policy","frame-ancestors 'none'")}),!L1().noTui)L.use("*",MS$());L.use("*",async(d,m)=>{if(await m(),ay(d.req.path))return;if(d.res.status>=500){let v0=await d.res.clone().text();console.error(`[5xx Response] ${d.req.method} ${d.req.path} - ${d.res.status}:`,v0)}}),L.get(xX.HEALTH,(d)=>{if(G)return d.json({status:"shutting_down"},503);return d.json({status:"ok"})}),L.get(xX.HEALTH_LIVE,(d)=>{return d.json({status:"ok"})}),L.get(xX.HEALTH_READY,async(d)=>{if(G)return d.json({status:"shutting_down"},503);let m={};if(m.postgres={status:await W$4(Z.pool)?"up":"down"},F)m.nats=F.isConnected()?{status:"up"}:{status:"down"};else m.nats={status:"down"};let V0=m.postgres.status==="up",v0=V0?200:503;return d.json({status:V0?"ready":"not_ready",services:m},v0)}),L.get(xX.METRICS,async(d)=>{try{let m=await $L0.collect(),V0=F$4.serialize(m.resourceMetrics);return d.text(V0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(m){return console.error("Failed to collect metrics:",m),d.text("# Error collecting metrics",500)}}),L.route("/api/config",sM$),L.route("/api/auth/custom",xP$),L.all("/api/auth/*",async(d)=>{return await s6.handler(d.req.raw)});let z=pr1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",kV),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",kV),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",hm),L.route("/",ar1()),L.use("/oauth-proxy/:connectionId/*",kV),L.all("/oauth-proxy/:connectionId/*",VV$);let j=async(d)=>{let V0=await B$4()(d.req.raw),v0=await V0.json();return Response.json(v0,V0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",kV),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(d)=>{let V0=await O$4()(d.req.raw),v0=await V0.json();return Response.json(v0,V0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=wP$({ttlMs:120000}),M=await _r1({db:Z.db,auth:s6,encryption:{key:L1().encryptionKey},observability:{tracer:Aw,meter:y8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(d,m)=>W.publishControlFrame(d,m)});vH.set(M);let S=new fO(L1().encryptionKey);RI1({db:Z.db,baseUrl:v3()});let q=H80(Z.db),V=new Gl(Z.db),t=TS$({db:Z.db});xn0({storage:q,meshContextFactory:t}),Nl0({meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ},prepareLinkWorkFn:II$,workPublisher:w}),Kl0({dispatchRunFn:AI$,meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ}});let f=new Cf(Z.db);M8$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let d=F?.getConnection();return d?await CV$.jetstreamManager(d):null},messageParts:f.messageParts(),resolveRun:async(d)=>{let m=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",d).executeTakeFirst();return m?{orgId:m.organization_id,createdBy:m.created_by,version:m.message_storage_version??1,status:m.status,runFenceToken:m.run_fence_token,title:m.title??null}:null},completeRunIfNotCompleted:async(d,m)=>{let V0=await f.completeRunIfNotCompleted(d,m);return ID0(YZ,m,d,V0),V0},markRunRequiresAction:async(d,m)=>{let V0=await f.requiresActionIfInProgress(d,m);return ID0(YZ,m,d,V0),V0},markRunFailed:async(d,m,V0,v0)=>{let r0=await f.markRunFailed(d,m,V0,v0);return ID0(YZ,m,d,r0),r0},persistTitle:(d,m,V0)=>f.update(d,m,{title:V0}),onTitleUpdated:async({runId:d,orgId:m,title:V0})=>{let v0=await f.get(d,m).catch(()=>null);YZ.emit(m,OJ(d,v0?.status??"in_progress",{title:V0,virtualMcpId:v0?.virtual_mcp_id??void 0,createdBy:v0?.created_by,triggerId:v0?.trigger_id,branch:v0?.branch??null,createdAt:v0?.created_at,updatedAt:v0?.updated_at}))},bumpProgress:async({runId:d,orgId:m})=>{await f.bumpProgress(d,m)},recordCompleted:async({runId:d,orgId:m,distinctId:V0,usage:v0})=>{p1.capture({distinctId:V0,event:"chat_message_completed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",input_tokens:v0.inputTokens,output_tokens:v0.outputTokens,total_tokens:v0.totalTokens}})},recordFailed:async({runId:d,orgId:m,distinctId:V0,reason:v0,kind:r0})=>{p1.capture({distinctId:V0,event:"chat_message_failed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",error_category:r0,error_message:v0}})},purgeRun:async(d)=>{K.purge(d)}}),$Q$({meshContextFactory:t,systemDatabaseUrl:u_1(L1().databaseUrl,L1().databasePgSsl),streamBuffer:K}),PS$(),qI1();let v=async(d,m,V0)=>{let v0=await q.findById(d,m);if(!v0)throw Error("Automation not found");return gn0({automationId:v0.id,organizationId:v0.organization_id,triggerId:null})},e=new Iy(q,({automation:d,trigger:m,contextMessages:V0,idempotencyKey:v0})=>Hn({automationId:d.id,organizationId:d.organization_id,triggerId:m.id,contextMessages:V0},{idempotencyKey:v0})),o=[yQ(),iV(),wK()];for(let d of o)MD0(d).then(()=>{}).catch((m)=>console.error("[monitoring] Retention cleanup failed:",m));let B0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((d)=>console.error("[auth] Expired API key cleanup failed:",d));B0(),setInterval(B0,86400000).unref(),L.use("*",async(d,m)=>{if(tD0(d.req.path))return m();let V0={measure:async(r0,s0)=>{tY(d,r0);try{return await s0()}finally{aX(d,r0)}}},v0=await vH.create(d.req.raw,{timings:V0});v0.automationRunner=v,d.set("meshContext",v0);try{await m()}finally{let r0=v0.pendingRevalidations;if(r0.length>0)Promise.race([Promise.allSettled(r0),new Promise((x1)=>setTimeout(x1,30000))]).catch((x1)=>console.error("[mesh] revalidation cleanup error:",x1))}}),L.use("/api/:org/decopilot/*",SV),L.use("/api/:org/v1/*",SV),L.use("/api/:org/files/*",SV),L.use("*",async(d,m)=>{let V0=d.req.path;if(V0.startsWith("/api/org-sso/")||V0.startsWith("/api/auth/")||V0.startsWith("/api/tools/management")||V0.startsWith("/oauth-proxy/"))return m();let v0=d.get("meshContext");if(!v0?.organization?.id||!v0?.auth?.user?.id)return m();if(!(await v0.storage.orgSsoConfig.getByOrgId(v0.organization.id))?.enforced)return m();if(!await v0.storage.orgSsoSessions.isValid(v0.auth.user.id,v0.organization.id))return d.json({error:"SSO authentication required for this organization"},403);return m()});let O0=new y1;O0.use("*",bQ({mountPath:"/api/org-sso"})),O0.route("/",JE0()),L.route("/api/org-sso",O0),L.get("/api/tools/management",(d)=>{return d.json({tools:Sb0,grouped:TO()})}),L.use("/mcp/*",async(d,m)=>{tY(d,"mcp");try{return await m()}finally{aX(d,"mcp")}});let K0=async(d,m)=>{let V0=d.var.meshContext;if(!V0.auth.user?.id&&!V0.auth.apiKey?.id){let v0=new URL(d.req.url);return d.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${v0.origin}${v0.pathname}/.well-known/oauth-protected-resource"`}})}return await m()};if(L.use("/mcp/:connectionId?",K0),L.use("/mcp/gateway/:virtualMcpId?",K0),L.use("/mcp/virtual-mcp/:virtualMcpId?",K0),L.use("/mcp/self",K0),EJ()){let{mountDevRoutes:d}=(mS$(),gD0(lS$));d(L,K0)}let J0=new y1;J0.use("*",bQ({mountPath:"/mcp"})),J0.route("/",tH0()),L.route("/mcp",J0);let s=new y1;s.use("*",bQ({mountPath:"/mcp/self"})),s.route("/",ND0()),L.route("/mcp/self",s);let T0=new y1;T0.use("*",bQ({mountPath:"/mcp"})),T0.route("/",aH0()),L.route("/mcp",T0),L.use("/api/:org/models/*",async(d,m)=>{tY(d,"llm_models");try{return await m()}finally{aX(d,"llm_models")}});let F0=Oe0({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",F0),F!=null)g11=$S$({getConnection:()=>F?.getConnection()??null});L.route("/api",yM$()),L.get("/api/links/me",async(d)=>{try{let m=d.req.header("authorization")??"",V0=/^Bearer\s+(.+)$/i.exec(m),v0=null;if(V0){let s0=(V0[1]??"").trim();v0=await jM$(s0,s6.api)}else v0=d.get("meshContext")?.auth?.user?.id??null;if(!v0)return d.json({error:"unauthorized"},401);let r0=U?await U(v0):{online:!1,capabilities:[]};if(!r0.online)return d.json(null);return d.json({hostname:r0.hostname,cliVersion:r0.cliVersion})}catch(m){return console.error("[links/me] presence probe failed; reporting offline:",m instanceof Error?m.message:String(m)),d.json(null)}}),L.use("/api/:org/files/*",SV),L.route("/api",Gk$);let f0=new y1;f0.use("*",bQ({mountPath:"/api"})),f0.route("/",BD0()),L.route("/api",f0),L.route("/api",rM$);let m0=new y1;m0.use("*",bQ({mountPath:"/api"})),m0.route("/",OD0({tokenStorage:V,automationEventDispatcher:e})),L.route("/api",m0);let x0=new Yl(Z.db),i0=new y1;i0.use("*",bQ({mountPath:"/api"})),i0.route("/",fE0()),L.route("/api",i0),L.route("/api/deco-sites",dI$()),L.route("/api/deco-apps",lM$());let H0=new y1;H0.use("*",bQ({mountPath:"/api/deco-sites"})),H0.route("/",vE0()),L.route("/api/deco-sites",H0);let S0=new y1;S0.use("*",bQ({mountPath:"/api/vm-events"})),S0.route("/",uM$()),L.route("/api/vm-events",S0);let{createPublishRequestHandler:R0,createPublicMCPHandler:w0}=await Promise.resolve().then(() => (MV$(),qV$)),Y0={db:Z.db,vault:{encrypt:(d)=>S.encrypt(d),decrypt:(d)=>S.decrypt(d)}},G0=R0(Y0),k0=w0(Y0);L.use("/org/:orgRef/registry/publish-request",kV),L.post("/org/:orgRef/registry/publish-request",G0),L.use("/org/:orgSlug/registry/*",kV),L.all("/org/:orgSlug/registry/*",k0),L.post("/api/:org/registry/publish-request",G0),L.all("/api/:org/registry/*",k0);let i=LM$({kvStorage:x0,runRegistry:B,streamBuffer:K,sseHub:YZ,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:e,mountDevAssets:EJ(),mcpAuth:K0,oauthProxyHandler:VV$,watchHandler:bV$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",i),L.notFound((d)=>{return d.json({error:"Not Found",path:d.req.path},404)}),L.onError(SI$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([YZ.stop(),py?Promise.resolve(py()).finally(()=>{py=null}):Promise.resolve()]),F)await F.drain().catch((d)=>console.error("[shutdown] NATS drain error:",d));console.log("[shutdown] Flushing telemetry..."),await CY().catch((d)=>console.error("[shutdown] Telemetry flush error:",d)),console.log("[shutdown] Closing database..."),await l_1(Z).catch((d)=>console.error("[shutdown] Database close error:",d)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Et.registerQueue(vQ,{partitionQueue:!0,concurrency:bn0,minPollingIntervalMs:_n0}),await Et.registerQueue(L3,{partitionQueue:!0,concurrency:Hl0}),await Et.registerQueue(Pw,{partitionQueue:!0,concurrency:Wl0}),await Et.registerQueue($B,{partitionQueue:!0,concurrency:eY$}),await ze0(q),await Promise.allSettled(["automations-gate","automations-global"].map((d)=>Et.deleteQueue(d))),await fn0(Z.pool),Hy1().catch((d)=>{console.error("[studio-pack-backfill] failed:",d)}),MI1().catch((d)=>{console.error("[org-fs] public-sets boot sync kick failed:",d)})}})}var CV$,kV$=5000,g11=null,py=null,VV$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("meshContext");if(!Y)Y=await vH.create($.req.raw),$.set("meshContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await Ox(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await cm(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let q=N.searchParams.get("redirect_uri");if(q){let V=L1().baseUrl??B.origin;try{let t=new URL(q),f=new URL(V);if(!(t.origin===f.origin||t.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",q)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(_V1(J.connection_url))try{let V=await U$4(Y,J.organization_id),t=w$4(V);for(let[f,v]of t)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},D=$.req.header("Content-Type");if(D)E["Content-Type"]=D;let L=$.req.header("Authorization");if(L)E.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&D?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),e=v.indexOf(":");if(e!==-1){let o=decodeURIComponent(v.slice(0,e)),B0=decodeURIComponent(v.slice(e+1));j=o||null,P=B0||null}}catch{}let q=await $.req.formData();if(q.has("resource"))q.set("resource",J.connection_url);let V=q.get("client_id"),t=q.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof t==="string"&&t)P=t;let f=new URLSearchParams;for(let[v,e]of q.entries())f.append(v,e.toString());z=f.toString()}else if(X==="register"&&D?.toLowerCase().includes("application/json")){let q=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),t={};try{t=V?JSON.parse(V):{}}catch{z=V}let f=typeof t==="object"&&t!==null&&!Array.isArray(t);if(z===void 0&&!f)z=V;if(z===void 0){let v=t,e=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...e,organization_id:J.organization_id,...q?.slug?{organization_slug:q.slug}:{},...q?.name?{organization_name:q.name}:{}},z=JSON.stringify(v),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[q,V]of A.headers.entries())if(!S.includes(q.toLowerCase()))M.set(q,V);if(X==="token"&&A.ok){let q=await A.text();try{let V=JSON.parse(q);if(typeof V.access_token==="string"&&V.access_token){let t=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await Ex(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:t,clientId:j,clientSecret:P,tokenEndpoint:f};await new V5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(q,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},bV$=async($)=>{let Z=$.var.meshContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return _Q($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!YZ.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{YZ.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),YZ.remove(X,J),w()})})})},F$4,B$4=()=>N$4(s6),O$4=()=>H$4(s6);var ti0=O(()=>{q8();kI1();m7();eb();$6();d6();K10();LC1();kb0();SU();gm();ws0();LJ();I5();f4();Ds0();Ps0();MI$();Ee0();uJ();$40();De0();VI$();Le0();zM$();gM$();dM$();Te0();mM$();rH0();um();oM$();sH0();i01();eM$();Xk$();m01();l01();Mt();p10();jk$();eX();V80();Jl();ln0();Pk$();Tk$();Sk$();ek$();ZS$();JS$();DS$();LS$();ov0();Zy0();AS$();Y$0();P11();fX();je0();ki();Ql0();Y$0();He0();jv0();Pv0();IS$();X_();kS$();gV();ws0();Bv();M50();CV$=k(OB(),1);F$4=new J$4});var vV$={};e8(vV$,{resolveClientDir:()=>T$4,resolveAssetPathWithTraversalCheck:()=>xV$,isPathWithinDirectory:()=>fV$,createAssetHandler:()=>I$4});import{resolve as Dt,dirname as D$4,join as L$4,extname as z$4,basename as j$4,sep as _V$}from"path";function P$4($,Z){if($===Z||j$4($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${_V$}assets${_V$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function fV$($,Z){let G=Dt(Z),X=Dt($);return X===G||X.startsWith(G+"/")}function xV$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=Dt(Z,G);if(!fV$(X,Z))return null;return X}function T$4($,Z="../client"){let G=new URL($),X=D$4(G.pathname);return Dt(X,Z)}function I$4($={}){let{env:Z="production",clientDir:G=A$4,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=xV$({requestPath:W,clientDir:G});if(!K)return null;let U=L$4(K,"index.html"),w=Dt(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(z$4(K))?