decocms 4.125.3 → 4.125.5

package/dist/server/cli.js

@@ -12699,12 +12699,11 @@ function commitBeforeRebase(repoDir, operator) {
 function resolveConflictFile(repoDir, summary) {
   const filePath = summary.path;
   const xy = \`\${summary.index}\${summary.working_dir}\`;
-  const abs = path2.join(repoDir, filePath);
-  if (xy.includes("U") && (summary.index === "D" || summary.working_dir === "D")) {
-    if (fs3.existsSync(abs)) {
-      runGit(repoDir, ["add", "--", filePath]);
-      return;
-    }
+  if (xy === "DU") {
+    runGit(repoDir, ["add", "--", filePath]);
+    return;
+  }
+  if (xy === "UD") {
     runGit(repoDir, ["rm", "-f", "--", filePath]);
     return;
   }
@@ -83070,7 +83069,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=Zq(d),_=D&&Zq(t)?Dau(t):t,N=D?Dau(d):_au(d),Z=NVt(_,N);return Z===""||!Z.startsWith("..")&&!DVt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(i6i)},reconcile(){let d=Date.now();for(let D of l.all().map(i6i)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!Zq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(i6i)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!Zq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!k_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=k_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=Oau(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}vVt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=i6i(D),N=0,Z=null;if(Zq(_.sandboxPath)&&k_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=k_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=Oau(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var Gbi=()=>{};function FVt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function Bau(i,u){if(process.platform==="win32")return;for(let t of FVt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var Fau=()=>{};import{existsSync as gVt,readdirSync as TVt}from"fs";import{rm as UVt}from"fs/promises";import{join as gau}from"path";async function Tau(i,u={}){let t=u.detach??AVt,f=u.exists??gVt,l=u.readdir??((w)=>TVt(w)),E=u.rm??((w)=>UVt(w,{recursive:!0,force:!0})),c=gau(i,"org");if(f(c))for(let w of l(c))t(gau(c,w));await E(i)}var AVt=(i)=>Bau(i,process.platform==="darwin");var Uau=O(()=>{Fau()});import{join as yVt}from"path";function Aau(i){let u=i.purge??Tau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await B1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??yVt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var yau=O(()=>{O4();Uau()});import{randomBytes as PVt}from"crypto";import{mkdir as GVt}from"fs/promises";import{createServer as IVt}from"net";import{join as xVt}from"path";function Pau(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function Gau(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function Iau(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function kVt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function jVt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:kVt(i.repo?.cloneUrl)}}function xau(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??XVt,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>xVt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=jVt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,T;try{await GVt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),T=PVt(24).toString("hex");let[k,I]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${I} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:T,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(X){throw Pau("the sandbox didn't come online in time",X)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,I,{repo:N.repo,workload:N.workload,operator:N.operator},T)}catch(X){throw Pau(Gau(X)?"configuration timed out":"the sandbox rejected its configuration",X)}}catch(k){if((Gau(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:Iau(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:Iau(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let U=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${U} previewUrl=${A}`);let G={handle:N.handle,port:F,process:g,sandboxApiUrl:U,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:T,registryMetadata:Z};if(t.set(N.handle,G),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===G)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:U,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function XVt(){return new Promise((i,u)=>{let t=IVt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var kau=()=>{};import{randomUUID as JVt}from"crypto";import{hostname as KVt}from"os";async function jau(i){let u=KVt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=$Mu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=t6i({path:u6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=xau({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(X,b)=>c>0?`http://${X}.localhost:${c}`:`http://127.0.0.1:${b}`,spawnDaemon:async(X)=>{let b={DAEMON_BOOT_ID:JVt(),APP_ROOT:X.workdir,PROXY_PORT:String(X.port),DAEMON_TOKEN:X.daemonToken,OFFLOAD_ALLOWED_HOSTS:X.offloadAllowedHosts.join(","),...X.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(X.orgFsConfigJson){let L=await DMu(i.dataDir);if(L)b.ORGFS_CONFIG=X.orgFsConfigJson,b.ORGFS_RCLONE_PATH=L}let K=await t({workdir:X.workdir,env:b,daemonPort:X.port});return{port:X.port,kill:(L)=>K.kill(L),exited:K.exited.then(()=>{return})}},postConfig:async(X,b,K,L)=>{let m={port:b};if(K.workload)m.runtime=K.workload.runtime,m.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:m},ti=T5(K.operator??null);if(ti)Q.operator=ti;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await B_(`http://127.0.0.1:${X}`,L,Q)},waitForHealth:async(X)=>{await uli(`http://127.0.0.1:${X}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await iau({port:i.port,lookupSandboxPort:(X)=>w.proxyPort(X)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=NMu({provider:w}),v=async()=>{let X=await Z_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!X)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return X.accessToken},d=await vau(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await Pbi(),N=$au(_,{onChange:(X)=>{console.log(`[link-daemon] capabilities detected: +${X.join(",")} (now: ${_.join(",")})`)}}),Z=Dni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let T=await beu(g);console.log("[link-daemon] active transport=tunnel");let U,A=new Promise((X)=>{U=X}),G=!1,k=async()=>{if(G)return;G=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await T.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),U(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!G)console.error("Cluster connection closed permanently; exiting."),k()});let I=Aau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(c){throw E(),c}}var Xau=O(()=>{Eni();zM();hMu();_Mu();OMu();_ni();Ceu();uau();hau();dau();HM();Gbi();yau();kau()});function Ibi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as YVt}from"net";async function SVt(i){for(let u of WVt)if(await xbi(i,u))return u;return null}async function Jau(i,{intervalMs:u=1000}={}){for(;;){let t=await SVt(i);if(t)return t;await y0(u)}}function xbi(i,u){return new Promise((t)=>{let f=YVt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var WVt;var kbi=O(()=>{O4();WVt=["localhost","127.0.0.1","0.0.0.0"]});function Kau(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function LVt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function Yau(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${LVt(i,u)}`].join(`
