decocms 4.139.21 → 4.139.22

package/dist/server/cli.js

@@ -83165,7 +83165,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=Uq(d),_=D&&Uq(t)?Xau(t):t,N=D?Xau(d):Jau(d),Z=LVt(_,N);return Z===""||!Z.startsWith("..")&&!WVt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(t6i)},reconcile(){let d=Date.now();for(let D of l.all().map(t6i)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!Uq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(t6i)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!Uq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!J_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=J_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=Yau(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}KVt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=t6i(D),N=0,Z=null;if(Uq(_.sandboxPath)&&J_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=J_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=Yau(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var kbi=()=>{};function nVt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function Sau(i,u){if(process.platform==="win32")return;for(let t of nVt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var Lau=()=>{};import{existsSync as RVt,readdirSync as bVt}from"fs";import{rm as CVt}from"fs/promises";import{join as Qau}from"path";async function Hau(i,u={}){let t=u.detach??MVt,f=u.exists??RVt,l=u.readdir??((w)=>bVt(w)),E=u.rm??((w)=>CVt(w,{recursive:!0,force:!0})),c=Qau(i,"org");if(f(c))for(let w of l(c))t(Qau(c,w));await E(i)}var MVt=(i)=>Sau(i,process.platform==="darwin");var zau=O(()=>{Lau()});import{join as qVt}from"path";function nau(i){let u=i.purge??Hau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await F1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??qVt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var Rau=O(()=>{Z4();zau()});import{randomBytes as VVt}from"crypto";import{mkdir as rVt}from"fs/promises";import{createServer as mVt}from"net";import{join as eVt}from"path";function bau(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function Cau(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function Mau(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function aVt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function oVt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:aVt(i.repo?.cloneUrl)}}function qau(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??sVt,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>eVt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=oVt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,U;try{await rVt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),U=VVt(24).toString("hex");let[k,I]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${I} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:U,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(j){throw bau("the sandbox didn't come online in time",j)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,I,{repo:N.repo,workload:N.workload,operator:N.operator},U)}catch(j){throw bau(Cau(j)?"configuration timed out":"the sandbox rejected its configuration",j)}}catch(k){if((Cau(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:Mau(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:Mau(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let T=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${T} previewUrl=${A}`);let G={handle:N.handle,port:F,process:g,sandboxApiUrl:T,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:U,registryMetadata:Z};if(t.set(N.handle,G),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===G)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:T,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function sVt(){return new Promise((i,u)=>{let t=mVt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var Vau=()=>{};import{randomUUID as pVt}from"crypto";import{hostname as irt}from"os";async function rau(i){let u=irt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=IMu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=l6i({path:f6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=qau({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(j,C)=>c>0?`http://${j}.localhost:${c}`:`http://127.0.0.1:${C}`,spawnDaemon:async(j)=>{let C={DAEMON_BOOT_ID:pVt(),APP_ROOT:j.workdir,PROXY_PORT:String(j.port),DAEMON_TOKEN:j.daemonToken,OFFLOAD_ALLOWED_HOSTS:j.offloadAllowedHosts.join(","),...j.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(j.orgFsConfigJson){let L=await XMu(i.dataDir);if(L)C.ORGFS_CONFIG=j.orgFsConfigJson,C.ORGFS_RCLONE_PATH=L}let K=await t({workdir:j.workdir,env:C,daemonPort:j.port});return{port:j.port,kill:(L)=>K.kill(L),exited:K.exited.then(()=>{return})}},postConfig:async(j,C,K,L)=>{let r={port:C};if(K.workload)r.runtime=K.workload.runtime,r.