[U,w]:[];for(let B of[K,...N])try{let E=Bun.file(B);if(await E.exists())return new Response(E,{headers:P$4(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var A$4="./dist/client";var yV$=()=>{};var gV$={};e8(gV$,{tryUpgradePreviewWs:()=>C$4,tryHandlePreviewHttp:()=>V$4,previewWebSocketHandler:()=>b$4,parsePreviewBaseDomain:()=>S$4,isPreviewWsData:()=>_D0,extractHandleFromHost:()=>h11});function M$4($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function k$4(){return new Response(q$4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function S$4($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function h11($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function V$4($,Z){let G=h11($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return zt(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(uS)&&M$4($))return k$4();return Y.headers.delete(uS),Y}function zt($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function _D0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function C$4($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=h11($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return zt(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return zt(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return zt(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return zt(426,"upgrade failed");return}function Lt($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var R$4=256,q$4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',b$4;var hV$=O(()=>{li0();b$4={open($){let Z=$.data;if(!_D0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Lt($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Lt($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Lt($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!_D0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=R$4){Lt($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!_D0(Z))return;Lt($,Z,1000,"")}}});var lV$={};e8(lV$,{printBanner:()=>f$4,bannerLines:()=>dV$,BANNER_LINES:()=>cV$,BANNER_GRADIENT:()=>uV$});function _$4($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function dV$($){let Z=cV$.map((G,X)=>{let[Y,Q,J]=_$4(uV$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function f$4($){console.log("");for(let Z of dV$($))console.log(Z);console.log("")}var cV$,uV$;var mV$=O(()=>{cV$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],uV$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var nV$={};e8(nV$,{bootstrapDevLinkSession:()=>l$4});import{existsSync as x$4}from"fs";import{chmod as v$4,mkdir as y$4,rename as g$4,writeFile as h$4}from"fs/promises";import{dirname as c$4,join as iV$}from"path";function u$4($){return iV$($,"dev-link")}function d$4($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return iV$(u$4($),"session.json")}async function l$4($,Z){let G=d$4($),X=g6().db,Y=PQ()?await Kn():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(x$4(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await s6.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await s6.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await y$4(c$4(G),{recursive:!0});let W=`${G}.tmp`;return await h$4(W,JSON.stringify(J,null,2),{mode:384}),await v$4(W,384),await g$4(W,G),{path:G,userSub:Y.id}}var pV$=O(()=>{LJ();SU();jN()});f7();var t11="3";function r11($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:t11,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}q8();I5();function Jb$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function YL0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function V$1(){let $=Jb$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:YL0($,"--cpu-prof-dir")??process.cwd(),name:YL0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(YL0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}WL0();var Vt;function h$1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=GB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),Vt=setInterval(()=>void Z().catch(()=>{}),$),Vt.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(Vt)clearInterval(Vt)}}import*as Ub$ from"bun:jsc";var{startSamplingProfiler:wb$,samplingProfilerStackTraces:Fb$}=Ub$;function c$1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{wb$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=Fb$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function u$1(){V$1();let $=[h$1(),g$1(),c$1()];return()=>{for(let Z of $)Z()}}import{existsSync as a$4}from"fs";var VY=L1();k$1();var{DBOS:jt,DBOSClient:m$4}=await import("@dbos-inc/dbos-sdk");function sV$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var i$4=[vQ,L3,Pw,$B],n$4=VY.dispatchRole==="worker"?i$4:VY.dispatchRole==="api"?[]:void 0;jt.setConfig(r11({systemDatabaseUrl:sV$(VY.databaseUrl,VY.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:VY.podName,listenQueues:n$4}));var{createApp:p$4}=await Promise.resolve().then(() => (ti0(),pi0)),{isServerPath:t$4}=await Promise.resolve().then(() => (Mt(),F$1)),{createAssetHandler:r$4,resolveClientDir:eV$}=await Promise.resolve().then(() => (yV$(),vV$)),o$4=VY.port,tV$=eV$(import.meta.url,"../client"),s$4=a$4(tV$)?tV$:eV$(import.meta.url,"../dist/client"),e$4=r$4({clientDir:s$4,isServerPath:t$4}),$84={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function Z84($){let Z=new Headers($.headers);for(let[G,X]of Object.entries($84))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:G84,tryHandlePreviewHttp:X84,tryUpgradePreviewWs:Y84,previewWebSocketHandler:c11,isPreviewWsData:u11}=await Promise.resolve().then(() => (hV$(),gV$)),{getOrInitSharedRunner:Q84}=await Promise.resolve().then(() => (Xn(),eX$)),$C$=G84(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),rV$={baseDomain:$C$??"",getRunner:Q84},fD0=await p$4(),d11=process.env.DBOS_CONDUCTOR_KEY?.trim(),oV$=process.env.DBOS_CONDUCTOR_URL?.trim();await jt.launch({...d11?{conductorKey:d11}:{},...d11&&oV$?{conductorURL:oV$}:{}});console.log(`[dbos] application version: ${jt.applicationVersion}`);await fD0.initDbos();if(!VY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (mV$(),lV$));console.log("");for(let Z of $())console.log(Z)}var J84=Bun.serve({idleTimeout:0,port:o$4,hostname:"0.0.0.0",fetch:async($,Z)=>{if($C$){let X=await Y84($,Z,rV$);if(X===void 0)return;if(X)return X;let Y=await X84($,rV$);if(Y)return Y}let G=await e$4($);if(G)return Z84(G);return fD0.fetch($,{server:Z})},websocket:{open($){if(u11($.data))c11.open($)},message($,Z){if(u11($.data))c11.message($,Z)},close($){if(u11($.data))c11.close($)}},development:!1}),W84=u$1();if(VY.localMode)Promise.resolve().then(() => (jN(),kH0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (pV$(),nV$)),Y=VY.baseUrl??`http://localhost:${VY.port}`,Q=await X(VY.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (jN(),kH0));Z()}catch{}});var aV$=!1;async function K84($){let Z;try{Z=await m$4.create({systemDatabaseUrl:sV$(VY.databaseUrl,VY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:L3,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:L3}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function xD0($){if(aV$)return;aV$=!0,console.log(`
+`;return new TextEncoder().encode(X)}var Z11,hV,Ge6,MM$,$11="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",Ye6,h$,g$,a8,qM$=24,cV,O3;var fM$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(Z11||(Z11={}));(function($){var Z=function(g,l){this.hi=g|0,this.lo=l|0},G=function(g){var l,h=new Float64Array(16);if(g)for(l=0;l<g.length;l++)h[l]=g[l];return h},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(g,l){return g<<l|g>>>32-l}function E(g,l){var h=g[l+3]&255;return h=h<<8|g[l+2]&255,h=h<<8|g[l+1]&255,h<<8|g[l+0]&255}function D(g,l){var h=g[l]<<24|g[l+1]<<16|g[l+2]<<8|g[l+3],r=g[l+4]<<24|g[l+5]<<16|g[l+6]<<8|g[l+7];return new Z(h,r)}function L(g,l,h){var r;for(r=0;r<4;r++)g[l+r]=h&255,h>>>=8}function z(g,l,h){g[l]=h.hi>>24&255,g[l+1]=h.hi>>16&255,g[l+2]=h.hi>>8&255,g[l+3]=h.hi&255,g[l+4]=h.lo>>24&255,g[l+5]=h.lo>>16&255,g[l+6]=h.lo>>8&255,g[l+7]=h.lo&255}function j(g,l,h,r,X0){var W0,_0=0;for(W0=0;W0<X0;W0++)_0|=g[l+W0]^h[r+W0];return(1&_0-1>>>8)-1}function P(g,l,h,r){return j(g,l,h,r,16)}function A(g,l,h,r){return j(g,l,h,r,32)}function M(g,l,h,r,X0){var W0=new Uint32Array(16),_0=new Uint32Array(16),l0=new Uint32Array(16),P0=new Uint32Array(4),M0,j0,g0;for(M0=0;M0<4;M0++)_0[5*M0]=E(r,4*M0),_0[1+M0]=E(h,4*M0),_0[6+M0]=E(l,4*M0),_0[11+M0]=E(h,16+4*M0);for(M0=0;M0<16;M0++)l0[M0]=_0[M0];for(M0=0;M0<20;M0++){for(j0=0;j0<4;j0++){for(g0=0;g0<4;g0++)P0[g0]=_0[(5*j0+4*g0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(g0=0;g0<4;g0++)W0[4*j0+(j0+g0)%4]=P0[g0]}for(g0=0;g0<16;g0++)_0[g0]=W0[g0]}if(X0){for(M0=0;M0<16;M0++)_0[M0]=_0[M0]+l0[M0]|0;for(M0=0;M0<4;M0++)_0[5*M0]=_0[5*M0]-E(r,4*M0)|0,_0[6+M0]=_0[6+M0]-E(l,4*M0)|0;for(M0=0;M0<4;M0++)L(g,4*M0,_0[5*M0]),L(g,16+4*M0,_0[6+M0])}else for(M0=0;M0<16;M0++)L(g,4*M0,_0[M0]+l0[M0]|0)}function S(g,l,h,r){return M(g,l,h,r,!1),0}function q(g,l,h,r){return M(g,l,h,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function t(g,l,h,r,X0,W0,_0){var l0=new Uint8Array(16),P0=new Uint8Array(64),M0,j0;if(!X0)return 0;for(j0=0;j0<16;j0++)l0[j0]=0;for(j0=0;j0<8;j0++)l0[j0]=W0[j0];while(X0>=64){S(P0,l0,_0,V);for(j0=0;j0<64;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0];M0=1;for(j0=8;j0<16;j0++)M0=M0+(l0[j0]&255)|0,l0[j0]=M0&255,M0>>>=8;if(X0-=64,l+=64,h)r+=64}if(X0>0){S(P0,l0,_0,V);for(j0=0;j0<X0;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0]}return 0}function f(g,l,h,r,X0){return t(g,l,null,0,h,r,X0)}function v(g,l,h,r,X0){var W0=new Uint8Array(32);return q(W0,r,X0,V),f(g,l,h,r.subarray(16),W0)}function e(g,l,h,r,X0,W0,_0){var l0=new Uint8Array(32);return q(l0,W0,_0,V),t(g,l,h,r,X0,W0.subarray(16),l0)}function o(g,l){var h,r=0;for(h=0;h<17;h++)r=r+(g[h]+l[h]|0)|0,g[h]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function O0(g,l,h,r,X0,W0){var _0,l0,P0,M0,j0=new Uint32Array(17),g0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),K1=new Uint32Array(17);for(P0=0;P0<17;P0++)g0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)g0[P0]=W0[P0];g0[3]&=15,g0[4]&=252,g0[7]&=15,g0[8]&=252,g0[11]&=15,g0[12]&=252,g0[15]&=15;while(X0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<X0;++P0)Z1[P0]=h[r+P0];Z1[P0]=1,r+=P0,X0-=P0,o(o0,Z1);for(l0=0;l0<17;l0++){j0[l0]=0;for(P0=0;P0<17;P0++)j0[l0]=j0[l0]+o0[P0]*(P0<=l0?g0[l0-P0]:320*g0[l0+17-P0]|0)|0|0}for(l0=0;l0<17;l0++)o0[l0]=j0[l0];M0=0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0&3,M0=5*(M0>>>2)|0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0}for(P0=0;P0<17;P0++)K1[P0]=o0[P0];o(o0,B0),_0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=_0&(K1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)g[l+P0]=o0[P0];return 0}function K0(g,l,h,r,X0,W0){var _0=new Uint8Array(16);return O0(_0,0,h,r,X0,W0),P(g,l,_0,0)}function J0(g,l,h,r,X0){var W0;if(h<32)return-1;e(g,0,l,0,h,r,X0),O0(g,16,g,32,h-32,g);for(W0=0;W0<16;W0++)g[W0]=0;return 0}function s(g,l,h,r,X0){var W0,_0=new Uint8Array(32);if(h<32)return-1;if(v(_0,0,32,r,X0),K0(l,16,l,32,h-32,_0)!==0)return-1;e(g,0,l,0,h,r,X0);for(W0=0;W0<32;W0++)g[W0]=0;return 0}function T0(g,l){var h;for(h=0;h<16;h++)g[h]=l[h]|0}function F0(g){var l,h;for(h=0;h<16;h++)g[h]+=65536,l=Math.floor(g[h]/65536),g[(h+1)*(h<15?1:0)]+=l-1+37*(l-1)*(h===15?1:0),g[h]-=l*65536}function f0(g,l,h){var r,X0=~(h-1);for(var W0=0;W0<16;W0++)r=X0&(g[W0]^l[W0]),g[W0]^=r,l[W0]^=r}function m0(g,l){var h,r,X0,W0=G(),_0=G();for(h=0;h<16;h++)_0[h]=l[h];F0(_0),F0(_0),F0(_0);for(r=0;r<2;r++){W0[0]=_0[0]-65517;for(h=1;h<15;h++)W0[h]=_0[h]-65535-(W0[h-1]>>16&1),W0[h-1]&=65535;W0[15]=_0[15]-32767-(W0[14]>>16&1),X0=W0[15]>>16&1,W0[14]&=65535,f0(_0,W0,1-X0)}for(h=0;h<16;h++)g[2*h]=_0[h]&255,g[2*h+1]=_0[h]>>8}function x0(g,l){var h=new Uint8Array(32),r=new Uint8Array(32);return m0(h,g),m0(r,l),A(h,0,r,0)}function i0(g){var l=new Uint8Array(32);return m0(l,g),l[0]&1}function H0(g,l){var h;for(h=0;h<16;h++)g[h]=l[2*h]+(l[2*h+1]<<8);g[15]&=32767}function S0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]+h[r]|0}function R0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]-h[r]|0}function w0(g,l,h){var r,X0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(X0=0;X0<16;X0++)W0[r+X0]+=l[r]*h[X0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)g[r]=W0[r];F0(g),F0(g)}function Y0(g,l){w0(g,l,l)}function G0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=253;r>=0;r--)if(Y0(h,h),r!==2&&r!==4)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function k0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=250;r>=0;r--)if(Y0(h,h),r!