-`)}var jbi;var Wau=O(()=>{jbi=class jbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var gL;var f6i=O(()=>{gL={name:"decocms",version:"4.125.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Bq={};ji(Bq,{printBanner:()=>zVt,bannerLines:()=>Sau,BANNER_LINES:()=>l6i,BANNER_GRADIENT:()=>E6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Sau(i){let u=l6i.map((t,f)=>{let[l,E,c]=HVt(E6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Sau(i))console.log(u);console.log("")}var l6i,E6i;var TL=O(()=>{l6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],E6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Lau}from"ink";import{jsx as RVt,jsxs as Qau}from"react/jsx-runtime";function c6i({version:i}){return Qau(nVt,{flexDirection:"column",marginTop:1,children:[l6i.map((u,t)=>RVt(Lau,{color:E6i[t],children:u},t)),Qau(Lau,{dimColor:!0,children:[" v",i]})]})}var Xbi=O(()=>{TL()});function Hau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function UL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function zau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function nau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Wbi={};ji(Wbi,{subscribeLinkState:()=>Jbi,setSelectedHandle:()=>Kbi,setRemoving:()=>h6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>gq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>$6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Ybi,pushSandboxEvent:()=>sVt,getLinkState:()=>Fq,applySandboxEvent:()=>Rau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function Rau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function bau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of w6i)i()}function Fq(){return lf}function Jbi(i){return w6i.add(i),()=>w6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Kbi(i){lf={...lf,selectedHandle:i},b3()}function gq(i){lf={...lf,pendingConfirm:i},b3()}function $6i(i){lf={...lf,actionError:i},b3()}function h6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Ybi(i){let u=UL(lf.sandboxes),t=nau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:Rau(lf.sandboxes,i)},b3()}function pVt(){lf=bau(),w6i.clear()}var bVt=20,lf,w6i;var Tq=O(()=>{lf=bau(),w6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Cau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Mau=()=>{};function qau(i,u={}){let t=u.openUrl??Cau,f=Fq(),l=UL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Kbi(zau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);$6i(null),gq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(gq(null),w===null||!c)return;h6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Ybi(w.handle);else h6i(w.handle,!1),$6i($.error)});return}case"confirmNo":gq(null);return;case"quit":if(c)c.quit();return}}var Vau=O(()=>{Tq();Mau()});function rau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var mau={};ji(mau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(Jbi,Fq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=UL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=rau(l,E,i.pendingConfirm!==null);if(c!==null)qau(c)}),J5(b1,{flexDirection:"column",children:[kf(c6i,{version:gL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Hau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var AL;var eau=O(()=>{f6i();Xbi();Vau();Tq();AL={project:18,branch:22,status:14}});var aau={};ji(aau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Sbi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Ibi(l)}
+`)}var jbi;var Wau=O(()=>{jbi=class jbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var gL;var f6i=O(()=>{gL={name:"decocms",version:"4.125.5",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Bq={};ji(Bq,{printBanner:()=>zVt,bannerLines:()=>Sau,BANNER_LINES:()=>l6i,BANNER_GRADIENT:()=>E6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Sau(i){let u=l6i.map((t,f)=>{let[l,E,c]=HVt(E6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Sau(i))console.log(u);console.log("")}var l6i,E6i;var TL=O(()=>{l6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],E6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Lau}from"ink";import{jsx as RVt,jsxs as Qau}from"react/jsx-runtime";function c6i({version:i}){return Qau(nVt,{flexDirection:"column",marginTop:1,children:[l6i.map((u,t)=>RVt(Lau,{color:E6i[t],children:u},t)),Qau(Lau,{dimColor:!0,children:[" v",i]})]})}var Xbi=O(()=>{TL()});function Hau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function UL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function zau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function nau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Wbi={};ji(Wbi,{subscribeLinkState:()=>Jbi,setSelectedHandle:()=>Kbi,setRemoving:()=>h6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>gq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>$6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Ybi,pushSandboxEvent:()=>sVt,getLinkState:()=>Fq,applySandboxEvent:()=>Rau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function Rau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function bau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of w6i)i()}function Fq(){return lf}function Jbi(i){return w6i.add(i),()=>w6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Kbi(i){lf={...lf,selectedHandle:i},b3()}function gq(i){lf={...lf,pendingConfirm:i},b3()}function $6i(i){lf={...lf,actionError:i},b3()}function h6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Ybi(i){let u=UL(lf.sandboxes),t=nau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:Rau(lf.sandboxes,i)},b3()}function pVt(){lf=bau(),w6i.clear()}var bVt=20,lf,w6i;var Tq=O(()=>{lf=bau(),w6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Cau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Mau=()=>{};function qau(i,u={}){let t=u.openUrl??Cau,f=Fq(),l=UL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Kbi(zau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);$6i(null),gq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(gq(null),w===null||!c)return;h6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Ybi(w.handle);else h6i(w.handle,!1),$6i($.error)});return}case"confirmNo":gq(null);return;case"quit":if(c)c.quit();return}}var Vau=O(()=>{Tq();Mau()});function rau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var mau={};ji(mau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(Jbi,Fq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=UL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=rau(l,E,i.pendingConfirm!==null);if(c!==null)qau(c)}),J5(b1,{flexDirection:"column",children:[kf(c6i,{version:gL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Hau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var AL;var eau=O(()=>{f6i();Xbi();Vau();Tq();AL={project:18,branch:22,status:14}});var aau={};ji(aau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Sbi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Ibi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(Ibi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function Drt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function _rt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??Sbi(vrt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await xbi(u,"127.0.0.1"))throw new jbi(u);let $=Sbi(t,"sandboxes");c=t6i({path:u6i(t),managedSandboxRoot:$});let h=await o1i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await Drt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (eau(),mau)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:T,setDaemonError:U,setIngress:A,setLogPath:G,setMachine:k,setPersistedSandboxes:I}=await Promise.resolve().then(() => (Tq(),Wbi));wrt(t,{recursive:!0});let X=Sbi(t,"link.log");E=$rt(X,"w"),G(X),I(v),T(f),g("connecting"),d={onEvent:(b)=>F(b),onIngress:(b)=>A(b,`http://127.0.0.1:${b}`),onCluster:(b)=>g(b),onMachine:(b)=>k(b)},l=drt(U,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (TL(),Bq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await