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:r},fi=Uh(K.operator??null);if(fi)Q.operator=fi;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await U_(`http://127.0.0.1:${j}`,L,Q)},waitForHealth:async(j)=>{await fli(`http://127.0.0.1:${j}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await Fau({port:i.port,lookupSandboxPort:(j)=>w.proxyPort(j)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=KMu({provider:w}),v=async()=>{let j=await g_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!j)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return j.accessToken},d=await kau(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await xbi(),N=Iau(_,{onChange:(j)=>{console.log(`[link-daemon] capabilities detected: +${j.join(",")} (now: ${_.join(",")})`)}}),Z=Oni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let U=await cau(g);console.log("[link-daemon] active transport=tunnel");let T,A=new Promise((j)=>{T=j}),G=!1,k=async()=>{if(G)return;G=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await U.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),T(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},U.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!G)console.error("Cluster connection closed permanently; exiting."),k()});let I=nau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(c){throw E(),c}}var mau=O(()=>{$ni();CM();xMu();JMu();YMu();Zni();wau();gau();xau();jau();bM();kbi();Rau();Vau()});function jbi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as urt}from"net";async function frt(i){for(let u of trt)if(await Xbi(i,u))return u;return null}async function eau(i,{intervalMs:u=1000,sleepFn:t=P0}={}){for(;;){let f=await frt(i);if(f)return f;await t(u)}}function Xbi(i,u){return new Promise((t)=>{let f=urt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var trt;var Jbi=O(()=>{Z4();trt=["localhost","127.0.0.1","0.0.0.0"]});function aau(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function lrt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function oau(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${lrt(i,u)}`].join(`
-`)}var Kbi;var sau=O(()=>{Kbi=class Kbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var TL;var E6i=O(()=>{TL={name:"decocms",version:"4.139.21",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Tq={};Gi(Tq,{printBanner:()=>wrt,bannerLines:()=>pau,BANNER_LINES:()=>c6i,BANNER_GRADIENT:()=>w6i});function crt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function pau(i){let u=c6i.map((t,f)=>{let[l,E,c]=crt(w6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function wrt(i){console.log("");for(let u of pau(i))console.log(u);console.log("")}var c6i,w6i;var AL=O(()=>{c6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],w6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as $rt,Text as iou}from"ink";import{jsx as hrt,jsxs as uou}from"react/jsx-runtime";function $6i({version:i}){return uou($rt,{flexDirection:"column",marginTop:1,children:[c6i.map((u,t)=>hrt(iou,{color:w6i[t],children:u},t)),uou(iou,{dimColor:!0,children:[" v",i]})]})}var Ybi=O(()=>{AL()});function tou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function yL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function fou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function lou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Qbi={};Gi(Qbi,{subscribeLinkState:()=>Wbi,setSelectedHandle:()=>Sbi,setRemoving:()=>d6i,setPersistedSandboxes:()=>grt,setPendingConfirm:()=>yq,setMachine:()=>Ort,setLogPath:()=>Brt,setLinkActions:()=>Frt,setIngress:()=>Nrt,setDaemonError:()=>Zrt,setClusterUrl:()=>_rt,setCluster:()=>Drt,setActionError:()=>v6i,resetLinkStateForTests:()=>Trt,removeSandboxRow:()=>Lbi,pushSandboxEvent:()=>Urt,getLinkState:()=>Aq,applySandboxEvent:()=>Eou});function drt(i){return i==="spawning"||i==="ready"||i==="failed"}function Eou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function cou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:vrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of h6i)i()}function Aq(){return lf}function Wbi(i){return h6i.add(i),()=>h6i.delete(i)}function Drt(i){lf={...lf,cluster:i},b3()}function _rt(i){lf={...lf,clusterUrl:i},b3()}function Nrt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function Ort(i){lf={...lf,machine:i},b3()}function Zrt(i){lf={...lf,daemonError:i},b3()}function Brt(i){lf={...lf,logPath:i},b3()}function Sbi(i){lf={...lf,selectedHandle:i},b3()}function yq(i){lf={...lf,pendingConfirm:i},b3()}function v6i(i){lf={...lf,actionError:i},b3()}function d6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function Frt(i){lf={...lf,actions:i},b3()}function Lbi(i){let u=yL(lf.sandboxes),t=lou(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function grt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(drt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function Urt(i){lf={...lf,sandboxes:Eou(lf.sandboxes,i)},b3()}function Trt(){lf=cou(),h6i.clear()}var vrt=20,lf,h6i;var Pq=O(()=>{lf=cou(),h6i=new Set});import{spawn as Art}from"child_process";function yrt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function wou(i,u=process.platform){let t=yrt(u);try{Art(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var $ou=()=>{};function hou(i,u={}){let t=u.openUrl??wou,f=Aq(),l=yL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Sbi(fou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);v6i(null),yq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(yq(null),w===null||!c)return;d6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Lbi(w.handle);else d6i(w.handle,!1),v6i($.error)});return}case"confirmNo":yq(null);return;case"quit":if(c)c.quit();return}}var vou=O(()=>{Pq();$ou()});function dou(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Dou={};Gi(Dou,{LinkApp:()=>xrt});import{Box as C1,Text as vl,useInput as Prt}from"ink";import{useSyncExternalStore as Grt}from"react";import{jsx as jf,jsxs as Jh}from"react/jsx-runtime";function Irt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function xrt(){let i=Grt(Wbi,Aq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=yL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return Prt((l,E)=>{let c=dou(l,E,i.pendingConfirm!