==1)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function i(g,l,h){var r=new Uint8Array(32),X0=new Float64Array(80),W0,_0,l0=G(),P0=G(),M0=G(),j0=G(),g0=G(),o0=G();for(_0=0;_0<31;_0++)r[_0]=l[_0];r[31]=l[31]&127|64,r[0]&=248,H0(X0,h);for(_0=0;_0<16;_0++)P0[_0]=X0[_0],j0[_0]=l0[_0]=M0[_0]=0;l0[0]=j0[0]=1;for(_0=254;_0>=0;--_0)W0=r[_0>>>3]>>>(_0&7)&1,f0(l0,P0,W0),f0(M0,j0,W0),S0(g0,l0,M0),R0(l0,l0,M0),S0(M0,P0,j0),R0(P0,P0,j0),Y0(j0,g0),Y0(o0,l0),w0(l0,M0,l0),w0(M0,P0,g0),S0(g0,l0,M0),R0(l0,l0,M0),Y0(P0,l0),R0(M0,j0,o0),w0(l0,M0,K),S0(l0,l0,j0),w0(M0,M0,l0),w0(l0,j0,o0),w0(j0,P0,X0),Y0(P0,g0),f0(l0,P0,W0),f0(M0,j0,W0);for(_0=0;_0<16;_0++)X0[_0+16]=l0[_0],X0[_0+32]=M0[_0],X0[_0+48]=P0[_0],X0[_0+64]=j0[_0];var Z1=X0.subarray(32),K1=X0.subarray(16);return G0(Z1,Z1),w0(K1,K1,Z1),m0(g,K1),0}function $0(g,l){return i(g,l,Q)}function p0(g,l){return X(l,32),$0(g,l)}function I0(g,l,h){var r=new Uint8Array(32);return i(r,h,l),q(g,Y,r,V)}var d=J0,m=s;function V0(g,l,h,r,X0,W0){var _0=new Uint8Array(32);return I0(_0,X0,W0),d(g,l,h,r,_0)}function v0(g,l,h,r,X0,W0){var _0=new Uint8Array(32);return I0(_0,X0,W0),m(g,l,h,r,_0)}function r0(){var g=0,l=0,h=0,r=0,X0=65535,W0,_0,l0;for(l0=0;l0<arguments.length;l0++)W0=arguments[l0].lo,_0=arguments[l0].hi,g+=W0&X0,l+=W0>>>16,h+=_0&X0,r+=_0>>>16;return l+=g>>>16,h+=l>>>16,r+=h>>>16,new Z(h&X0|r<<16,g&X0|l<<16)}function s0(g,l){return new Z(g.hi>>>l,g.lo>>>l|g.hi<<32-l)}function x1(){var g=0,l=0,h;for(h=0;h<arguments.length;h++)g^=arguments[h].lo,l^=arguments[h].hi;return new Z(l,g)}function W8(g,l){var h,r,X0=32-l;if(l<32)h=g.hi>>>l|g.lo<<X0,r=g.lo>>>l|g.hi<<X0;else if(l<64)h=g.lo>>>l|g.hi<<X0,r=g.hi>>>l|g.lo<<X0;return new Z(h,r)}function z4(g,l,h){var r=g.hi&l.hi^~g.hi&h.hi,X0=g.lo&l.lo^~g.lo&h.lo;return new Z(r,X0)}function l4(g,l,h){var r=g.hi&l.hi^g.hi&h.hi^l.hi&h.hi,X0=g.lo&l.lo^g.lo&h.lo^l.lo&h.lo;return new Z(r,X0)}function F5(g){return x1(W8(g,28),W8(g,34),W8(g,39))}function Z0(g){return x1(W8(g,14),W8(g,18),W8(g,41))}function J1(g){return x1(W8(g,1),W8(g,8),s0(g,7))}function m8(g){return x1(W8(g,19),W8(g,61),s0(g,6))}var t$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function D9(g,l,h){var r=[],X0=[],W0=[],_0=[],l0,P0,M0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=D(g,8*P0);var j0=0;while(h>=128){for(P0=0;P0<16;P0++)_0[P0]=D(l,8*P0+j0);for(P0=0;P0<80;P0++){for(M0=0;M0<8;M0++)X0[M0]=W0[M0];l0=r0(W0[7],Z0(W0[4]),z4(W0[4],W0[5],W0[6]),t$[P0],_0[P0%16]),X0[7]=r0(l0,F5(W0[0]),l4(W0[0],W0[1],W0[2])),X0[3]=r0(X0[3],l0);for(M0=0;M0<8;M0++)W0[(M0+1)%8]=X0[M0];if(P0%16===15)for(M0=0;M0<16;M0++)_0[M0]=r0(_0[M0],_0[(M0+9)%16],J1(_0[(M0+1)%16]),m8(_0[(M0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=r0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,h-=128}for(P0=0;P0<8;P0++)z(g,8*P0,r[P0]);return h}var _7=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function P8(g,l,h){var r=new Uint8Array(64),X0=new Uint8Array(256),W0,_0=h;for(W0=0;W0<64;W0++)r[W0]=_7[W0];D9(r,l,h),h%=128;for(W0=0;W0<256;W0++)X0[W0]=0;for(W0=0;W0<h;W0++)X0[W0]=l[_0-h+W0];X0[h]=128,h=256-128*(h<112?1:0),X0[h-9]=0,z(X0,h-8,new Z(_0/536870912|0,_0<<3)),D9(r,X0,h);for(W0=0;W0<64;W0++)g[W0]=r[W0];return 0}function I6(g,l){var h=G(),r=G(),X0=G(),W0=G(),_0=G(),l0=G(),P0=G(),M0=G(),j0=G();R0(h,g[1],g[0]),R0(j0,l[1],l[0]),w0(h,h,j0),S0(r,g[0],g[1]),S0(j0,l[0],l[1]),w0(r,r,j0),w0(X0,g[3],l[3]),w0(X0,X0,w),w0(W0,g[2],l[2]),S0(W0,W0,W0),R0(_0,r,h),R0(l0,W0,X0),S0(P0,W0,X0),S0(M0,r,h),w0(g[0],_0,l0),w0(g[1],M0,P0),w0(g[2],P0,l0),w0(g[3],_0,M0)}function e4(g,l,h){var r;for(r=0;r<4;r++)f0(g[r],l[r],h)}function A5(g,l){var h=G(),r=G(),X0=G();G0(X0,l[2]),w0(h,l[0],X0),w0(r,l[1],X0),m0(g,r),g[31]^=i0(h)<<7}function $9(g,l,h){var r,X0;T0(g[0],J),T0(g[1],W),T0(g[2],W),T0(g[3],J);for(X0=255;X0>=0;--X0)r=h[X0/8|0]>>(X0&7)&1,e4(g,l,r),I6(l,g),I6(g,g),e4(g,l,r)}function L9(g,l){var h=[G(),G(),G(),G()];T0(h[0],F),T0(h[1],H),T0(h[2],W),w0(h[3],F,H),$9(g,h,l)}function b1(g,l,h){var r=new Uint8Array(64),X0=[G(),G(),G(),G()],W0;if(!h)X(l,32);P8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,L9(X0,r),A5(g,X0);for(W0=0;W0<32;W0++)l[W0+32]=g[W0];return 0}var A8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function T8(g,l){var h,r,X0,W0;for(r=63;r>=32;--r){h=0;for(X0=r-32,W0=r-12;X0<W0;++X0)l[X0]+=h-16*l[r]*A8[X0-(r-32)],h=Math.floor((l[X0]+128)/256),l[X0]-=h*256;l[X0]+=h,l[r]=0}h=0;for(X0=0;X0<32;X0++)l[X0]+=h-(l[31]>>4)*A8[X0],h=l[X0]>>8,l[X0]&=255;for(X0=0;X0<32;X0++)l[X0]-=h*A8[X0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,g[r]=l[r]&255}function s8(g){var l=new Float64Array(64),h;for(h=0;h<64;h++)l[h]=g[h];for(h=0;h<64;h++)g[h]=0;T8(g,l)}function b$(g,l,h,r){var X0=new Uint8Array(64),W0=new Uint8Array(64),_0=new Uint8Array(64),l0,P0,M0=new Float64Array(64),j0=[G(),G(),G(),G()];P8(X0,r,32),X0[0]&=248,X0[31]&=127,X0[31]|=64;var g0=h+64;for(l0=0;l0<h;l0++)g[64+l0]=l[l0];for(l0=0;l0<32;l0++)g[32+l0]=X0[32+l0];P8(_0,g.subarray(32),h+32),s8(_0),L9(j0,_0),A5(g,j0);for(l0=32;l0<64;l0++)g[l0]=r[l0];P8(W0,g,h+64),s8(W0);for(l0=0;l0<64;l0++)M0[l0]=0;for(l0=0;l0<32;l0++)M0[l0]=_0[l0];for(l0=0;l0<32;l0++)for(P0=0;P0<32;P0++)M0[l0+P0]+=W0[l0]*X0[P0];return T8(g.subarray(32),M0),g0}function K8(g,l){var h=G(),r=G(),X0=G(),W0=G(),_0=G(),l0=G(),P0=G();if(T0(g[2],W),H0(g[1],l),Y0(X0,g[1]),w0(W0,X0,U),R0(X0,X0,g[2]),S0(W0,g[2],W0),Y0(_0,W0),Y0(l0,_0),w0(P0,l0,_0),w0(h,P0,X0),w0(h,h,W0),k0(h,h),w0(h,h,X0),w0(h,h,W0),w0(h,h,W0),w0(g[0],h,W0),Y0(r,g[0]),w0(r,r,W0),x0(r,X0))w0(g[0],g[0],N);if(Y0(r,g[0]),w0(r,r,W0),x0(r,X0))return-1;if(i0(g[0])===l[31]>>7)R0(g[0],J,g[0]);return w0(g[3],g[0],g[1]),0}function EG(g,l,h,r){var X0,W0=new Uint8Array(32),_0=new Uint8Array(64),l0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(h<64)return-1;if(K8(P0,r))return-1;for(X0=0;X0<h;X0++)g[X0]=l[X0];for(X0=0;X0<32;X0++)g[X0+32]=r[X0];if(P8(_0,g,h),s8(_0),$9(l0,P0,_0),L9(P0,l.subarray(32)),I6(l0,P0),A5(W0,l0),h-=64,A(l,0,W0,0)){for(X0=0;X0<h;X0++)g[X0]=0;return-1}for(X0=0;X0<h;X0++)g[X0]=l[X0+64];return h}var R$=32,c6=24,t6=32,i8=16,$5=32,C=32,u=32,c=32,I=32,p=c6,y0=t6,d0=i8,Q1=64,w1=32,_1=64,V1=32,Z8=64;$.lowlevel={crypto_core_hsalsa20:q,crypto_stream_xor:e,crypto_stream:v,crypto_stream_salsa20_xor:t,crypto_stream_salsa20:f,crypto_onetimeauth:O0,crypto_onetimeauth_verify:K0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:J0,crypto_secretbox_open:s,crypto_scalarmult:i,crypto_scalarmult_base:$0,crypto_box_beforenm:I0,crypto_box_afternm:d,crypto_box:V0,crypto_box_open:v0,crypto_box_keypair:p0,crypto_hash:P8,crypto_sign:b$,crypto_sign_keypair:b1,crypto_sign_open:EG,crypto_secretbox_KEYBYTES:R$,crypto_secretbox_NONCEBYTES:c6,crypto_secretbox_ZEROBYTES:t6,crypto_secretbox_BOXZEROBYTES:i8,crypto_scalarmult_BYTES:$5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:u,crypto_box_SECRETKEYBYTES:c,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:p,crypto_box_ZEROBYTES:y0,crypto_box_BOXZEROBYTES:d0,crypto_sign_BYTES:Q1,crypto_sign_PUBLICKEYBYTES:w1,crypto_sign_SECRETKEYBYTES:_1,crypto_sign_SEEDBYTES:V1,crypto_hash_BYTES:Z8,gf:G,D:U,L:A8,pack25519:m0,unpack25519:H0,M:w0,A:S0,S:Y0,Z:R0,pow2523:k0,add:I6,set25519:T0,modL:T8,scalarmult:$9,scalarbase:L9};function h1(g,l){if(g.length!==R$)throw Error("bad key size");if(l.length!==c6)throw Error("bad nonce size")}function D$(g,l){if(g.length!==u)throw Error("bad public key size");if(l.length!==c)throw Error("bad secret key size")}function G$(){for(var g=0;g<arguments.length;g++)if(!(arguments[g]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function f$(g){for(var l=0;l<g.length;l++)g[l]=0}$.randomBytes=function(g){var l=new Uint8Array(g);return X(l,g),l},$.secretbox=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(t6+g.length),X0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+t6]=g[W0];return J0(X0,r,r.length,l,h),X0.subarray(i8)},$.secretbox.open=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(i8+g.length),X0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+i8]=g[W0];if(r.length<32)return null;if(s(X0,r,r.length,l,h)!==0)return null;return X0.subarray(t6)},$.secretbox.keyLength=R$,$.secretbox.nonceLength=c6,$.secretbox.overheadLength=i8,$.scalarMult=function(g,l){if(G$(g,l),g.length!==C)throw Error("bad n size");if(l.length!==$5)throw Error("bad p size");var h=new Uint8Array($5);return i(h,g,l),h},$.scalarMult.base=function(g){if(G$(g),g.length!==C)throw Error("bad n size");var l=new Uint8Array($5);return $0(l,g),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=$5,$.box=function(g,l,h,r){var X0=$.box.before(h,r);return $.secretbox(g,l,X0)},$.box.before=function(g,l){G$(g,l),D$(g,l);var h=new Uint8Array(I);return I0(h,g,l),h},$.box.after=$.secretbox,$.box.open=function(g,l,h,r){var X0=$.box.before(h,r);return $.secretbox.open(g,l,X0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var g=new Uint8Array(u),l=new Uint8Array(c);return p0(g,l),{publicKey:g,secretKey:l}},$.box.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==c)throw Error("bad secret key size");var l=new Uint8Array(u);return $0(l,g),{publicKey:l,secretKey:new Uint8Array(g)}},$.box.publicKeyLength=u,$.box.secretKeyLength=c,$.box.sharedKeyLength=I,$.box.nonceLength=p,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(g,l){if(G$(g,l),l.length!==_1)throw Error("bad secret key size");var h=new Uint8Array(Q1+g.length);return b$(h,g,g.length,l),h},$.sign.open=function(g,l){if(G$(g,l),l.length!==w1)throw Error("bad public key size");var h=new Uint8Array(g.length),r=EG(h,g,g.length,l);if(r<0)return null;var X0=new Uint8Array(r);for(var W0=0;W0<X0.length;W0++)X0[W0]=h[W0];return X0},$.sign.detached=function(g,l){var h=$.sign(g,l),r=new Uint8Array(Q1);for(var X0=0;X0<r.length;X0++)r[X0]=h[X0];return r},$.sign.detached.verify=function(g,l,h){if(G$(g,l,h),l.length!==Q1)throw Error("bad signature size");if(h.length!==w1)throw Error("bad public key size");var r=new Uint8Array(Q1+g.length),X0=new Uint8Array(Q1+g.length),W0;for(W0=0;W0<Q1;W0++)r[W0]=l[W0];for(W0=0;W0<g.length;W0++)r[W0+Q1]=g[W0];return EG(X0,r,r.length,h)>=0},$.sign.keyPair=function(){var g=new Uint8Array(w1),l=new Uint8Array(_1);return b1(g,l),{publicKey:g,secretKey:l}},$.sign.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==_1)throw Error("bad secret key size");var l=new Uint8Array(w1);for(var h=0;h<l.length;h++)l[h]=g[32+h];return{publicKey:l,secretKey:new Uint8Array(g)}},$.sign.keyPair.fromSeed=function(g){if(G$(g),g.length!==V1)throw Error("bad seed size");var l=new Uint8Array(w1),h=new Uint8Array(_1);for(var r=0;r<32;r++)h[r]=g[r];return b1(l,h,!0),{publicKey:l,secretKey:h}},$.sign.publicKeyLength=w1,$.sign.secretKeyLength=_1,$.sign.seedLength=V1,$.sign.signatureLength=Q1,$.hash=function(g){G$(g);var l=new Uint8Array(Z8);return P8(l,g,g.length),l},$.hash.hashLength=Z8,$.verify=function(g,l){if(G$(g,l),g.length===0||l.length===0)return!1;if(g.length!==l.length)return!1;return j(g,0,l,0,g.length)===0?!0:!1},$.setPRNG=function(g){X=g},function(){var g=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(g&&g.getRandomValues){var l=65536;$.setPRNG(function(h,r){var X0,W0=new Uint8Array(r);for(X0=0;X0<r;X0+=l)g.getRandomValues(W0.subarray(X0,X0+Math.min(r-X0,l)));for(X0=0;X0<r;X0++)h[X0]=W0[X0];f$(W0)})}else if(g=u0("crypto"),g&&g.randomBytes)$.setPRNG(function(h,r){var X0,W0=g.randomBytes(r);for(X0=0;X0<r;X0++)h[X0]=W0[X0];f$(W0)})}()})(typeof ly<"u"&&Fs9?Fs9:globalThis.nacl=globalThis.nacl||{});hV=typeof ly<"u"&&Fs9?Fs9:globalThis.nacl,Ge6={fromSeed:hV.sign.keyPair.fromSeed,sign:hV.sign.detached,verify:hV.sign.detached.verify,randomBytes:hV.randomBytes,scalarBaseMultiply:hV.scalarMult.base,seal:hV.box,open:hV.box.open};Ye6=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);h$=class h$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(g$||(g$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(a8||(a8={}));cV=[120,107,118,49];Xe6(Ge6);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(O3||(O3={}))});function J11($){try{$?.clear?.()}catch{}}async function xM$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=bM$($),W=Y11(J.sub),K=Q11(new TextEncoder().encode(Z)),U=kM$();try{let w=await CM$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:O3.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(_M$(w,U))}finally{J11(U),J11(K),J11(W)}}var vM$=O(()=>{fM$()});function Oe6($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function yM$(){let $=new y1;return $.post("/links/session",async(Z)=>{let X=Z.get("meshContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=L1();if(!Y.natsTunnelPublicEnabled)return Z.json(W11(),503);if(!Y.natsPublicUrl)return Z.json(W11(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(W11(),503)}let Q=B3(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await xM$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:TM$(Q),userId:X,allowedConnectionTypes:Oe6(Y.natsPublicUrl)})}return Z.json(IM$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var W11=()=>({error:"link session unavailable"});var gM$=O(()=>{d6();q8();RM$();vM$()});async function Le6($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function ze6($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new YN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function je6($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},Ee6),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=Gn(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function Pe6($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<hM$){await m4(cM$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<hM$){await m4(cM$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var Ee6=90000,De6=15000,uM$=()=>{let $=new y1;return $.get("/",async(Z)=>{let G=Z.var.meshContext;try{b0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=l1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=E0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=gU({orgId:Y.id,virtualMcpId:Q,branch:J}),U=Hy({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let D=await Z3(G,{userId:X,branch:J,virtualMcpMetadata:w});F=D.provider,H=D.kind}catch(D){N=D instanceof Error?D:Error(String(D)),F=null}let B=H&&uU(e9(w),X,J,H),E=!!B&&B.sandboxHandle===U;if(!F)return _Q(Z,async(D)=>{await D.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this mesh."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),_Q(Z,async(D)=>{let L=new AbortController,z=setInterval(()=>{D.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},De6);D.onAbort(()=>{L.abort(),clearInterval(z)});try{if(E&&H){if(await Le6(F,U)){await ze6({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await D.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await je6({stream:D,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await Pe6({stream:D,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},hM$=60000,cM$=500;var dM$=O(()=>{d6();gV();EY();f7();wE0();Xn();Wv();c50();LQ()});function Te6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function Ie6($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(Ae6)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var Ae6=1e4,Re6=async($,Z)=>{if(!$.get("meshContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},lM$=()=>{let $=new y1;return $.use("*",Re6),$.get("/",async(Z)=>{let G=L1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await Ie6(X,Y);return Z.json({apps:Te6(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var mM$=O(()=>{d6();q8()});import{z as f1}from"zod";function QK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function xe6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function ve6($,Z,G){try{return JSON.parse($)}catch{throw new pM$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function ye6($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:ve6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function ge6($){let Z=$.map((G)=>{let X=G.function.parameters?QY(G.function.parameters):QY({type:"object",properties:{}});return[G.function.name,s$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function he6($){if(!