jau({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (Tq(),Wbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error(Kau($)?Yau(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{crt(E)}catch{}w()}}var oau=O(()=>{lni();Xau();kbi();Wau();Gbi()});var Rbi={};ji(Rbi,{resolveDevLinkClusterUrl:()=>Brt,populateDevLinkToxiProxy:()=>fou,isDevLinkToxiProxyEnabled:()=>Zrt,ensureDevLinkToxiProxy:()=>Art,buildDevLinkToxiProxyConfig:()=>uou,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>pau,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>iou});function Zrt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function Lbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function uou(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=Lbi(i.apiPort,"apiPort"),f=Lbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=Lbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:pau,proxyName:iou,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function Brt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function Qbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function nbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function tou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return tou(i.cause)}async function Hbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${nbi(l)}`,{cause:l})}}async function fou(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await Hbi(u,"reset",t,{method:"POST"});await Qbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await Hbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await Qbi(E,"populate",l)}async function Frt(i,u){let t=`${i.apiUrl}/version`;try{await B1(async()=>{let f=await Hbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(Ort)});await Qbi(f,"readiness check",t)},{maxAttempts:Nrt,minTimeout:sau,maxTimeout:sau,multiplier:1,jitter:0,isRetriable:(f)=>!tou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${nbi(l)}`,{cause:l})}}async function grt(i){if(i===null)return"";return await new Response(i).text()}async function zbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${nbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,grt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Trt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await zbi(["rm","-f",t],{ignoreFailure:!0}),await zbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function Urt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await zbi(["rm","-f",t],{ignoreFailure:!0})}async function Art(i){let u=uou(i),t=i.startDaemon??Trt,f=i.stopDaemon??(i.startDaemon===void 0?Urt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await Frt(u,l),await fou(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var pau="ToxiProxy",iou="dev_link_studio",Nrt=20,sau=100,Ort=100;var bbi=O(()=>{O4()});var lou={};ji(lou,{migrateBetterAuth:()=>Cbi});import{getMigrations as yrt}from"better-auth/db";import{sso as Prt}from"@better-auth/sso";import{organization as Grt}from"@decocms/better-auth/plugins";import{admin as Irt,apiKey as xrt,jwt as krt,magicLink as jrt,mcp as Xrt,openAPI as Jrt}from"better-auth/plugins";import{emailOTP as Krt}from"better-auth/plugins/email-otp";async function Cbi(i){let t={database:KM(i||D_()),plugins:[Grt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),Irt(),xrt(),krt(),Jrt(),Xrt({loginPage:"/login"}),Prt(),jrt({sendMagicLink:async()=>{}}),Krt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await yrt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var Mbi=O(()=>{b6()});var qbi={};ji(qbi,{up:()=>Yrt,down:()=>Wrt});import{sql as _d}from"kysely";async function Yrt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function Wrt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Eou=()=>{};var Vbi={};ji(Vbi,{up:()=>Srt,down:()=>Lrt});import{sql as cou}from"kysely";async function Srt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(cou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(cou`CURRENT_TIMESTAMP`)).execute()}async function Lrt(i){await i.schema.dropTable("organization_settings").execute()}var wou=()=>{};var rbi={};ji(rbi,{up:()=>Qrt,down:()=>Hrt});async function Qrt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Hrt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var mbi={};ji(mbi,{up:()=>zrt,down:()=>nrt});async function zrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function nrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var ebi={};ji(ebi,{up:()=>Rrt,down:()=>brt});async function Rrt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function brt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var abi={};ji(abi,{up:()=>Mrt,down:()=>qrt});import{sql as Crt}from"kysely";async function Mrt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Crt`text`).execute()}async function qrt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var $ou=()=>{};var obi={};ji(obi,{up:()=>Vrt,down:()=>rrt});async function Vrt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function rrt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var sbi={};ji(sbi,{up:()=>mrt,down:()=>ert});import{sql as Uq}from"kysely";async function mrt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function ert(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var hou=()=>{};var pbi={};ji(pbi,{up:()=>ort,down:()=>srt});import{sql as art}from"kysely";async function ort(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function srt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(art`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var vou=()=>{};var iCi={};ji(iCi,{up:()=>prt,down:()=>imt});import{sql as v6i}from"kysely";async function prt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await v6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function imt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var dou=()=>{};var uCi={};ji(uCi,{up:()=>umt,down:()=>tmt});async function umt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function tmt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var tCi={};ji(tCi,{up:()=>fmt,down:()=>lmt});import{sql as d6i}from"kysely";async function fmt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await d6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -86666,7 +86665,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
         and status = 'pending'
         and "expiresAt" > now()
     ) as exists
-  `.execute(i)).rows[0]?.exists??!1}async function As0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!zN(f))throw f}}async function ys0(i,u){for(let t=0;t<Fs0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return wg4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!$g4(l)||t===Fs0-1)throw l}}throw Error("Failed to create organization")}var Fs0=5,ig4,ug4;var S5u=O(()=>{lGi();ig4=["labs","agent","studio","workspace","systems","core","cloud","works"],ug4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var Xs0={};ji(Xs0,{resetPasswordEnabled:()=>wGi,grantDeploymentAdmin:()=>z5u,getTrustedOrigins:()=>$Gi,authConfig:()=>uf,auth:()=>vt,GENERIC_EMAIL_DOMAINS:()=>jv});import{sso as hg4}from"@better-auth/sso";import{organization as vg4}from"@decocms/better-auth/plugins";import{betterAuth as dg4}from"better-auth";import{admin as Dg4,apiKey as _g4,jwt as Ng4,magicLink as Og4,mcp as Zg4,openAPI as Bg4}from"better-auth/plugins";import{emailOTP as Fg4}from"better-auth/plugins/email-otp";import{APIError as xs0}from"better-auth/api";import{adminAc as gg4,defaultRoles as Tg4}from"better-auth/plugins/admin/access";import{defaultStatements as Ug4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as Ag4}from"@decocms/better-auth/plugins/access";function Ps0(i){if(!egi(i))return;throw new xs0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function z5u(i){if(!L5u.includes(i))L5u.push(i)}function $Gi(){let i=[Gp];try{let u=new URL(Gp);if(u.hostname==="localhost")i.push(Gp.