==null);if(c!==null)hou(c)}),Jh(C1,{flexDirection:"column",children:[jf($6i,{version:TL.version}),jf(C1,{marginBottom:1,children:jf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),jf(C1,{children:i.cluster==="linked"?Jh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Jh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Jh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),jf(C1,{children:i.ingressUrl?Jh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):jf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),jf(C1,{marginBottom:1,children:jf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?jf(vl,{dimColor:!0,children:"No previews running yet."}):Jh(C1,{flexDirection:"column",children:[Jh(C1,{children:[jf(C1,{width:2,flexShrink:0}),jf(C1,{width:PL.project,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),jf(C1,{width:PL.branch,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),jf(C1,{width:PL.status,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),jf(C1,{flexGrow:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=Irt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Jh(C1,{children:[jf(C1,{width:2,flexShrink:0,children:jf(vl,{color:"cyan",children:c?"\u203A":" "})}),jf(C1,{width:PL.project,flexShrink:0,marginRight:1,children:jf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),jf(C1,{width:PL.branch,flexShrink:0,marginRight:1,children:jf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),jf(C1,{width:PL.status,flexShrink:0,marginRight:1,children:jf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),jf(C1,{flexGrow:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?jf(C1,{marginTop:1,children:Jh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?jf(C1,{marginTop:1,children:Jh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?jf(C1,{marginTop:1,children:jf(vl,{color:"yellow",children:tou(i.pendingConfirm)})}):null,i.actionError?jf(C1,{marginTop:1,children:Jh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,jf(C1,{marginTop:1,children:jf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var PL;var _ou=O(()=>{E6i();Ybi();vou();Pq();PL={project:18,branch:22,status:14}});var Nou={};Gi(Nou,{runLinkCommand:()=>Srt});import{closeSync as krt,mkdirSync as jrt,openSync as Xrt,writeSync as Jrt}from"fs";import{homedir as Krt}from"os";import{join as Hbi}from"path";function Yrt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{Jrt(u,`${jbi(l)}
+`)}var Kbi;var sau=O(()=>{Kbi=class Kbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var TL;var E6i=O(()=>{TL={name:"decocms",version:"4.139.22",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Tq={};Gi(Tq,{printBanner:()=>wrt,bannerLines:()=>pau,BANNER_LINES:()=>c6i,BANNER_GRADIENT:()=>w6i});function crt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function pau(i){let u=c6i.map((t,f)=>{let[l,E,c]=crt(w6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function wrt(i){console.log("");for(let u of pau(i))console.log(u);console.log("")}var c6i,w6i;var AL=O(()=>{c6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],w6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as $rt,Text as iou}from"ink";import{jsx as hrt,jsxs as uou}from"react/jsx-runtime";function $6i({version:i}){return uou($rt,{flexDirection:"column",marginTop:1,children:[c6i.map((u,t)=>hrt(iou,{color:w6i[t],children:u},t)),uou(iou,{dimColor:!0,children:[" v",i]})]})}var Ybi=O(()=>{AL()});function tou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function yL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function fou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function lou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Qbi={};Gi(Qbi,{subscribeLinkState:()=>Wbi,setSelectedHandle:()=>Sbi,setRemoving:()=>d6i,setPersistedSandboxes:()=>grt,setPendingConfirm:()=>yq,setMachine:()=>Ort,setLogPath:()=>Brt,setLinkActions:()=>Frt,setIngress:()=>Nrt,setDaemonError:()=>Zrt,setClusterUrl:()=>_rt,setCluster:()=>Drt,setActionError:()=>v6i,resetLinkStateForTests:()=>Trt,removeSandboxRow:()=>Lbi,pushSandboxEvent:()=>Urt,getLinkState:()=>Aq,applySandboxEvent:()=>Eou});function drt(i){return i==="spawning"||i==="ready"||i==="failed"}function Eou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function cou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:vrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of