$)return;return{openai:{response_format:$}}}function ce6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function iM$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function nM$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var qe6=256,Me6,ke6,Se6,Ve6,Ce6,be6,_e6,fe6,pM$,tM$,rM$;var oM$=O(()=>{f6();d6();gV();Me6=f1.object({type:f1.literal("function"),function:f1.object({name:f1.string(),description:f1.string().optional(),parameters:f1.record(f1.string(),f1.unknown()).optional()})}),ke6=f1.object({id:f1.string(),type:f1.literal("function"),function:f1.object({name:f1.string(),arguments:f1.string()})}),Se6=f1.discriminatedUnion("role",[f1.object({role:f1.literal("system"),content:f1.string(),name:f1.string().optional()}),f1.object({role:f1.literal("user"),content:f1.union([f1.string(),f1.array(f1.union([f1.object({type:f1.literal("text"),text:f1.string()}),f1.object({type:f1.literal("image_url"),image_url:f1.object({url:f1.string(),detail:f1.string().optional()})})]))]),name:f1.string().optional()}),f1.object({role:f1.literal("assistant"),content:f1.string().nullable().optional(),name:f1.string().optional(),tool_calls:f1.array(ke6).optional()}),f1.object({role:f1.literal("tool"),content:f1.string(),tool_call_id:f1.string()})]),Ve6=f1.object({type:f1.literal("text")}),Ce6=f1.object({type:f1.literal("json_object")}),be6=f1.object({type:f1.literal("json_schema"),json_schema:f1.object({name:f1.string(),description:f1.string().optional(),schema:f1.record(f1.string(),f1.unknown()),strict:f1.boolean().optional()})}),_e6=f1.union([Ve6,Ce6,be6]),fe6=f1.object({model:f1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:f1.array(Se6),stream:f1.boolean().optional().default(!1),temperature:f1.number().min(0).max(2).optional(),max_tokens:f1.number().positive().optional(),top_p:f1.number().min(0).max(1).optional(),frequency_penalty:f1.number().min(-2).max(2).optional(),presence_penalty:f1.number().min(-2).max(2).optional(),stop:f1.union([f1.string(),f1.array(f1.string())]).optional(),tools:f1.array(Me6).optional(),tool_choice:f1.union([f1.literal("auto"),f1.literal("none"),f1.literal("required"),f1.object({type:f1.literal("function"),function:f1.object({name:f1.string()})})]).optional(),response_format:_e6.optional(),user:f1.string().optional()});pM$=class pM$ extends Error{constructor($){super($);this.name="MessageConversionError"}};tM$=new y1;tM$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("meshContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(QK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(QK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(QK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=fe6.safeParse(X);if(!Y.success){let D=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(QK(`Invalid request: ${D.message}`,"invalid_request_error",D.path.length>0?D.path.join("."):null),400)}let Q=Y.data,J=xe6(Q.model);if(!J)return $.json(QK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let D=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(D.length===0)return $.json(QK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=D[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(QK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=ye6(Q.messages),H=Q.tools?ge6(Q.tools):void 0,N=he6(Q.response_format),B=ce6(),E=Math.floor(Date.now()/1000);if(Q.stream)return _Q($,async(D)=>{let L=iM$(w,F,H,Q,N,$.req.raw.signal);try{let z=EQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=qe6)await M()}else if(S.type==="tool-call"){await M();let q=P++;await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{},finish_reason:nM$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await D.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await D.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let D=iM$(w,F,H,Q,N,$.req.raw.signal),L=await aH(D),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:E,model:Q.model,choices:[{index:0,message:z,finish_reason:nM$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(QK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(QK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(QK(Y.message,"server_error"),500)}});rM$=tM$});function de6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??ue6}}var aM$,ue6="https://ph.studio.decocms.com",sM$;var eM$=O(()=>{d6();_b0();jN();m7();q8();Ds0();aM$=new y1;aM$.get("/",($)=>{let Z={theme:MC1(),...IO().logo&&{logo:IO().logo},...PQ()&&{internalUrl:Je()},...L1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!L1().firecrawlApiKey,auth:fP$(),posthog:de6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!PQ()&&L1().sandboxProviderKind==="agent-sandbox"}};return $.json({success:!0,config:Z})});sM$=aM$});function $k$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals")}var Zk$,le6,me6,Gk$;var Xk$=O(()=>{d6();DJ();Nv();eb();Zk$=new y1,le6=["range","if-none-match","if-modified-since"],me6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Zk$.get("/:org/files/*",async($)=>{let Z=$.get("meshContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(Ay($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new z$(401,{message:"Authentication required"})}if(!G)throw new z$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new z$(400,{message:"Missing file key"});let Y=await Un(X,Z);if(!Y)throw new z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&EJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new z$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return $k$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of le6){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of me6){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),$k$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Gk$=Zk$});var Nt=b((dV)=>{var ie6=dV&&dV.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),ne6=dV&&dV.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))ie6(Z,$,G)};Object.defineProperty(dV,"__esModule",{value:!0});ne6(hX(),dV)});var Jk$=b((Yk$)=>{Object.defineProperty(Yk$,"__esModule",{value:!0});Yk$.version=void 0;Yk$.version="3.4.0"});var Uk$=b((JK)=>{var pe6=JK&&JK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(JK,"__esModule",{value:!0});JK.NodeTransport=JK.VERSION=void 0;JK.nodeResolveHost=ee6;var d4=Nt(),te6=u0("net"),K11=u0("tls"),re6=u0("path"),Wk$=u0("fs"),oe6=pe6(u0("dns")),ae6=Jk$();JK.VERSION=ae6.version;var se6="nats.js";class Kk${socket;version;lang;yields=[];signal=(0,d4.deferred)();closedNotification=(0,d4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=se6,this.version=JK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,d4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw d4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new d4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new d4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,d4.deferred)(),G,X=(0,te6.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,d4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=d4.DataBuffer.concat(...this.yields),Y=(0,d4.extractProtocolMessage)(X);if(Y!=="")try{let Q=d4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,d4.deferred)();try{if($=(0,re6.resolve)($),!(0,Wk$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Wk$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,d4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,d4.deferred)();try{let Y=(0,K11.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,d4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,d4.deferred)();try{let X=(0,K11.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,d4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,d4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof K11.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,d4.render)($)}`);let Z=(0,d4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}JK.NodeTransport=Kk$;function ee6($){let Z=(0,d4.deferred)();return oe6.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Bk$=b((Nk$)=>{Object.defineProperty(Nk$,"__esModule",{value:!0});Nk$.connect=$04;var wk$=Uk$(),Fk$=Nt(),Hk$=Nt();function $04($={}){if((0,Hk$.hasWsProtocol)($))return Promise.reject(Hk$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Fk$.setTransportFactory)({factory:()=>{return new wk$.NodeTransport},dnsResolveFn:wk$.nodeResolveHost}),Fk$.NatsConnectionImpl.connect($)}});var Ok$=b((zw)=>{var G04=zw&&zw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),X04=zw&&zw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))G04(Z,$,G)};Object.defineProperty(zw,"__esModule",{value:!0});zw.connect=void 0;var Y04=Bk$();Object.defineProperty(zw,"connect",{enumerable:!0,get:function(){return Y04.connect}});X04(Nt(),zw)});function zk$($){let Z=$?.connectFn??K04,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:W04,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let E=_X(J04,Q04,B-1,2,0.5);await m4(E)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?Ek$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=Lk$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function K04($){return Dk$.connect($)}var Ek$,Dk$,Lk$,Q04=100,J04=3000,W04=3000;var jk$=O(()=>{f7();Ek$=k(Eg(),1),Dk$=k(Ok$(),1),Lk$=k(OB(),1)});function my($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function U11($,Z){return`${$}.${Z}`}class w11{cache;constructor($){this.cache=my({ttlMs:$?.ttlMs??U04,maxSize:$?.maxSize??w04})}async get($,Z){return this.cache.get(U11($,Z))??null}async set($,Z,G){this.cache.set(U11($,Z),G)}async invalidate($,Z){this.cache.delete(U11($,Z))}teardown(){this.cache.clear()}}var U04=600000,w04=5000;var Pk$=()=>{};function AD0($,Z){return`${$}:${Z}`}function F11($){let Z=my({ttlMs:$?.ttlMs??F04,maxSize:$?.maxSize??H04}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(Ak$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(AD0(K,U))},set(K,U,w){Z.set(AD0(K,U),w)},invalidate(K,U){Z.delete(AD0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(Ak$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(AD0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Ak$="studio.ai-provider-keys.invalidate",F04=30000,H04=5000;var Tk$=()=>{};class H11{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var Ik$=($)=>{let Z;return()=>Z??=$()},N11,B11;var Rk$=O(()=>{I5();N11=Ik$(()=>y8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),B11=Ik$(()=>y8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function z04(){return{name:fU,subjects:[`${nd0}.>`],storage:E3.StorageType.File,max_age:O04,max_bytes:D04,max_msgs_per_subject:L04,discard:E3.DiscardPolicy.Old,retention:E3.RetentionPolicy.Limits,duplicate_window:E04,num_replicas:1}}class kk${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function qk$($){let Z=Mk$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function T04($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,B04().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class O11{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await E3.jetstreamManager($),G=z04();try{await Z.streams.info(fU),await Z.streams.update(fU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(fU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y){console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`);return}let Q=T04(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=E8$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=td0(U,{runId:Z}),H=performance.now()-w;if(N11().record(H),B11().add(1,{"org.id":X??"unknown"}),A04?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?qk$(N.headers):void 0)};(async()=>{let U=$.getReader(),w=0,F=0;try{while(!0){let{done:H,value:N}=await U.read();if(H)break;if(K(N),F++,++w>=64)w=0,await new Promise((B)=>setImmediate(B))}}catch(H){console.warn(`[Decopilot] stream pump error for thread ${Z}:`,H?.message??H)}finally{if(U.releaseLock(),W(),P04)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=td0(Z,{runId:$,dedup:G});if(N11().record(performance.now()-Y),B11().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:qk$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=O8$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?E3.DeliverPolicy.New:E3.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=eH($),W;try{W=await(await X.consumers.get(fU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(E){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",E?.message??E),null}let w=N50({messages:async function*(){try{for await(let E of W)yield{subject:E.subject,data:E.data,headers:E.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(F50()).pipeThrough(H50()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(E){for(;;){let{done:D,value:L}=await w.read();if(D){B(),E.close();return}let z=L;if(z.kind==="done"){if(Q){B(),E.close();return}continue}E.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(fU,{filter:eH($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var E3,Mk$,N04=($)=>{let Z;return()=>Z??=$()},B04,O04=86400000000000,E04=120000000000,D04=4294967296,L04=500000,j04,P04,A04;var Sk$=O(()=>{od0();ad0();rd0();I5();Rk$();E3=k(OB(),1),Mk$=k(Eg(),1),B04=N04(()=>y8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));j04=process.env.STREAM_ENCODE_TRACE==="1",P04=process.env.DECOPILOT_STREAM_TRACE==="1";A04=j04?new kk$:null});import{z as $8}from"zod";var Vk$,Ck$,WK,E11,bk$,_k$,fk$,xk$,I04,vk$,yk$,gk$,hk$,ck$,R04,uk$,je9,q04,M04=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},dk$=($)=>{return new TextEncoder().encode(JSON.stringify($))},lk$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?q04[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${M04(Y.error)}`);return Y.data};var mk$=O(()=>{Vk$=$8.string().regex(/^[A-Za-z0-9_-]*$/u),Ck$=$8.array($8.tuple([$8.string(),$8.string()])),WK=$8.string().regex(/^[A-Za-z0-9_-]+$/u),E11=$8.string().min(1),bk$=$8.object({type:$8.literal("request.start"),protocol:$8.literal("tunnel.v1"),requestId:WK,method:$8.string().min(1),url:$8.string().min(1),headers:Ck$,replySubject:E11,bodySubject:E11.optional(),abortSubject:E11,deadlineUnixMs:$8.number().int().nonnegative().optional()}),_k$=$8.object({type:$8.literal("request.chunk"),requestId:WK,seq:$8.number().int().nonnegative(),data:Vk$}),fk$=$8.object({type:$8.literal("request.end"),requestId:WK,seq:$8.number().int().nonnegative()}),xk$=$8.object({type:$8.literal("request.error"),requestId:WK,code:$8.string().min(1),message:$8.string()}),I04=$8.union([_k$,fk$,xk$]),vk$=$8.object({type:$8.literal("response.ack"),requestId:WK}),yk$=$8.object({type:$8.literal("response.start"),requestId:WK,status:$8.number().int().min(100).max(599),statusText:$8.string().optional(),headers:Ck$}),gk$=$8.object({type:$8.literal("response.chunk"),requestId:WK,seq:$8.number().int().nonnegative(),data:Vk$}),hk$=$8.object({type:$8.literal("response.end"),requestId:WK,seq:$8.number().int().nonnegative()}),ck$=$8.object({type:$8.literal("response.error"),requestId:WK,code:$8.string().min(1),message:$8.string()}),R04=$8.union([vk$,yk$,gk$,hk$,ck$]),uk$=$8.object({type:$8.literal("abort"),requestId:WK,reason:$8.string().optional()}),je9=$8.union([bk$,I04,R04,uk$]),q04={"request.start":bk$,"request.chunk":_k$,"request.end":fk$,"request.error":xk$,"response.ack":vk$,"response.start":yk$,"response.chunk":gk$,"response.end":hk$,"response.error":ck$,abort:uk$}});var k04=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},S04=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},V04=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},C04=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},ik$=($)=>{return k04(btoa(V04($)))},nk$=($)=>{return C04(atob(S04($)))},b04;var pk$=O(()=>{b04=class b04{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*d04($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class o04{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var _04=30000,f04=1000,x04=65536,xQ,v04=($)=>{return"connection"in $},y04=($)=>{let Z=v04($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??