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Gp.replace("127.0.0.1","localhost"))}catch{}return i}var ks0,yg4,cGi,H5u,Pg4,Gg4,Ig4,Gs0,L5u,uf,js0=void 0,Q5u=void 0,wGi=!1,xg4,kg4,jg4,Gp,Is0,Xg4=262144,vt;var F$=O(()=>{z0();oL();yri();H4();Ml();b6();Af0();UV();Pf0();vs0();Ds0();_s0();Uh();Mpi();Os0();lGi();S5u();Z1u();ks0=Object.values(yB()).map((i)=>i.map((u)=>u.name)).flat(),yg4={...Ug4,self:["*",...ks0]},cGi=Ag4(yg4),H5u=Cpi(ks0),Pg4=cGi.newRole(H5u.user),Gg4=cGi.newRole(H5u.admin),Ig4=cGi.newRole(H5u.owner),Gs0=Object.values(yB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),L5u=[];uf=PB().auth;if(uf.inviteEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=sD(uf.emailProviders,uf.inviteEmailProviderId);if(i){let u=oD(i);js0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${cl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:pD({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:jB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(uf.resetPasswordEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=sD(uf.emailProviders,uf.resetPasswordEmailProviderId);if(i){let u=oD(i);wGi=!0,Q5u=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:pD({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:jB("Reset password",f)+mEi("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}xg4=[vg4({organizationCreation:{afterCreate:async(i)=>{await hs0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Ps0(i.slug)},afterAddMember:async({member:i})=>{try{await j5u(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await j5u(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Ps0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await ds0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:cGi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:nm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:Pg4,admin:Gg4,owner:Ig4},sendInvitationEmail:js0}),Zg4({loginPage:"/login",oidcConfig:{scopes:Gs0,metadata:{scopes_supported:Gs0},loginPage:"/login"}}),_g4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),Dg4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...Tg4,owner:gg4},adminUserIds:L5u}),Bg4(),Ng4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),hg4(uf.ssoConfig?Ns0(uf.ssoConfig):void 0),...uf.magicLinkConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[Og4(yf0(uf.magicLinkConfig,uf.emailProviders))]:[],...uf.emailOtpConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[Fg4(Uf0(uf.emailOtpConfig,uf.emailProviders))]:[]],kg4=D_(),jg4=KM(kg4),Gp=cl();Is0=hu(),vt=dg4({secret:Is0.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Gp,trustedOrigins:$Gi(),database:jg4,socialProviders:uf.socialProviders,...uf.ssoConfig&&{account:{accountLinking:{trustedProviders:[uf.ssoConfig.providerId]}}},emailAndPassword:{enabled:uf.emailAndPassword.enabled,...Q5u&&{sendResetPassword:Q5u}},rateLimit:{enabled:!Is0.disableRateLimit,window:60,max:1e4},plugins:xg4,databaseHooks:{user:{create:{after:async(i)=>{X5u({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified}),mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name}});let u=PB().autoCreateOrganizationOnSignup!==!1;try{let t=await EGi({db:m0().db,authApi:vt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:u,createdVia:"signup"});if(t.status==="created")mu.groupIdentify({groupType:"organization",groupKey:t.organization.id,properties:{name:t.organization.name,slug:t.organization.slug,created_at:new Date().toISOString(),created_via:t.createdVia,email_domain:t.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,name:t.organization.name,created_via:t.createdVia,email_domain:t.domain}});if(t.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,email_domain:t.domain,joined_via:t.createdVia}})}catch(t){mu.captureException(t,i.id),console.error("Failed to ensure organization on signup:",t)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>Xg4)throw new xs0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await m0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;X5u({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function n5u(i,u){return`${i}:${u}`}function Js0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=n5u(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=n5u(E,c);f.set($,{role:w,expiresAt:Date.now()+u,organizationId:c}),l()},invalidate(E,c){f.delete(n5u(E,c))},invalidateOrg(E){for(let[c,w]of f)if(w.organizationId===E)f.delete(c)}}}class R5u{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=Ks0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of Ks0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var Ks0;var Ys0=O(()=>{Ks0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function Jg4(i,u,t=5){try{await B1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function Ws0(i){let u=new R5u({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{Jg4("[NatsSSEBroadcast]",()=>u.start())})}var b5u=O(()=>{O4();Ys0();QTi();QTi()});var Ss0=()=>{};var C5u=()=>{};var Ls0=()=>{};var Kg4,SK6;var Qs0=O(()=>{Ss0();C5u();q_();Ls0();Kg4={br:".br",zstd:".zst",gzip:".gz"},SK6=Object.keys(Kg4)});var Hs0=O(()=>{Qs0()});var zs0=()=>{};var ns0=O(()=>{zs0()});var Rs0=()=>{};var bs0=O(()=>{hri()});var M5u=O(()=>{V_();bs0()});var q5u="x-hono-disable-ssg",iY6;var V5u=O(()=>{M5u();iY6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[q5u]:"true"}})}catch{return null}})()});var Cs0=O(()=>{FEi()});var r5u=O(()=>{Cs0()});var Ms0=O(()=>{ns0();Rs0();C5u();V5u();r5u();M5u()});var qs0=O(()=>{V5u();r5u();Ms0()});var LY6;var Vs0=O(()=>{qs0();({write:LY6}=Bun)});var Sg4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},rs0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var ms0=()=>{};var Ip=(i)=>("server"in i.env)?i.env.server:i.env;var hGi=()=>{};var Lg4;var es0=O(()=>{ms0();hGi();Lg4=rs0((i,u)=>{let t=Ip(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var m5u=(i)=>{let u=Ip(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var as0=O(()=>{hGi()});var os0=O(()=>{Hs0();Vs0();es0();as0();hGi()});var ss0;var ps0=O(()=>{ss0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function ip0(){let i=Object.keys(uf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:ss0[l].icon})),f=hu().localMode;return{emailAndPassword:{enabled:uf.emailAndPassword?.enabled??!1},magicLink:{enabled:uf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:uf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:wGi},socialProviders:{enabled:u,providers:t},sso:uf.ssoConfig?{enabled:!0,providerId:uf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:mh()}}async function Qg4(i,u,t){try{if(!uf.inviteEmailProviderId||!uf.emailProviders||uf.emailProviders.length===0)return;let f=sD(uf.emailProviders,uf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=nm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=oD(f),$=`${cl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:pD({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:jB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var D7,up0;var e5u=O(()=>{mt();os0();H4();z0();F$();b6();S5u();j1u();lGi();UV();Uh();Ml();Tpi();ps0();lO();oL();D7=new Ku;D7.post("/local-session",async(i)=>{if(!mh())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=m5u(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (lO(),GUi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),Xs0)),E=await ts();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await PUi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});D7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(Th(c))return i.json({role:c,capabilities:$00()});if(c==="user")return i.json({role:c,capabilities:Tri({self:[...kEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:Tri($)})});D7.get("/domain-lookup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(m0().db).getAllByDomain(t)).filter(fGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await m0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});D7.post("/domain-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=m0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await vt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!zN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});D7.post("/domain-setup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=m0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let T=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((U)=>U.organizationId)).executeTakeFirst();if(T)return i.json({success:!0,slug:T.