h6i)i()}function Aq(){return lf}function Wbi(i){return h6i.add(i),()=>h6i.delete(i)}function Drt(i){lf={...lf,cluster:i},b3()}function _rt(i){lf={...lf,clusterUrl:i},b3()}function Nrt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function Ort(i){lf={...lf,machine:i},b3()}function Zrt(i){lf={...lf,daemonError:i},b3()}function Brt(i){lf={...lf,logPath:i},b3()}function Sbi(i){lf={...lf,selectedHandle:i},b3()}function yq(i){lf={...lf,pendingConfirm:i},b3()}function v6i(i){lf={...lf,actionError:i},b3()}function d6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function Frt(i){lf={...lf,actions:i},b3()}function Lbi(i){let u=yL(lf.sandboxes),t=lou(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function grt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(drt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function Urt(i){lf={...lf,sandboxes:Eou(lf.sandboxes,i)},b3()}function Trt(){lf=cou(),h6i.clear()}var vrt=20,lf,h6i;var Pq=O(()=>{lf=cou(),h6i=new Set});import{spawn as Art}from"child_process";function yrt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function wou(i,u=process.platform){let t=yrt(u);try{Art(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var $ou=()=>{};function hou(i,u={}){let t=u.openUrl??wou,f=Aq(),l=yL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Sbi(fou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);v6i(null),yq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(yq(null),w===null||!c)return;d6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Lbi(w.handle);else d6i(w.handle,!1),v6i($.error)});return}case"confirmNo":yq(null);return;case"quit":if(c)c.quit();return}}var vou=O(()=>{Pq();$ou()});function dou(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Dou={};Gi(Dou,{LinkApp:()=>xrt});import{Box as C1,Text as vl,useInput as Prt}from"ink";import{useSyncExternalStore as Grt}from"react";import{jsx as jf,jsxs as Jh}from"react/jsx-runtime";function Irt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function xrt(){let i=Grt(Wbi,Aq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=yL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return Prt((l,E)=>{let c=dou(l,E,i.pendingConfirm!==null);if(c!==null)hou(c)}),Jh(C1,{flexDirection:"column",children:[jf($6i,{version:TL.version}),jf(C1,{marginBottom:1,children:jf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),jf(C1,{children:i.cluster==="linked"?Jh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Jh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Jh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),jf(C1,{children:i.ingressUrl?Jh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):jf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),jf(C1,{marginBottom:1,children:jf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?jf(vl,{dimColor:!0,children:"No previews running yet."}):Jh(C1,{flexDirection:"column",children:[Jh(C1,{children:[jf(C1,{width:2,flexShrink:0}),jf(C1,{width:PL.project,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),jf(C1,{width:PL.branch,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),jf(C1,{width:PL.status,flexShrink:0,marginRight:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),jf(C1,{flexGrow:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=Irt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Jh(C1,{children:[jf(C1,{width:2,flexShrink:0,children:jf(vl,{color:"cyan",children:c?"\u203A":" "})}),jf(C1,{width:PL.project,flexShrink:0,marginRight:1,children:jf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),jf(C1,{width:PL.branch,flexShrink:0,marginRight:1,children:jf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),jf(C1,{width:PL.status,flexShrink:0,marginRight:1,children:jf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),jf(C1,{flexGrow:1,children:jf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?jf(C1,{marginTop:1,children:Jh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?jf(C1,{marginTop:1,children:Jh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?jf(C1,{marginTop:1,children:jf(vl,{color:"yellow",children:tou(i.pendingConfirm)})}):null,i.actionError?jf(C1,{marginTop:1,children:Jh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,jf(C1,{marginTop:1,children:jf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var PL;var _ou=O(()=>{E6i();Ybi();vou();Pq();PL={project:18,branch:22,status:14}});var Nou={};Gi(Nou,{runLinkCommand:()=>Srt});import{closeSync as krt,mkdirSync as jrt,openSync as Xrt,writeSync as Jrt}from"fs";import{homedir as Krt}from"os";import{join as Hbi}from"path";function Yrt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{Jrt(u,`${jbi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(jbi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function Wrt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function Srt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??Hbi(Krt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await Xbi(u,"127.0.0.1"))throw new Kbi(u);let $=Hbi(t,"sandboxes");c=l6i({path:f6i(t),managedSandboxRoot:$});let h=await p1i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await