_04,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??f04,maxChunkBytes:Z.maxChunkBytes??x04,diagnostics:Z.diagnostics}},tk$=($)=>{return Array.from($.entries())},g04=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},h04=($,Z,G)=>{if(g04(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return tk$(G.headers);return tk$(G.headers)},rk$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},c04=()=>{return crypto.randomUUID().replaceAll("-","")},u04=($)=>{try{$?.unsubscribe()}catch{}},l04=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},m04=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},aN=($,Z,G)=>{$.publish(Z,dk$(G))},i04=($)=>{return $.type.startsWith("response.")},D11=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},n04=($)=>{if($==="idle")return new xQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new xQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},ok$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(n04(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=lk$(W.value.data);if(!i04(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},p04=async($)=>{let Z=!1;while(!0){let G=await ok$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new xQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new xQ(G.value.code,G.value.message);throw new xQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},t04=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){aN($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of d04(J,$.maxChunkBytes)){if(X)return;aN($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:ik$(W)}),G++}}}catch(Q){if(X)return;aN($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},r04=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await ok$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new xQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(nk$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new xQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){aN($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},sN=($)=>{let Z=y04($);return l04(Z.maxChunkBytes),async(G,X)=>{let Y=PM$(G),Q=new Request(G,X),J=c04(),W=AM$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,E=!1,D=(P=new xQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,u04(F),Q.body&&!E)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new xQ("tunnel_aborted",D11(Q.signal));aN(Z.connection,W.abort,{type:"abort",requestId:J,reason:D11(Q.signal)}),K.abort(P),D(P)};if(Q.signal.aborted)throw new xQ("tunnel_aborted",D11(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new xQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);aN(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),D(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:h04(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};aN(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!E)aN(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(E)return;E=!0,(Q.body?t04({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await p04({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(m04(Q.method,P.status))return D(),new Response(null,{status:P.status,statusText:P.statusText,headers:rk$(P.headers)});return new Response(r04({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:D}),{status:P.status,statusText:P.statusText,headers:rk$(P.headers)})}catch(P){throw D(P instanceof Error?P:Error(String(P))),P}}};var ak$=O(()=>{mk$();pk$();LD0();xQ=class xQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var TD0=O(()=>{ak$()});function sk$($){let Z=$.createFetch??a04,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return L11;let Q=B3(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return L11;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return L11}}}var L11,a04=($,Z)=>sN({connection:$,firstFrameTimeoutMs:Z});var ek$=O(()=>{TD0();Ft();L11={online:!1,capabilities:[]}});async function*s04($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function $S$($){let Z=$.createFetch??((G)=>sN({connection:G,idleTimeoutMs:e04}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=B3(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*s04(w)}}var e04=45000;var ZS$=O(()=>{TD0();Ft()});import{z as D3}from"zod";function GS$($){return JSON.stringify($)}var re9;var XS$=O(()=>{re9=D3.discriminatedUnion("type",[D3.object({type:D3.literal("cancel"),runId:D3.string()}),D3.object({type:D3.literal("cancel_req"),reqId:D3.string()}),D3.object({type:D3.literal("keep_alive")}),D3.object({type:D3.literal("shutdown")})])});function YS$($){let Z=$.createFetch??((G)=>sN({connection:G,idleTimeoutMs:$14}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=B3(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function QS$($){let Z=$.createFetch??sN;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=B3(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:GS$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var $14=45000;var JS$=O(()=>{TD0();XS$();Ft()});function WS$($,Z){switch($.type){case"START":{let G={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(Z?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:Z.orgId},G];return[G]}case"STEP_DONE":{if(Z?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:Z.status.stepCount+1}]}case"FINISH":{if(Z==null||Z.status.tag!=="running")return[];let{stepCount:G}=Z.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"error"}]}case"CANCEL":{if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"cancelled"}]}case"RESUME":{if(Z?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z?.orgId??$.orgId,reason:$.reason}];if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:$.reason}]}}}function KS$($,Z,G=new Date){switch(Z.type){case"RUN_STARTED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"RUN_RESUMED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:Z.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function US$($,Z,G,X){let{storage:Y,sseHub:Q}=X,J=await Y.get($,Z);Q.emit(Z,OJ($,G,{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit(Z,ic($,G))}async function Z14($,Z){let{storage:G,streamBuffer:X,sseHub:Y}=Z;switch($.type){case"RUN_STARTED":{await G.update($.taskId,$.orgId,{status:"in_progress",run_config:$.runConfig??null,run_started_at:new Date().toISOString(),last_progress_at:null});let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"in_progress",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at}));return}case"RUN_RESUMED":{await G.update($.taskId,$.orgId,{run_started_at:new Date().toISOString()});let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"in_progress",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at}));return}case"STEP_COMPLETED":Y.emit($.orgId,p00($.taskId,$.stepCount));return;case"RUN_COMPLETED":await US$($.taskId,$.orgId,"completed",Z);return;case"RUN_REQUIRES_ACTION":await US$($.taskId,$.orgId,"requires_action",Z);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await G.forceFailIfInProgress($.taskId,$.orgId))return;await G.update($.taskId,$.orgId,{run_config:null,run_started_at:null})}else await G.update($.taskId,$.orgId,{status:"failed",run_config:null,run_started_at:null});X.purge($.taskId);let Q=await G.get($.taskId,$.orgId);Y.emit($.orgId,OJ($.taskId,"failed",{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at})),Y.emit($.orgId,ic($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function wS$($,Z){for(let{event:G}of $)await Z14(G,Z)}var FS$=O(()=>{$6()});function HS$($){return $.now-$.lastProgressAt>$.idleTimeoutMs}function NS$($){return Math.max($.persistedLastProgressAt??Number.NEGATIVE_INFINITY,$.currentRunStartedAt)}class z11{deps;clock;states=new Map;reaperTimer=null;constructor($,Z=()=>new Date){this.deps=$;this.clock=Z;this.reaperTimer=setInterval(()=>{this.reapStaleRuns().catch((G)=>{console.error("[RunRegistry] Reaper sweep failed",G)})},G14)}async execute($){let Z=this.dispatch($);return await this.react(Z),Z}dispatch($){let Z=this.states.get($.taskId),G=WS$($,Z),X=[];for(let Y of G){let Q=this.states.get(Y.taskId);if(Y.type==="PREVIOUS_RUN_ABORTED"||Y.type==="RUN_FAILED"){if(Q?.status.tag==="running")Q.status.abortController.abort()}let J=KS$(Q,Y,this.clock());if(J===void 0)this.states.delete(Y.taskId);else this.states.set(Y.taskId,J);if(X.push({event:Y,state:J}),X14.has(Y.type))OS$().add(1,{"org.id":Y.orgId});else if(Y14.has(Y.type)&&Q?.status.tag==="running")OS$().add(-1,{"org.id":Y.orgId})}return X}react($){return wS$($,this.deps)}getAbortSignal($){let Z=this.states.get($);if(Z?.status.tag==="running")return Z.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}async reapStaleRuns(){let $=this.clock().getTime(),Z=[...this.states].filter(([,G])=>G.status.tag==="running");for(let[G,X]of Z){if(this.states.get(G)?.status.tag!=="running")continue;let Q;try{let W=await this.deps.storage.getProgress(G,X.orgId);Q=NS$({persistedLastProgressAt:W?.lastProgressAt??null,currentRunStartedAt:X.status.startedAt.getTime()})}catch(W){console.warn(`[RunRegistry] Reaper progress read failed for ${G}; skipping`,W);continue}if(!HS$({lastProgressAt:Q,now:$,idleTimeoutMs:BS$}))continue;let J=await this.deps.storage.get(G,X.orgId).catch(()=>null);if(J&&J.status!=="in_progress"){let W=this.states.get(G);if(W?.status.tag==="running")W.status.abortController.abort();this.states.delete(G);continue}console.warn(`[RunRegistry] Reaping stuck run for thread ${G} (idle > ${BS$/60000}m) ...`),Q14().add(1,{"org.id":X.orgId,reason:"idle_timeout"}),await this.execute({type:"FORCE_FAIL",taskId:G,reason:"reaped"}).catch((W)=>{console.error("[RunRegistry] Reaper execute failed",W)})}}}var G14=300000,BS$=600000,X14,Y14,ES$=($)=>{let Z;return()=>Z??=$()},OS$,Q14;var DS$=O(()=>{FS$();I5();X14=new Set(["RUN_STARTED","RUN_RESUMED"]),Y14=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),OS$=ES$(()=>y8.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})),Q14=ES$(()=>y8.createCounter("decopilot.run.reaped",{description:"Number of decopilot runs force-failed by the progress-based reaper",unit:"{runs}"}))});function ID0($,Z,G,X){if(!X)return!1;return $.emit(Z,OJ(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var LS$=O(()=>{$6()});class j11{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as J14,rm as RD0}from"fs/promises";import{join as qD0}from"path";async function MD0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-W14),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await lV($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await zS$($,Y,Z);else if(!Y.startsWith(".")){let Q=qD0($,Y),J=await lV(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await zS$(Q,K,Z)}if((await lV(Q)).length===0)await RD0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function zS$($,Z,G){let X=0,Y=qD0($,Z),Q=await lV(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=qD0(Y,W),U=await lV(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=qD0(K,F);await RD0(N,{recursive:!0,force:!0}),X++}}if((await lV(K)).length===0)await RD0(K,{recursive:!0,force:!0})}if((await lV(Y)).length===0)await RD0(Y,{recursive:!0,force:!0});return X}async function lV($){try{return(await J14($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var W14=30;var P11=()=>{};import{DBOS as A11,SchedulerMode as K14}from"@dbos-inc/dbos-sdk";async function w14(){let $=[yQ(),iV(),wK()],Z=0;for(let G of $)try{Z+=await MD0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function F14($,Z){await A11.runStep(()=>w14(),{name:"monitoringRetention"})}function PS$(){if(jS$)return;jS$=!0;let $=A11.registerWorkflow(F14,{name:"monitoringRetentionWorkflow"});A11.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:U14,mode:K14.ExactlyOncePerIntervalWhenActive})}var U14="23 4 * * *",jS$=!1;var AS$=O(()=>{fX();P11()});function TS$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await vH.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Xc0($.db,Z,X.role);return Y.boundAuth=Gc0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new wE(G,void 0,Y.boundAuth,X.role,"self"),e60(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var IS$=O(()=>{FE();gm()});function H14(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function B14(){for(let $ of N14)$()}function RS$($){let Z=[...T11.logs,$];T11={...T11,logs:Z.length>500?Z.slice(-500):Z},B14()}function I11(){return O14}var T11,N14,O14=!1;var R11=O(()=>{T11=H14(),N14=new Set});import{EventEmitter as E14}from"events";var q11;var qS$=O(()=>{R11();q11=new E14;q11.on("request",($)=>{RS$($)})});function MS$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=iy(H.params.name),B=H.params.arguments||{},E=Object.keys(B).map((L)=>iy(L)),D=E.length>0?E.slice(0,3).join(",")+(E.length>3?"\u2026":""):"";Q=`${s4.tool}${N}${s4.dim}(${D})${s4.reset}`}else if(H.method)Q=`${s4.dim}${iy(H.method)}${s4.reset}`}}catch{}}let W=iy(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${s4.mcp}${iy(w.slice(0,12))}\u2026${s4.reset}`}else if(Y==="/mcp")W=`${s4.mcp}/mcp${s4.reset}`;else if(Y==="/mcp/registry")W=`${s4.mcp}/mcp/registry${s4.reset}`;let K=L14(X),U=J?"