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let U=0;U<3;U++){let A=U===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=U===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await vt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||U===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let T=hu().firecrawlApiKey;if(T){let U=await ogi(t,T,d);if(U){let A=new Hm(m0().db),G=await A.create(N,U);if(await A.setDefault(G.id,N),Z=!0,U.name&&U.name!==d)B=U.name;F=U.favicon??U.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await vt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});D7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await vt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!jv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new zH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});D7.post("/domain-request-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=m0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new zH(E).create(c.id,u.user.id),await Qg4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});D7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await vt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await EGi({db:m0().db,authApi:vt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});up0=D7});async function vGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as Hg4}from"crypto";function zg4(i,u){let t=Hg4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var tp0,fp0;var lp0=O(()=>{mt();F$();tp0=new Ku;tp0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await vGi(f,vt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await vt.$context,c=await E.internalAdapter.createSession(l,!1),w=zg4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});fp0=tp0});function wp0(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function ng4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!$Gi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function Ep0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function cp0(i){let u=await vt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function Rg4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!hu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return z5u(t.id),u()}function $p0(){let i=new Ku;return i.use("*",ng4),i.use("*",Rg4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await vt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await cp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await vt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;Ep0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=m0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!CH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await m0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await vt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(zN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await cp0(u),h=$??w;return Ep0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var a5u="/api/_admin";var hp0=O(()=>{mt();F$();Uh();b6();H4();z0()});import*as DGi from"jose";function bg4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await s5u(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await s5u(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await o5u(E.issuer,E.discoveryEndpoint),w=Cg4(),$=await Mg4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});vV(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=aL(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");vV(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await o5u($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=DGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await DGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await s5u(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!qg4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await o5u(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function dGi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=hu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function o5u(i,u){let t=u||i,f=vp0.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;dGi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return dGi(c.authorization_endpoint),dGi(c.token_endpoint),dGi(c.jwks_uri),vp0.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function Cg4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Mg4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function s5u(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function qg4(i){return Th(i.organization?.role)}function p5u(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var _Gi=()=>{let i=new Ku;return bg4(i),i},vp0;var ivu=O(()=>{mt();IEi();z0();Uh();vp0=new Map});function mg4(i){if(i==="claude-code")return Vg4;if(i==="codex")return rg4;return null}function dp0(i,u){return mg4(i)?.[u]??null}var Vg4,rg4;var Dp0=O(()=>{Vg4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 4.8 1M"}},rg4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});var _p0=O(()=>{Dp0()});function Np0(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function eg4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function Op0(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(Np0(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(Np0(c))return c.toolCallId===t;if(eg4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function ag4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function og4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function Zp0(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Co({messages:t}),l=ag4(f),E=await aK(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=og4(E),$=Op0(w),v=slu({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,T=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...T?{providerOptions:{google:T}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var Bp0=O(()=>{Of()});function Fp0(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var gp0=()=>{};function NGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}async function OGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=NGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(/[.*>\s]/.test(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function ZGi(i){let u=await OGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var Tp0=O(()=>{C5()});import{z as il}from"zod";var sg4,pg4,Up0;var Ap0=O(()=>{b2();r9();sg4=il.looseObject({id:il.string().optional(),role:il.enum(["user","assistant","system"]),parts:il.array(il.record(il.string(),il.unknown())),metadata:il.unknown().optional()}),pg4=il.object({windowSize:il.number().default(Ah),thread_id:il.string()}),Up0=il.object({messages:il.array(sg4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:pg4.optional(),tier:ZI0.optional(),agent:il.object({id:il.string()}).loose(),stream:il.boolean().optional(),temperature:il.number().default(0.5),thread_id:il.string().optional(),branch:il.string().nullish(),toolApprovalLevel:il.