Wrt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (_ou(),Dou)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:U,setDaemonError:T,setIngress:A,setLogPath:G,setMachine:k,setPersistedSandboxes:I}=await Promise.resolve().then(() => (Pq(),Qbi));jrt(t,{recursive:!0});let j=Hbi(t,"link.log");E=Xrt(j,"w"),G(j),I(v),U(f),g("connecting"),d={onEvent:(C)=>F(C),onIngress:(C)=>A(C,`http://127.0.0.1:${C}`),onCluster:(C)=>g(C),onMachine:(C)=>k(C)},l=Yrt(T,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (AL(),Tq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await rau({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (Pq(),Qbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error(aau($)?oau(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{krt(E)}catch{}w()}}var Oou=O(()=>{wni();mau();Jbi();sau();kbi()});var Mbi={};Gi(Mbi,{resolveDevLinkClusterUrl:()=>zrt,populateDevLinkToxiProxy:()=>Tou,isDevLinkToxiProxyEnabled:()=>Hrt,ensureDevLinkToxiProxy:()=>Mrt,buildDevLinkToxiProxyConfig:()=>gou,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>Bou,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>Fou});function Hrt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function zbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function gou(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=zbi(i.apiPort,"apiPort"),f=zbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=zbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:Bou,proxyName:Fou,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function zrt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function nbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function Cbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function Uou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return Uou(i.cause)}async function Rbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${Cbi(l)}`,{cause:l})}}async function Tou(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await Rbi(u,"reset",t,{method:"POST"});await nbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await Rbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await nbi(E,"populate",l)}async function nrt(i,u){let t=`${i.apiUrl}/version`;try{await F1(async()=>{let f=await Rbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(Qrt)});await nbi(f,"readiness check",t)},{maxAttempts:Lrt,minTimeout:Zou,maxTimeout:Zou,multiplier:1,jitter:0,isRetriable:(f)=>!Uou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${Cbi(l)}`,{cause:l})}}async function Rrt(i){if(i===null)return"";return await new Response(i).text()}async function bbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${Cbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,Rrt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function brt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await bbi(["rm","-f",t],{ignoreFailure:!0}),await bbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function Crt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await bbi(["rm","-f",t],{ignoreFailure:!0})}async function Mrt(i){let u=gou(i),t=i.startDaemon??brt,f=i.stopDaemon??(i.startDaemon===void 0?Crt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await nrt(u,l),await Tou(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var Bou="ToxiProxy",Fou="dev_link_studio",Lrt=20,Zou=100,Qrt=100;var qbi=O(()=>{Z4()});var Aou={};Gi(Aou,{migrateBetterAuth:()=>Vbi});import{getMigrations as qrt}from"better-auth/db";import{sso as Vrt}from"@better-auth/sso";import{organization as rrt}from"@decocms/better-auth/plugins";import{admin as mrt,apiKey as ert,jwt as art,magicLink as ort,mcp as srt,openAPI as prt}from"better-auth/plugins";import{emailOTP as imt}from"better-auth/plugins/email-otp";async function Vbi(i){let t={database:LM(i||O_()),plugins:[rrt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),mrt(),ert(),art(),prt(),srt({loginPage:"/login"}),Vrt(),ort({sendMagicLink:async()=>{}}),imt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await qrt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var rbi=O(()=>{b6()});var mbi={};Gi(mbi,{up:()=>umt,down:()=>tmt});import{sql as Bd}from"kysely";async function umt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Bd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function tmt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var you=()=>{};var ebi={};Gi(ebi,{up:()=>fmt,down:()=>lmt});import{sql as Pou}from"kysely";async function fmt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Pou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Pou`CURRENT_TIMESTAMP`)).execute()}async function lmt(i){await i.schema.dropTable("organization_settings").execute()}var Gou=()=>{};var abi={};Gi(abi,{up:()=>Emt,down:()=>cmt});async function Emt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function cmt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var obi={};Gi(obi,{up:()=>wmt,down:()=>$mt});async function wmt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function $mt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var sbi={};Gi(sbi,{up:()=>hmt,down:()=>vmt});async function