\u25C0":"\u2190";if(!I11())console.log(`${s4.dim}${U}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=D14(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!I11())console.log(`${s4.dim}${B}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${s4.reset} ${s4.duration}${N}${s4.reset}`);q11.emit("request",{method:X,path:iy(Y),status:F,duration:w,timestamp:new Date})}}}var s4,D14=($)=>{if($>=500)return s4.serverError;if($>=400)return s4.clientError;if($>=300)return s4.redirect;return s4.ok},L14=($)=>{return s4[$]||s4.reset},iy=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var kS$=O(()=>{R11();qS$();s4={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as bS$}from"crypto";import{mkdir as z14,readdir as j14,rm as SS$,stat as _S$}from"fs/promises";import{join as k11,relative as P14}from"path";import{z as P$}from"zod";function xS$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return k11(A14,Z)}function vS$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function M11($,Z){let G=xS$($),X=vS$(Z);return k11(G,X)}function T14($,Z,G,X){let Y=L1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return bS$("sha256",Y).update(Q).digest("hex")}function CS$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=T14(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${vS$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function yS$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${bS$("md5","etag").update(X).digest("hex")}"`}async function gS$($,Z,G,X,Y){try{let Q=await j14($,{withFileTypes:!0});for(let J of Q){let W=k11($,J.name),U=P14(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await gS$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await _S$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:yS$(W,w.mtime,w.size)})}catch{}}}}catch{}}function hS$($,Z){let X=E0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=xS$(X);await z14(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await gS$(w,w,J,K,F),F.objects.sort((D,L)=>D.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((D)=>D.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,E=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:E,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=M11(X,Q.key),W=await _S$(J);return{contentType:Ie0(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:yS$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??VS$;return{url:CS$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??VS$;return{url:CS$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let Q=Y,J=M11(X,Q.key);try{return await SS$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=M11(X,K);try{await SS$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function S11($,Z,G){let X=hS$(Z,G),Y=new sK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:O5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new TY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),gW(Y,Q,$,"mcp:dev-assets")}async function cS$($,Z,G,X){let Q=hS$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var A14="./data/assets",VS$=3600,fS$,uS$;var dS$=O(()=>{q8();Nn();d6();pc();Ev();H7();gE0();fS$=new y1;fS$.all("/",async($)=>{let Z=$.get("meshContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return S11($.req.raw,Z,X)});uS$=fS$});var lS$={};e8(lS$,{mountDevRoutes:()=>I14});function I14($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return S11(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await cS$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",uS$);let G=new y1;G.use("*",bQ({mountPath:"/api/dev-assets"})),G.route("/",yE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var mS$=O(()=>{d6();De0();gE0();dS$()});var iS$=O(()=>{Rc0();qc0();iE()});var kD0=O(()=>{iS$()});var pS$={};e8(pS$,{streamAgent:()=>nS$,createDecopilotClient:()=>q14});async function R14($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (f6(),dd0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function nS$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (f6(),dd0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let E=JSON.parse(N);if(E?.error)B=E.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await R14(F.body);return Q({stream:H})}function q14($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return nS$(Y,X,W,Q,J)}}}import{z as bX}from"zod";function tS$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=M14.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:bX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:bX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var M14,X1Z,k14=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},C11=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},SD0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},S14=($,Z,G)=>{let X=SD0($,Z,G);return new Proxy(Tx.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},V14=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => pS$);return J(X,Z.token,$,Y,Q)}}},V11=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>V11(G,Z));if(typeof $==="object"){if(k14($))return V14($,Z);if(C11($))return S14($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=V11(Y,Z);return G}return $},rS$=($)=>{return V11($.state,$)};var ny=O(()=>{kD0();M14=new Map;X1Z=bX.object({id:bX.string(),title:bX.string(),capabilities:bX.object({vision:bX.boolean().optional(),text:bX.boolean().optional(),tools:bX.boolean().optional(),reasoning:bX.boolean().optional()}).passthrough().optional(),provider:bX.string().optional().nullable(),limits:bX.object({contextWindow:bX.number().optional(),maxOutputTokens:bX.number().optional()}).passthrough().optional()})});var C14,oS$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},b14=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=oS$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},aS$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=oS$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??C14;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},sS$=($,Z,G)=>{let X=new Headers($.headers);return b14(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var eS$=O(()=>{C14=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function $V$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function _14($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function ZV$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function GV$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function XV$($){return{handleProtectedResourceMetadata:(U)=>{let w=KK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=KK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=KK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),E=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let D=KK(new URL(`${w.origin}/oauth/callback`)),L=D.toString(),j=ZV$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:E??void 0,oauthCallbackUri:L});D.searchParams.set("state",j);let P=$.authorizationUrl(D.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=KK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?GV$(H):null;if(N){let E=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let D=KK(new URL(B.redirectUri));if(D.searchParams.set("error",N),D.searchParams.set("error_description",E),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}return Response.json({error:N,error_description:E},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let E=B.oauthCallbackUri??KK(new URL(`${w.origin}/oauth/callback`)).toString(),D={code:F,redirect_uri:E},L=await $.exchangeCode(D),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=ZV$(z),P=KK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(E){console.error("OAuth callback error:",E);let D=KK(new URL(B.redirectUri));if(D.searchParams.set("error","server_error"),D.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:E}=F;if(B==="refresh_token"){if(typeof E!=="string"||!E)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(E)}catch(P){if(P instanceof b11)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let D=GV$(H);if(!D||!D.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(D.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(D.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==D.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:D.accessToken,token_type:D.tokenType};if(D.refreshToken)L.refresh_token=D.refreshToken;if(D.expiresIn!==void 0)L.expires_in=D.expiresIn;if(D.scope)L.scope=D.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let E of w.redirect_uris)if(!_14(E))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${E}`},{status:400});let F=$V$(32),H=w.token_endpoint_auth_method!=="none"?$V$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${KK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var b11,KK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var _11=O(()=>{b11=class b11 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as f14}from"async_hooks";var YV$,Bt;var f11=O(()=>{YV$=new f14,Bt={getStore:()=>{return YV$.getStore()},run:($,Z,...G)=>YV$.run($,Z,...G)}});var JV$="SELF",CD0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},WV$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},QV$="::",KV$=($)=>{let Z=$.indexOf(QV$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+QV$.length);return[G,X]},x14=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},UV$=($)=>{if(CD0($))return[];return Object.keys($)},v14=($,Z)=>{if(CD0($))return $.events;let G=$[Z];if(!G)return[];if(WV$(G))return G.events;return Object.keys(G)},VD0=($,Z,G)=>{if($===JV$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!C11(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},y14=($,Z,G)=>{let X=Z;if(CD0($)){let Q=[];for(let J of $.events){let W=KV$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=VD0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of UV$($)){let J=VD0(Q,X,G);if(!J)continue;let W=v14($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},g14=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},h14=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},c14=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},u14=async($,Z,G,X,Y)=>{let Q=X;if(CD0($)){let w=new Set;for(let H of $.events){let N=KV$(H);if(!N)continue;let[B,E]=N,D=VD0(B,Q,Y);if(!D)continue;w.add(`${D}:${E}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of UV$($)){let F=VD0(w,Q,Y);if(F)J.set(F,w)}let W=g14(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(WV$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(D){let L={};for(let z of F)L[z.id]={success:!1,error:D instanceof Error?D.message:String(D)};return{results:L}}})());continue}let B=N,E=h14(F);for(let[D,L]of E){let z=B[D];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return c14(U)},wV$;var x11=O(()=>{ny();wV$={subscriptions:y14,execute:u14,parseCron:x14}});function d14($,Z){let G=SD0("self",{meshUrl:$,token:Z});return Tx.forConnection(G)}function l14($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function FV$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=d14($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(l14(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var v11=O(()=>{ny();kD0()});import{z as JZ}from"zod";function jw($){return{...$,execute:(Z)=>{let G=Ot(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var Ot=($)=>{let Z=Bt.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},HV$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},m14=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?tS$(JZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[jw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:JZ.object({state:Z??JZ.unknown(),scopes:JZ.array(JZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:JZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:JZ.object({baseUrl:JZ.string(),org:JZ.string(),subjectConnectionId:JZ.string(),token:JZ.string()}).optional()}),outputSchema:JZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=HV$(J);await Y(J.runtimeContext.env,{createAgent:FV$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[jw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:P40,outputSchema:A40,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=HV$(J);return wV$.execute($.handlers,J.context.events,W,K,U)}})]:[],jw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:JZ.object({}),outputSchema:JZ.object({stateSchema:JZ.unknown(),scopes:JZ.array(JZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},NV$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(E)=>{if(J(E))return[E];Q();let D=await E(B);if(Array.isArray(D))return D;return[D]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...m14({...$}));let E;if(typeof $.prompts==="function")Q(),E=await $.prompts(N);else E=await W($.prompts,N);let D;if(typeof $.resources==="function")Q(),D=await $.resources(N);else D=await W($.resources,N);let L={tools:B,prompts:E,resources:D};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let E of B.tools)N.registerTool(E.id,{_meta:E._meta,title:E.title,description:E.description,annotations:E.annotations,inputSchema:E.inputSchema&&"shape"in E.inputSchema?E.inputSchema:JZ.object({}),outputSchema:E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0},async(D)=>{let L=Ot(),z=await E.execute({context:D,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let E of B.prompts)N.registerPrompt(E.name,{title:E.title,description:E.description,argsSchema:E.argsSchema?E.argsSchema:JZ.object({}).shape},async(D)=>{let L=Ot();return await E.execute({args:D,runtimeContext:L},L)});for(let E of B.resources)N.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType},async(D)=>{let L=Ot(),z=await E.read({uri:D,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...E}=$.serverInfo??{},D=new sK({...E,name:E.name??"@deco/mcp-api",version:E.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:O5,...B&&{instructions:B}}),L=await K(N);U(D,L);let z="tools/list",j=D.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:D,...L}};return{fetch:async(N,B)=>{let{server:E}=await w(B),D=new TY;await E.connect(D);let L=()=>{try{D.close?.()}catch{}try{E.close?.()}catch{}};try{let z=await D.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let E=Bt.getStore();if(!E)throw Error("Missing state, did you forget to call State.bind?");let D=E?.env,{tools:L}=await K(D),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=Ot();return j({context:B,runtimeContext:P},P)}}};var bD0=O(()=>{Vc0();H7();pc();Ev();ny();x11();f11();v11();x11();v11()});import{decodeJwt as BV$}from"jose";var i14=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},OV$=($)=>()=>{return{...$??{}}},n14=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=BV$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:OV$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=BV$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=OV$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=rS$(W),i14({env:Q,server:Z,url:X}),Q},p14,EV$=($)=>{let Z=NV$($),G=$.cors??p14,X=$.oauth,Y=X?XV$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return aS$(J,G??