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:il.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:il.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:il.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function BGi(i){yp0.set(i.id,i)}function Pp0(i){return yp0.get(i)}var yp0;var uvu=O(()=>{yp0=new Map});function tvu(i,u,t){let f=Pp0(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var fvu=O(()=>{uvu()});class lvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return tvu(this.harnessId,i,this.ctx)}}var Gp0=O(()=>{fvu()});import{z as Ri}from"zod";import{existsSync as dT4}from"fs";import{query as Jp0}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as US6,tool as AS6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as yS6,InMemorySessionStore as PS6,HOOK_EVENTS as GS6,AbortError as IS6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as kS6,forkSession as jS6,getSessionInfo as XS6,getSessionMessages as JS6,deleteSession as KS6,renameSession as YS6,tagSession as WS6,listSubagents as SS6,getSubagentMessages as LS6,foldSessionSummary as QS6,importSessionToStore as HS6}from"@anthropic-ai/claude-agent-sdk";import{startup as nS6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bS6,tool as CS6}from"@anthropic-ai/claude-agent-sdk";import"zod";function uT4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>Ip0)return`${u.slice(0,Ip0)}...[truncated]`;return u}function tT4(i){return i.replace(/\s+/g,"")}function fT4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function YR(i,u){let t=i.trim(),f=tT4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function hvu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function lT4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=hvu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return YR(f,t)}function ET4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:iT4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=YR(E,c);return w?{content:w}:{warning:b8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=YR(E,c);return w?{content:w}:{warning:b8}}if(u){let E=YR(u,t);if(E)return{content:E}}return{warning:b8}}function cT4(i){if(!i||typeof i!=="object")return{warning:b8};let u=i.image,t=hvu(i.mimeType);if(typeof u==="string")return ET4(u,t);if(u&&typeof u==="object"){let f=lT4(u,t);return f?{content:f}:{warning:b8}}return{warning:b8}}function wT4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function $T4(i){let u=hvu(i.mediaType??i.mimeType);if(!u||!fT4(u))return{};let t=i.data;if(typeof t==="string"){let f=YR(u,t);return f?{content:f}:{warning:b8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=wT4(t);if(!f)return{warning:b8};let l=YR(u,f);return l?{content:l}:{warning:b8}}return{warning:b8}}function xp0(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
+  `.execute(i)).rows[0]?.exists??!1}async function As0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!zN(f))throw f}}async function ys0(i,u){for(let t=0;t<Fs0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return wg4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!$g4(l)||t===Fs0-1)throw l}}throw Error("Failed to create organization")}var Fs0=5,ig4,ug4;var S5u=O(()=>{lGi();ig4=["labs","agent","studio","workspace","systems","core","cloud","works"],ug4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var Xs0={};ji(Xs0,{resetPasswordEnabled:()=>wGi,grantDeploymentAdmin:()=>z5u,getTrustedOrigins:()=>$Gi,authConfig:()=>uf,auth:()=>vt,GENERIC_EMAIL_DOMAINS:()=>jv});import{sso as hg4}from"@better-auth/sso";import{organization as vg4}from"@decocms/better-auth/plugins";import{betterAuth as dg4}from"better-auth";import{admin as Dg4,apiKey as _g4,jwt as Ng4,magicLink as Og4,mcp as Zg4,openAPI as Bg4}from"better-auth/plugins";import{emailOTP as Fg4}from"better-auth/plugins/email-otp";import{APIError as xs0}from"better-auth/api";import{adminAc as gg4,defaultRoles as Tg4}from"better-auth/plugins/admin/access";import{defaultStatements as Ug4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as Ag4}from"@decocms/better-auth/plugins/access";function Ps0(i){if(!egi(i))return;throw new xs0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function z5u(i){if(!L5u.includes(i))L5u.push(i)}function $Gi(){let i=[Gp];try{let u=new URL(Gp);if(u.hostname==="localhost")i.push(Gp.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Gp.replace("127.0.0.1","localhost"))}catch{}return i}var ks0,yg4,cGi,H5u,Pg4,Gg4,Ig4,Gs0,L5u,uf,js0=void 0,Q5u=void 0,wGi=!1,xg4,kg4,jg4,Gp,Is0,Xg4=262144,vt;var F$=O(()=>{z0();oL();yri();H4();Ml();b6();Af0();UV();Pf0();vs0();Ds0();_s0();Uh();Mpi();Os0();lGi();S5u();Z1u();ks0=Object.values(yB()).map((i)=>i.map((u)=>u.name)).flat(),yg4={...Ug4,self:["*",...ks0]},cGi=Ag4(yg4),H5u=Cpi(ks0),Pg4=cGi.newRole(H5u.user),Gg4=cGi.newRole(H5u.admin),Ig4=cGi.newRole(H5u.owner),Gs0=Object.values(yB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),L5u=[];uf=PB().auth;if(uf.inviteEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=sD(uf.emailProviders,uf.inviteEmailProviderId);if(i){let u=oD(i);js0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${cl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:pD({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:jB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(uf.resetPasswordEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=sD(uf.emailProviders,uf.resetPasswordEmailProviderId);if(i){let u=oD(i);wGi=!0,Q5u=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:pD({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:jB("Reset password",f)+mEi("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}xg4=[vg4({organizationCreation:{afterCreate:async(i)=>{await hs0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Ps0(i.slug)},afterAddMember:async({member:i})=>{try{await j5u(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await j5u(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Ps0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await ds0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:cGi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:nm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:Pg4,admin:Gg4,owner:Ig4},sendInvitationEmail:js0}),Zg4({loginPage:"/login",oidcConfig:{scopes:Gs0,metadata:{scopes_supported:Gs0},loginPage:"/login"}}),_g4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),Dg4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...Tg4,owner:gg4},adminUserIds:L5u}),Bg4(),Ng4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),hg4(uf.ssoConfig?Ns0(uf.ssoConfig):void 0),...uf.magicLinkConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[Og4(yf0(uf.magicLinkConfig,uf.emailProviders))]:[],...uf.emailOtpConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[Fg4(Uf0(uf.emailOtpConfig,uf.emailProviders))]:[]],kg4=D_(),jg4=KM(kg4),Gp=cl();Is0=hu(),vt=dg4({secret:Is0.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Gp,trustedOrigins:$Gi(),database:jg4,socialProviders:uf.socialProviders,...uf.ssoConfig&&{account:{accountLinking:{trustedProviders:[uf.ssoConfig.providerId]}}},emailAndPassword:{enabled:uf.emailAndPassword.enabled,...Q5u&&{sendResetPassword:Q5u}},rateLimit:{enabled:!Is0.disableRateLimit,window:60,max:1e4},plugins:xg4,databaseHooks:{user:{create:{after:async(i)=>{X5u({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified}),mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name}});let u=PB().autoCreateOrganizationOnSignup!==!1;try{let t=await EGi({db:m0().db,authApi:vt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:u,createdVia:"signup"});if(t.status==="created")mu.groupIdentify({groupType:"organization",groupKey:t.organization.id,properties:{name:t.organization.name,slug:t.organization.slug,created_at:new Date().toISOString(),created_via:t.createdVia,email_domain:t.