{});let U=n14({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await Bt.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return sS$(w,J,G??{});return w}}};var DV$=O(()=>{ny();eS$();_11();_11();f11();bD0();bD0();ny();kD0();p14={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as y11}from"zod";function o14($,Z){let G=jw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Wy,outputSchema:Ky,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=LV$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return LV$.set(U,F),F}}),X=jw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:aW,outputSchema:IV,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=jw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:aW,outputSchema:y11.object({versions:y11.array(IV.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=jw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:nO0,outputSchema:pO0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=jw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:y11.object({}),outputSchema:Uy,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function zV$($){let Z=$.db,G=new Tf(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=o14(G,Q.id),W=EV$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,E)=>{F.searchParams.set(E,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var t14=3600000,r14=500,LV$;var jV$=O(()=>{DV$();bD0();Sv0();e5();LV$=my({ttlMs:t14,maxSize:r14,updateRecencyOnGet:!0})});import{sql as a14}from"kysely";import{randomUUID as PV$}from"crypto";import{z as s14}from"zod";async function $$4($){let Z=new Date().toISOString(),G=PV$(),X=w4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:PV$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await a14`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function Z$4($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function G$4($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",RV).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):TV$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?AV$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:AV$,rateLimitWindow:e14,rateLimitMax:TV$}}async function X$4($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function Y$4($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function IV$($){let{db:Z,db:G}=$,X=new If(G),Y=new Rf(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await Z$4(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await G$4(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await X$4(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=yL$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:s14.treeifyError(w.error)},400);let F=await Y$4(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await $$4({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return p1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var AV$=!0,e14="hour",TV$=100;var RV$=O(()=>{f4();$6();wy();Vv0();Cv0();e5()});var qV$={};e8(qV$,{createPublishRequestHandler:()=>IV$,createPublicMCPHandler:()=>zV$});var MV$=O(()=>{jV$();RV$()});var pi0={};e8(pi0,{watchHandler:()=>bV$,getProxyDispatch:()=>K$4,createApp:()=>E$4});import{readFileSync as Q$4}from"fs";import{PrometheusSerializer as J$4}from"@opentelemetry/exporter-prometheus";import{DBOS as Et}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as H$4,oAuthProtectedResourceMetadata as N$4}from"better-auth/plugins";async function W$4($){let Z=$.connect(),G;try{G=await Promise.race([Z,SV$(kV$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),SV$(kV$)]),G.release(),!0}catch{return G.release(!0),!1}}function SV$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function K$4(){if(!g11)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return g11}async function U$4($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${bV1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function w$4($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function E$4($={}){let Z=$.database??g6(),G=!1;YZ.stop().catch((d)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",d)});let X,Y,Q=new w11,J,W,K,U,w,F=null;if($.disableNats)J=F11(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new Bn,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(d)=>{(async()=>{let m=d.getReader();try{while(!0){let{done:V0}=await m.read();if(V0)break}}catch{}finally{m.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=zk$();let d=L1().natsCredsPath,m;if(d)try{m=Q$4(d,"utf8")}catch(x1){console.error(`[app] failed to read NATS_CREDS at ${d}; connecting anonymously`,x1)}F.init(L1().natsUrls,m?{creds:m}:void 0);let V0=yv0()?new kf0({getJetStream:()=>F.getJetStream()}):null;V0?.init().catch(()=>{}),X=V0;let v0=new cn0({getJetStream:()=>F.getJetStream()});v0.init().catch(()=>{}),Y=v0,J=F11({getConnection:()=>F.getConnection()}),W=new H11({getConnection:()=>F.getConnection()}),K=new O11({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=sk$({getConnection:()=>F.getConnection()}),w=YS$({getConnection:()=>F.getConnection()});let r0=QS$({getConnection:()=>F.getConnection()}),s0=W;W={start:(x1)=>s0.start(x1),broadcast:(x1)=>s0.broadcast(x1),publishControlFrame:(x1,W8)=>{r0.publishControlFrame(x1,W8).catch((z4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",z4)})},stop:()=>s0.stop()},BP$(F),F.onReady(()=>{V0?.init().catch((x1)=>{console.error("[McpListCache] Deferred init failed:",x1)}),v0.init().catch((x1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",x1)}),J.start(),Pl1(()=>F.getConnection()),K.init().catch((x1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",x1)})})}if(py)await py();Sf0(X),un0(Y);let N={storage:new Cf(Z.db),streamBuffer:K,sseHub:YZ},B=new z11(N),E=new wl(Z.db),D=new j11(E);D.start(),W.start((d)=>{q50(d),B.execute({type:"CANCEL",taskId:d}).catch((m)=>{console.error("[Decopilot] CancelBroadcast execute failed:",m)})}).catch((d)=>{console.error("[Decopilot] CancelBroadcast start failed:",d)}),F?.onReady(()=>{W.start().catch((d)=>{console.error("[CancelBroadcast] Deferred start failed:",d)})}),K.init().catch((d)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",d)}),py=async()=>{await B.stopAll(),B.dispose(),D.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),Al1(),Y.teardown(),Sf0(null),un0(null)};let L=new y1;if(L.use("*",Mb0({enabled:(d)=>G_(d,"debug")==="1"})),L.use("*",oD0),L.use("/*",DC1({origin:(d)=>{if(d.includes("localhost")||d.includes("127.0.0.1"))return d;return d},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(d,m)=>{if(await m(),d.req.path.includes("/files/"))return;if(d.req.path.includes("/fs/")&&d.req.path.endsWith("/read"))return;d.header("X-Frame-Options","DENY"),d.header("Content-Security-Policy","frame-ancestors 'none'")}),!L1().noTui)L.use("*",MS$());L.use("*",async(d,m)=>{if(await m(),ay(d.req.path))return;if(d.res.status>=500){let v0=await d.res.clone().text();console.error(`[5xx Response] ${d.req.method} ${d.req.path} - ${d.res.status}:`,v0)}}),L.get(xX.HEALTH,(d)=>{if(G)return d.json({status:"shutting_down"},503);return d.json({status:"ok"})}),L.get(xX.HEALTH_LIVE,(d)=>{return d.json({status:"ok"})}),L.get(xX.HEALTH_READY,async(d)=>{if(G)return d.json({status:"shutting_down"},503);let m={};if(m.postgres={status:await W$4(Z.pool)?"up":"down"},F)m.nats=F.isConnected()?{status:"up"}:{status:"down"};else m.nats={status:"down"};let V0=m.postgres.status==="up",v0=V0?200:503;return d.json({status:V0?"ready":"not_ready",services:m},v0)}),L.get(xX.METRICS,async(d)=>{try{let m=await $L0.collect(),V0=F$4.serialize(m.resourceMetrics);return d.text(V0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(m){return console.error("Failed to collect metrics:",m),d.text("# Error collecting metrics",500)}}),L.route("/api/config",sM$),L.route("/api/auth/custom",xP$),L.all("/api/auth/*",async(d)=>{return await s6.handler(d.req.raw)});let z=pr1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",kV),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",kV),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",hm),L.route("/",ar1()),L.use("/oauth-proxy/:connectionId/*",kV),L.all("/oauth-proxy/:connectionId/*",VV$);let j=async(d)=>{let V0=await B$4()(d.req.raw),v0=await V0.json();return Response.json(v0,V0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",kV),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(d)=>{let V0=await O$4()(d.req.raw),v0=await V0.json();return Response.json(v0,V0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=wP$({ttlMs:120000}),M=await _r1({db:Z.db,auth:s6,encryption:{key:L1().encryptionKey},observability:{tracer:Aw,meter:y8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(d,m)=>W.publishControlFrame(d,m)});vH.set(M);let S=new fO(L1().encryptionKey);RI1({db:Z.db,baseUrl:v3()});let q=H80(Z.db),V=new Gl(Z.db),t=TS$({db:Z.db});xn0({storage:q,meshContextFactory:t}),Nl0({meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ},prepareLinkWorkFn:II$,workPublisher:w}),Kl0({dispatchRunFn:AI$,meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ}});let f=new Cf(Z.db);M8$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let d=F?.getConnection();return d?await CV$.jetstreamManager(d):null},messageParts:f.messageParts(),resolveRun:async(d)=>{let m=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",d).executeTakeFirst();return m?{orgId:m.organization_id,createdBy:m.created_by,version:m.message_storage_version??1,status:m.status,runFenceToken:m.run_fence_token,title:m.title??null}:null},completeRunIfNotCompleted:async(d,m)=>{let V0=await f.completeRunIfNotCompleted(d,m);return ID0(YZ,m,d,V0),V0},markRunRequiresAction:async(d,m)=>{let V0=await f.requiresActionIfInProgress(d,m);return ID0(YZ,m,d,V0),V0},markRunFailed:async(d,m,V0,v0)=>{let r0=await f.markRunFailed(d,m,V0,v0);return ID0(YZ,m,d,r0),r0},persistTitle:(d,m,V0)=>f.update(d,m,{title:V0}),onTitleUpdated:async({runId:d,orgId:m,title:V0})=>{let v0=await f.get(d,m).catch(()=>null);YZ.emit(m,OJ(d,v0?.status??"in_progress",{title:V0,virtualMcpId:v0?.virtual_mcp_id??void 0,createdBy:v0?.created_by,triggerId:v0?.trigger_id,branch:v0?.branch??null,createdAt:v0?.created_at,updatedAt:v0?.updated_at}))},bumpProgress:async({runId:d,orgId:m})=>{await f.bumpProgress(d,m)},recordCompleted:async({runId:d,orgId:m,distinctId:V0,usage:v0})=>{p1.capture({distinctId:V0,event:"chat_message_completed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",input_tokens:v0.inputTokens,output_tokens:v0.outputTokens,total_tokens:v0.totalTokens}})},recordFailed:async({runId:d,orgId:m,distinctId:V0,reason:v0,kind:r0})=>{p1.capture({distinctId:V0,event:"chat_message_failed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",error_category:r0,error_message:v0}})},purgeRun:async(d)=>{K.purge(d)}}),$Q$({meshContextFactory:t,systemDatabaseUrl:u_1(L1().databaseUrl,L1().databasePgSsl),streamBuffer:K}),PS$(),qI1();let v=async(d,m,V0)=>{let v0=await q.findById(d,m);if(!v0)throw Error("Automation not found");return gn0({automationId:v0.id,organizationId:v0.organization_id,triggerId:null})},e=new Iy(q,({automation:d,trigger:m,contextMessages:V0,idempotencyKey:v0})=>Hn({automationId:d.id,organizationId:d.organization_id,triggerId:m.id,contextMessages:V0},{idempotencyKey:v0})),o=[yQ(),iV(),wK()];for(let d of o)MD0(d).then(()=>{}).catch((m)=>console.error("[monitoring] Retention cleanup failed:",m));let B0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((d)=>console.error("[auth] Expired API key cleanup failed:",d));B0(),setInterval(B0,86400000).unref(),L.use("*",async(d,m)=>{if(tD0(d.req.path))return m();let V0={measure:async(r0,s0)=>{tY(d,r0);try{return await s0()}finally{aX(d,r0)}}},v0=await vH.create(d.req.raw,{timings:V0});v0.automationRunner=v,d.set("meshContext",v0);try{await m()}finally{let r0=v0.pendingRevalidations;if(r0.length>0)Promise.race([Promise.allSettled(r0),new Promise((x1)=>setTimeout(x1,30000))]).catch((x1)=>console.error("[mesh] revalidation cleanup error:",x1))}}),L.use("/api/:org/decopilot/*",SV),L.use("/api/:org/v1/*",SV),L.use("/api/:org/files/*",SV),L.use("*",async(d,m)=>{let V0=d.req.path;if(V0.startsWith("/api/org-sso/")||V0.startsWith("/api/auth/")||V0.startsWith("/api/tools/management")||V0.startsWith("/oauth-proxy/"))return m();let v0=d.get("meshContext");if(!v0?.organization?.id||!v0?.auth?.user?.id)return m();if(!(await v0.storage.orgSsoConfig.getByOrgId(v0.organization.id))?.enforced)return m();if(!await v0.storage.orgSsoSessions.isValid(v0.auth.user.id,v0.organization.id))return d.json({error:"SSO authentication required for this organization"},403);return m()});let O0=new y1;O0.use("*",bQ({mountPath:"/api/org-sso"})),O0.route("/",JE0()),L.route("/api/org-sso",O0),L.get("/api/tools/management",(d)=>{return d.json({tools:Sb0,grouped:TO()})}),L.use("/mcp/*",async(d,m)=>{tY(d,"mcp");try{return await m()}finally{aX(d,"mcp")}});let K0=async(d,m)=>{let V0=d.var.meshContext;if(!V0.auth.user?.id&&!V0.auth.apiKey?.id){let v0=new URL(d.req.url);return d.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${v0.origin}${v0.pathname}/.well-known/oauth-protected-resource"`}})}return await m()};if(L.use("/mcp/:connectionId?",K0),L.use("/mcp/gateway/:virtualMcpId?",K0),L.use("/mcp/virtual-mcp/:virtualMcpId?",K0),L.use("/mcp/self",K0),EJ()){let{mountDevRoutes:d}=(mS$(),gD0(lS$));d(L,K0)}let J0=new y1;J0.use("*",bQ({mountPath:"/mcp"})),J0.route("/",tH0()),L.route("/mcp",J0);let s=new y1;s.use("*",bQ({mountPath:"/mcp/self"})),s.route("/",ND0()),L.route("/mcp/self",s);let T0=new y1;T0.use("*",bQ({mountPath:"/mcp"})),T0.route("/",aH0()),L.route("/mcp",T0),L.use("/api/:org/models/*",async(d,m)=>{tY(d,"llm_models");try{return await m()}finally{aX(d,"llm_models")}});let F0=Oe0({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",F0),F!=null)g11=$S$({getConnection:()=>F?.getConnection()??null});L.route("/api",yM$()),L.get("/api/links/me",async(d)=>{try{let m=d.req.header("authorization")??"",V0=/^Bearer\s+(.+)$/i.exec(m),v0=null;if(V0){let s0=(V0[1]??"").trim();v0=await jM$(s0,s6.api)}else v0=d.get("meshContext")?.auth?.user?.id??null;if(!v0)return d.json({error:"unauthorized"},401);let r0=U?await U(v0):{online:!1,capabilities:[]};if(!r0.online)return d.json(null);return d.json({hostname:r0.hostname,cliVersion:r0.cliVersion})}catch(m){return console.error("[links/me] presence probe failed; reporting offline:",m instanceof Error?m.message:String(m)),d.json(null)}}),L.use("/api/:org/files/*",SV),L.route("/api",Gk$);let f0=new y1;f0.use("*",bQ({mountPath:"/api"})),f0.route("/",BD0()),L.route("/api",f0),L.route("/api",rM$);let m0=new y1;m0.use("*",bQ({mountPath:"/api"})),m0.route("/",OD0({tokenStorage:V,automationEventDispatcher:e})),L.route("/api",m0);let x0=new Yl(Z.db),i0=new y1;i0.use("*",bQ({mountPath:"/api"})),i0.route("/",fE0()),L.route("/api",i0),L.route("/api/deco-sites",dI$()),L.route("/api/deco-apps",lM$());let H0=new y1;H0.use("*",bQ({mountPath:"/api/deco-sites"})),H0.route("/",vE0()),L.route("/api/deco-sites",H0);let S0=new y1;S0.use("*",bQ({mountPath:"/api/vm-events"})),S0.route("/",uM$()),L.route("/api/vm-events",S0);let{createPublishRequestHandler:R0,createPublicMCPHandler:w0}=await Promise.resolve().then(() => (MV$(),qV$)),Y0={db:Z.db,vault:{encrypt:(d)=>S.encrypt(d),decrypt:(d)=>S.decrypt(d)}},G0=R0(Y0),k0=w0(Y0);L.use("/org/:orgRef/registry/publish-request",kV),L.post("/org/:orgRef/registry/publish-request",G0),L.use("/org/:orgSlug/registry/*",kV),L.all("/org/:orgSlug/registry/*",k0),L.post("/api/:org/registry/publish-request",G0),L.all("/api/:org/registry/*",k0);let i=LM$({kvStorage:x0,runRegistry:B,streamBuffer:K,sseHub:YZ,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:e,mountDevAssets:EJ(),mcpAuth:K0,oauthProxyHandler:VV$,watchHandler:bV$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",i),L.notFound((d)=>{return d.json({error:"Not Found",path:d.req.path},404)}),L.onError(SI$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([YZ.stop(),py?Promise.resolve(py()).finally(()=>{py=null}):Promise.resolve()]),F)await F.drain().catch((d)=>console.error("[shutdown] NATS drain error:",d));console.log("[shutdown] Flushing telemetry..."),await CY().catch((d)=>console.error("[shutdown] Telemetry flush error:",d)),console.log("[shutdown] Closing database..."),await l_1(Z).catch((d)=>console.error("[shutdown] Database close error:",d)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Et.registerQueue(vQ,{partitionQueue:!0,concurrency:bn0,minPollingIntervalMs:_n0}),await Et.registerQueue(L3,{partitionQueue:!0,concurrency:Hl0}),await Et.registerQueue(Pw,{partitionQueue:!0,concurrency:Wl0}),await Et.registerQueue($B,{partitionQueue:!0,concurrency:eY$}),await ze0(q),await Promise.allSettled(["automations-gate","automations-global"].map((d)=>Et.deleteQueue(d))),await fn0(Z.pool),Hy1().catch((d)=>{console.error("[studio-pack-backfill] failed:",d)}),MI1().catch((d)=>{console.error("[org-fs] public-sets boot sync kick failed:",d)})}})}var CV$,kV$=5000,g11=null,py=null,VV$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("meshContext");if(!Y)Y=await vH.create($.req.raw),$.set("meshContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await Ox(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await cm(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let q=N.searchParams.get("redirect_uri");if(q){let V=L1().baseUrl??B.origin;try{let t=new URL(q),f=new URL(V);if(!(t.origin===f.origin||t.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",q)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(_V1(J.connection_url))try{let V=await U$4(Y,J.organization_id),t=w$4(V);for(let[f,v]of t)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},D=$.req.header("Content-Type");if(D)E["Content-Type"]=D;let L=$.req.header("Authorization");if(L)E.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&D?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),e=v.indexOf(":");if(e!==-1){let o=decodeURIComponent(v.slice(0,e)),B0=decodeURIComponent(v.slice(e+1));j=o||null,P=B0||null}}catch{}let q=await $.req.formData();if(q.has("resource"))q.set("resource",J.connection_url);let V=q.get("client_id"),t=q.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof t==="string"&&t)P=t;let f=new URLSearchParams;for(let[v,e]of q.entries())f.append(v,e.toString());z=f.toString()}else if(X==="register"&&D?.toLowerCase().includes("application/json")){let q=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),t={};try{t=V?JSON.parse(V):{}}catch{z=V}let f=typeof t==="object"&&t!==null&&!Array.isArray(t);if(z===void 0&&!f)z=V;if(z===void 0){let v=t,e=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...e,organization_id:J.organization_id,...q?.slug?{organization_slug:q.slug}:{},...q?.name?{organization_name:q.name}:{}},z=JSON.stringify(v),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[q,V]of A.headers.entries())if(!S.includes(q.toLowerCase()))M.set(q,V);if(X==="token"&&A.ok){let q=await A.text();try{let V=JSON.parse(q);if(typeof V.access_token==="string"&&V.access_token){let t=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await Ex(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:t,clientId:j,clientSecret:P,tokenEndpoint:f};await new V5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(q,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},bV$=async($)=>{let Z=$.var.meshContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return _Q($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!YZ.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{YZ.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),YZ.remove(X,J),w()})})})},F$4,B$4=()=>N$4(s6),O$4=()=>H$4(s6);var ti0=O(()=>{q8();kI1();m7();eb();$6();d6();K10();LC1();kb0();SU();gm();ws0();LJ();I5();f4();Ds0();Ps0();MI$();Ee0();uJ();$40();De0();VI$();Le0();zM$();gM$();dM$();Te0();mM$();rH0();um();oM$();sH0();i01();eM$();Xk$();m01();l01();Mt();p10();jk$();eX();V80();Jl();ln0();Pk$();Tk$();Sk$();ek$();ZS$();JS$();DS$();LS$();ov0();Zy0();AS$();Y$0();P11();fX();je0();ki();Ql0();Y$0();He0();jv0();Pv0();IS$();X_();kS$();gV();ws0();Bv();M50();CV$=k(OB(),1);F$4=new J$4});var vV$={};e8(vV$,{resolveClientDir:()=>T$4,resolveAssetPathWithTraversalCheck:()=>xV$,isPathWithinDirectory:()=>fV$,createAssetHandler:()=>I$4});import{resolve as Dt,dirname as D$4,join as L$4,extname as z$4,basename as j$4,sep as _V$}from"path";function P$4($,Z){if($===Z||j$4($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${_V$}assets${_V$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function fV$($,Z){let G=Dt(Z),X=Dt($);return X===G||X.startsWith(G+"/")}function xV$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=Dt(Z,G);if(!fV$(X,Z))return null;return X}function T$4($,Z="../client"){let G=new URL($),X=D$4(G.pathname);return Dt(X,Z)}function I$4($={}){let{env:Z="production",clientDir:G=A$4,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=xV$({requestPath:W,clientDir:G});if(!K)return null;let U=L$4(K,"index.html"),w=Dt(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(z$4(K))?[U,w]:[];for(let B of[K,...N])try{let E=Bun.file(B);if(await E.exists())return new Response(E,{headers:P$4(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var A$4="./dist/client";var yV$=()=>{};var gV$={};e8(gV$,{tryUpgradePreviewWs:()=>C$4,tryHandlePreviewHttp:()=>V$4,previewWebSocketHandler:()=>b$4,parsePreviewBaseDomain:()=>S$4,isPreviewWsData:()=>_D0,extractHandleFromHost:()=>h11});function M$4($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function k$4(){return new Response(q$4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function S$4($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function h11($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function V$4($,Z){let G=h11($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return zt(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(uS)&&M$4($))return k$4();return Y.headers.delete(uS),Y}function zt($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function _D0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function C$4($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=h11($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return zt(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return zt(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return zt(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return zt(426,"upgrade failed");return}function Lt($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var R$4=256,q$4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',b$4;var hV$=O(()=>{li0();b$4={open($){let Z=$.data;if(!_D0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Lt($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Lt($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Lt($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!_D0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=R$4){Lt($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!_D0(Z))return;Lt($,Z,1000,"")}}});var lV$={};e8(lV$,{printBanner:()=>f$4,bannerLines:()=>dV$,BANNER_LINES:()=>cV$,BANNER_GRADIENT:()=>uV$});function _$4($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function dV$($){let Z=cV$.map((G,X)=>{let[Y,Q,J]=_$4(uV$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function f$4($){console.log("");for(let Z of dV$($))console.log(Z);console.log("")}var cV$,uV$;var mV$=O(()=>{cV$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],uV$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var nV$={};e8(nV$,{bootstrapDevLinkSession:()=>l$4});import{existsSync as x$4}from"fs";import{chmod as v$4,mkdir as y$4,rename as g$4,writeFile as h$4}from"fs/promises";import{dirname as c$4,join as iV$}from"path";function u$4($){return iV$($,"dev-link")}function d$4($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return iV$(u$4($),"session.json")}async function l$4($,Z){let G=d$4($),X=g6().db,Y=PQ()?await Kn():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(x$4(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await s6.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await s6.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await y$4(c$4(G),{recursive:!0});let W=`${G}.tmp`;return await h$4(W,JSON.stringify(J,null,2),{mode:384}),await v$4(W,384),await g$4(W,G),{path:G,userSub:Y.id}}var pV$=O(()=>{LJ();SU();jN()});f7();var t11="3";function r11($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:t11,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}q8();I5();function Jb$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function YL0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function V$1(){let $=Jb$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:YL0($,"--cpu-prof-dir")??process.cwd(),name:YL0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(YL0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}WL0();var Vt;function h$1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=GB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),Vt=setInterval(()=>void Z().catch(()=>{}),$),Vt.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(Vt)clearInterval(Vt)}}import*as Ub$ from"bun:jsc";var{startSamplingProfiler:wb$,samplingProfilerStackTraces:Fb$}=Ub$;function c$1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{wb$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=Fb$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function u$1(){V$1();let $=[h$1(),g$1(),c$1()];return()=>{for(let Z of $)Z()}}import{existsSync as a$4}from"fs";var VY=L1();k$1();var{DBOS:jt,DBOSClient:m$4}=await import("@dbos-inc/dbos-sdk");function sV$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var i$4=[vQ,L3,Pw,$B],n$4=VY.dispatchRole==="worker"?i$4:VY.dispatchRole==="api"?[]:void 0;jt.setConfig(r11({systemDatabaseUrl:sV$(VY.databaseUrl,VY.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:VY.podName,listenQueues:n$4}));var{createApp:p$4}=await Promise.resolve().then(() => (ti0(),pi0)),{isServerPath:t$4}=await Promise.resolve().then(() => (Mt(),F$1)),{createAssetHandler:r$4,resolveClientDir:eV$}=await Promise.resolve().then(() => (yV$(),vV$)),o$4=VY.port,tV$=eV$(import.meta.url,"../client"),s$4=a$4(tV$)?tV$:eV$(import.meta.url,"../dist/client"),e$4=r$4({clientDir:s$4,isServerPath:t$4}),$84={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function Z84($){let Z=new Headers($.headers);for(let[G,X]of Object.entries($84))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:G84,tryHandlePreviewHttp:X84,tryUpgradePreviewWs:Y84,previewWebSocketHandler:c11,isPreviewWsData:u11}=await Promise.resolve().then(() => (hV$(),gV$)),{getOrInitSharedRunner:Q84}=await Promise.resolve().then(() => (Xn(),eX$)),$C$=G84(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),rV$={baseDomain:$C$??"",getRunner:Q84},fD0=await p$4(),d11=process.env.DBOS_CONDUCTOR_KEY?.trim(),oV$=process.env.DBOS_CONDUCTOR_URL?.trim();await jt.launch({...d11?{conductorKey:d11}:{},...d11&&oV$?{conductorURL:oV$}:{}});console.log(`[dbos] application version: ${jt.applicationVersion}`);await fD0.initDbos();if(!VY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (mV$(),lV$));console.log("");for(let Z of $())console.log(Z)}var J84=Bun.serve({idleTimeout:0,port:o$4,hostname:"0.0.0.0",fetch:async($,Z)=>{if($C$){let X=await Y84($,Z,rV$);if(X===void 0)return;if(X)return X;let Y=await X84($,rV$);if(Y)return Y}let G=await e$4($);if(G)return Z84(G);return fD0.fetch($,{server:Z})},websocket:{open($){if(u11($.data))c11.open($)},message($,Z){if(u11($.data))c11.message($,Z)},close($){if(u11($.data))c11.close($)}},development:!1}),W84=u$1();if(VY.localMode)Promise.resolve().then(() => (jN(),kH0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (pV$(),nV$)),Y=VY.baseUrl??`http://localhost:${VY.port}`,Q=await X(VY.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (jN(),kH0));Z()}catch{}});var aV$=!1;async function K84($){let Z;try{Z=await m$4.create({systemDatabaseUrl:sV$(VY.databaseUrl,VY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:L3,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:L3}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function xD0($){if(aV$)return;aV$=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,G=Math.max(Z-5000,1e4),X=setTimeout(()=>{console.error(`[shutdown] Timed out after ${G}ms, forcing exit.`),process.exit(1)},G);X.unref?.();let Y=0;try{W84(),fD0.markShuttingDown();let Q=Number(process.env.SHUTDOWN_DRAIN_MS??Math.floor(G*0.6));await m4(Q),await J84.stop(!0);let J=jt.executorID;await jt.shutdown(),await K84(J),await fD0.shutdown()}catch(Q){console.error("[shutdown] Error during shutdown:",Q),Y=1}clearTimeout(X),process.exit(Y)}process.on("SIGTERM",()=>xD0("SIGTERM"));process.on("SIGINT",()=>xD0("SIGINT"));process.on("SIGHUP",()=>xD0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),xD0("uncaughtException")});