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,name:t.organization.name,created_via:t.createdVia,email_domain:t.domain}});if(t.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,email_domain:t.domain,joined_via:t.createdVia}})}catch(t){mu.captureException(t,i.id),console.error("Failed to ensure organization on signup:",t)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>Xg4)throw new xs0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await m0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;X5u({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function n5u(i,u){return`${i}:${u}`}function Js0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=n5u(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=n5u(E,c);f.set($,{role:w,expiresAt:Date.now()+u,organizationId:c}),l()},invalidate(E,c){f.delete(n5u(E,c))},invalidateOrg(E){for(let[c,w]of f)if(w.organizationId===E)f.delete(c)}}}class R5u{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=Ks0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of Ks0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var Ks0;var Ys0=O(()=>{Ks0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function Jg4(i,u,t=5){try{await B1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function Ws0(i){let u=new R5u({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{Jg4("[NatsSSEBroadcast]",()=>u.start())})}var b5u=O(()=>{O4();Ys0();QTi();QTi()});var Ss0=()=>{};var C5u=()=>{};var Ls0=()=>{};var Kg4,SK6;var Qs0=O(()=>{Ss0();C5u();q_();Ls0();Kg4={br:".br",zstd:".zst",gzip:".gz"},SK6=Object.keys(Kg4)});var Hs0=O(()=>{Qs0()});var zs0=()=>{};var ns0=O(()=>{zs0()});var Rs0=()=>{};var bs0=O(()=>{hri()});var M5u=O(()=>{V_();bs0()});var q5u="x-hono-disable-ssg",iY6;var V5u=O(()=>{M5u();iY6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[q5u]:"true"}})}catch{return null}})()});var Cs0=O(()=>{FEi()});var r5u=O(()=>{Cs0()});var Ms0=O(()=>{ns0();Rs0();C5u();V5u();r5u();M5u()});var qs0=O(()=>{V5u();r5u();Ms0()});var LY6;var Vs0=O(()=>{qs0();({write:LY6}=Bun)});var Sg4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},rs0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var ms0=()=>{};var Ip=(i)=>("server"in i.env)?i.env.server:i.env;var hGi=()=>{};var Lg4;var es0=O(()=>{ms0();hGi();Lg4=rs0((i,u)=>{let t=Ip(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var m5u=(i)=>{let u=Ip(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var as0=O(()=>{hGi()});var os0=O(()=>{Hs0();Vs0();es0();as0();hGi()});var ss0;var ps0=O(()=>{ss0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function ip0(){let i=Object.keys(uf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:ss0[l].icon})),f=hu().localMode;return{emailAndPassword:{enabled:uf.emailAndPassword?.enabled??!1},magicLink:{enabled:uf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:uf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:wGi},socialProviders:{enabled:u,providers:t},sso:uf.ssoConfig?{enabled:!0,providerId:uf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:mh()}}async function Qg4(i,u,t){try{if(!uf.inviteEmailProviderId||!uf.emailProviders||uf.emailProviders.length===0)return;let f=sD(uf.emailProviders,uf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=nm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=oD(f),$=`${cl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:pD({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:jB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var D7,up0;var e5u=O(()=>{mt();os0();H4();z0();F$();b6();S5u();j1u();lGi();UV();Uh();Ml();Tpi();ps0();lO();oL();D7=new Ku;D7.post("/local-session",async(i)=>{if(!mh())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=m5u(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (lO(),GUi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),Xs0)),E=await ts();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await PUi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});D7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(Th(c))return i.json({role:c,capabilities:$00()});if(c==="user")return i.json({role:c,capabilities:Tri({self:[...kEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:Tri($)})});D7.get("/domain-lookup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(m0().db).getAllByDomain(t)).filter(fGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await m0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});D7.post("/domain-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=m0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await vt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!zN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});D7.post("/domain-setup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=m0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let T=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((U)=>U.organizationId)).executeTakeFirst();if(T)return i.json({success:!0,slug:T.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let U=0;U<3;U++){let A=U===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=U===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await vt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||U===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let T=hu().firecrawlApiKey;if(T){let U=await ogi(t,T,d);if(U){let A=new Hm(m0().db),G=await A.create(N,U);if(await A.setDefault(G.id,N),Z=!0,U.name&&U.name!==d)B=U.name;F=U.favicon??U.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await vt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});D7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await vt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!jv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new zH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});D7.post("/domain-request-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||jv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=m0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new zH(E).create(c.id,u.user.id),await Qg4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});D7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await vt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await EGi({db:m0().db,authApi:vt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});up0=D7});async function vGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as Hg4}from"crypto";function zg4(i,u){let t=Hg4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var tp0,fp0;var lp0=O(()=>{mt();F$();tp0=new Ku;tp0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await vGi(f,vt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await vt.$context,c=await E.internalAdapter.createSession(l,!1),w=zg4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});fp0=tp0});function wp0(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function ng4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!$Gi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function Ep0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function cp0(i){let u=await vt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function Rg4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!hu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return z5u(t.id),u()}function $p0(){let i=new Ku;return i.use("*",ng4),i.use("*",Rg4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await vt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await cp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await vt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;Ep0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=m0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!CH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await m0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await vt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(zN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await cp0(u),h=$??w;return Ep0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var a5u="/api/_admin";var hp0=O(()=>{mt();F$();Uh();b6();H4();z0()});import*as DGi from"jose";function bg4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await s5u(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await s5u(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await o5u(E.issuer,E.discoveryEndpoint),w=Cg4(),$=await Mg4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});vV(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=aL(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");vV(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await o5u($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=DGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await DGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await s5u(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!qg4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await o5u(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!p5u(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function dGi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=hu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function o5u(i,u){let t=u||i,f=vp0.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;dGi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return dGi(c.authorization_endpoint),dGi(c.token_endpoint),dGi(c.jwks_uri),vp0.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function Cg4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Mg4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function s5u(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function qg4(i){return Th(i.organization?.role)}function p5u(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var _Gi=()=>{let i=new Ku;return bg4(i),i},vp0;var ivu=O(()=>{mt();IEi();z0();Uh();vp0=new Map});function mg4(i){if(i==="claude-code")return Vg4;if(i==="codex")return rg4;return null}function dp0(i,u){return mg4(i)?.[u]??null}var Vg4,rg4;var Dp0=O(()=>{Vg4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 4.8 1M"}},rg4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});var _p0=O(()=>{Dp0()});function Np0(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function eg4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function Op0(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(Np0(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(Np0(c))return c.toolCallId===t;if(eg4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function ag4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function og4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function Zp0(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Co({messages:t}),l=ag4(f),E=await aK(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=og4(E),$=Op0(w),v=slu({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,T=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...T?{providerOptions:{google:T}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var Bp0=O(()=>{Of()});function Fp0(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var gp0=()=>{};function NGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}async function OGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=NGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(/[.*>\s]/.test(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function ZGi(i){let u=await OGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var Tp0=O(()=>{C5()});import{z as il}from"zod";var sg4,pg4,Up0;var Ap0=O(()=>{b2();r9();sg4=il.looseObject({id:il.string().optional(),role:il.enum(["user","assistant","system"]),parts:il.array(il.record(il.string(),il.unknown())),metadata:il.unknown().optional()}),pg4=il.object({windowSize:il.number().int().min(1).max(500).default(Ah),thread_id:il.string()}),Up0=il.object({messages:il.array(sg4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:pg4.optional(),tier:ZI0.optional(),agent:il.object({id:il.string()}).loose(),stream:il.boolean().optional(),temperature:il.number().default(0.5),thread_id:il.string().optional(),branch:il.string().nullish(),toolApprovalLevel:il.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:il.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:il.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:il.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function BGi(i){yp0.set(i.id,i)}function Pp0(i){return yp0.get(i)}var yp0;var uvu=O(()=>{yp0=new Map});function tvu(i,u,t){let f=Pp0(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var fvu=O(()=>{uvu()});class lvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return tvu(this.harnessId,i,this.ctx)}}var Gp0=O(()=>{fvu()});import{z as Ri}from"zod";import{existsSync as dT4}from"fs";import{query as Jp0}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as US6,tool as AS6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as yS6,InMemorySessionStore as PS6,HOOK_EVENTS as GS6,AbortError as IS6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as kS6,forkSession as jS6,getSessionInfo as XS6,getSessionMessages as JS6,deleteSession as KS6,renameSession as YS6,tagSession as WS6,listSubagents as SS6,getSubagentMessages as LS6,foldSessionSummary as QS6,importSessionToStore as HS6}from"@anthropic-ai/claude-agent-sdk";import{startup as nS6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bS6,tool as CS6}from"@anthropic-ai/claude-agent-sdk";import"zod";function uT4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>Ip0)return`${u.slice(0,Ip0)}...[truncated]`;return u}function tT4(i){return i.replace(/\s+/g,"")}function fT4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function YR(i,u){let t=i.trim(),f=tT4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function hvu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function lT4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=hvu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return YR(f,t)}function ET4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:iT4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=YR(E,c);return w?{content:w}:{warning:b8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=YR(E,c);return w?{content:w}:{warning:b8}}if(u){let E=YR(u,t);if(E)return{content:E}}return{warning:b8}}function cT4(i){if(!i||typeof i!=="object")return{warning:b8};let u=i.image,t=hvu(i.mimeType);if(typeof u==="string")return ET4(u,t);if(u&&typeof u==="object"){let f=lT4(u,t);return f?{content:f}:{warning:b8}}return{warning:b8}}function wT4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function $T4(i){let u=hvu(i.mediaType??i.mimeType);if(!u||!fT4(u))return{};let t=i.data;if(typeof t==="string"){let f=YR(u,t);return f?{content:f}:{warning:b8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=wT4(t);if(!f)return{warning:b8};let l=YR(u,f);return l?{content:l}:{warning:b8}}return{warning:b8}}function xp0(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
 `),Z=w(N?`Human: ${N}`:"");if(N)u.push(N);for(let B of _.content)if(B.type==="image"){let{content:F,warning:g}=cT4(B);if(F)$(Z,F);else if(g)t.push(g)}else if(B.type==="file"){let{content:F,warning:g}=$T4(B);if(F)$(Z,F);else if(g)t.push(g)}}break;case"assistant":{let N="";if(typeof _.content==="string")N=_.content;else{let B=_.content.filter((g)=>g.type==="text").map((g)=>g.text).join(`
 `);if(B)N=B;let F=_.content.filter((g)=>g.type==="tool-call");if(F.length>0){let g=F.map((T)=>`[Tool call: ${T.toolName}(${uT4(T.input)})]`).join(`
 `);N+=N?`