hmt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function vmt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var pbi={};Gi(pbi,{up:()=>Dmt,down:()=>_mt});import{sql as dmt}from"kysely";async function Dmt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",dmt`text`).execute()}async function _mt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Iou=()=>{};var iCi={};Gi(iCi,{up:()=>Nmt,down:()=>Omt});async function Nmt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function Omt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var uCi={};Gi(uCi,{up:()=>Zmt,down:()=>Bmt});import{sql as Gq}from"kysely";async function Zmt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Gq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(Gq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function Bmt(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var xou=()=>{};var tCi={};Gi(tCi,{up:()=>gmt,down:()=>Umt});import{sql as Fmt}from"kysely";async function gmt(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function Umt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(Fmt`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var kou=()=>{};var fCi={};Gi(fCi,{up:()=>Tmt,down:()=>Amt});import{sql as D6i}from"kysely";async function Tmt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(D6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(D6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(D6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await D6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function Amt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var jou=()=>{};var lCi={};Gi(lCi,{up:()=>ymt,down:()=>Pmt});async function ymt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function Pmt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var ECi={};Gi(ECi,{up:()=>Gmt,down:()=>Imt});import{sql as _6i}from"kysely";async function Gmt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await _6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -85707,7 +85707,7 @@ data:
 </head>`+i.slice(v)}return`<head>
 `+f+`
 </head>
-`+i}function CTi(i){if(!i||i.length===0)return[];return i.filter((u)=>oaf.test(u))}function saf(i){if(i.csp)return i.csp;let u=i.resourceCsp;if(!u)return RS0;let t=CTi(u.resourceDomains),f=CTi(u.connectDomains),l=CTi(u.frameDomains),E=CTi(u.baseUriDomains),c=t.length>0,w=f.length>0,$=l.length>0,h=E.length>0;if(!c&&!w&&!$&&!h)return RS0;let v=t.join(" ");return["default-src 'none'",c?`script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' ${v}`:"script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",c?`style-src 'unsafe-inline' ${v}`:"style-src 'unsafe-inline'",c?`img-src * data: blob: ${v}`:"img-src * data: blob:",c?`media-src * data: blob: ${v}`:"media-src * data: blob:",c?`font-src data: ${v}`:"font-src data:",w?`connect-src ${f.join(" ")}`:"connect-src 'none'",$?`frame-src ${l.join(" ")}`:"frame-src 'none'","worker-src blob:","form-action 'none'",h?`base-uri ${E.join(" ")}`:"base-uri 'none'"].join("; ")}var RS0,oaf;var CS0=O(()=>{RS0=["default-src 'none'","script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'","style-src 'unsafe-inline'","img-src * data: blob:","media-src * data: blob:","font-src data:","connect-src 'none'","frame-src 'none'","worker-src blob:","form-action 'none'","base-uri 'none'"].join("; ");oaf=/^https?:\/\/(\*\.)?[a-zA-Z0-9._-]+(:\d+)?\/?$/});function paf(i){let u=i.lastFailureAt-i.firstFailureAt;return i.count>=Q10&&u>=H10}class Ocu{options;kv=null;codec=C3i();constructor(i){this.options=i}async init(){let i=this.options.getJetStream();if(!i)return;this.kv=await new qS0.Kvm(i).create(iof,{storage:MS0.StorageType.Memory,ttl:VS0.nanos(z10)})}async recordFailure(i){if(!this.kv)return Ncu;let u=Date.now();for(let t=0;t<uof;t++)try{let f=await this.kv.get(i);if(!(f&&f.operation!=="DEL"&&f.operation!=="PURGE"&&f.value?.length)){let w={count:1,firstFailureAt:u,lastFailureAt:u};return await this.kv.create(i,this.codec.encode(w)),{count:w.count,shouldDisable:!1}}let E=this.codec.decode(f.value),c={count:E.count+1,firstFailureAt:E.firstFailureAt,lastFailureAt:u};return await this.kv.update(i,this.codec.encode(c),f.revision),{count:c.count,shouldDisable:paf(c)}}catch{}return Ncu}async recordSuccess(i){if(!this.kv)return;try{await this.kv.delete(i)}catch{}}teardown(){this.kv=null}}class $s{async recordFailure(){return Ncu}async recordSuccess(){}teardown(){}}function Zcu(i){rS0=i??new $s}function Bcu(){return rS0}var MS0,qS0,VS0,Ncu,iof="DECOCMS_CONN_CIRCUIT",uof=5,rS0;var Fcu=O(()=>{MS0=X(j_(),1),qS0=X(Joi(),1),VS0=X(EB(),1),Ncu={count:0,shouldDisable:!1};rS0=new $s});function mS0(i){if(!i)return{decision:"skip"};if(i.startsWith("notifications/"))return{decision:"skip"};if(fof.has(i))return{decision:"skip"};let u=tof[i];if(u)return{decision:"skip-if-list-cached",listType:u};return{decision:"probe"}}async function eS0(i){if(i.method!=="POST")return;let u=i.headers.get("content-length");if(u&&Number(u)>lof)return;try{let t=await i.clone().json(),l=(Array.isArray(t)?t[0]:t)?.method;return typeof l==="string"?l:void 0}catch{return}}var tof,fof,lof=64000;var aS0=O(()=>{tof={"tools/list":"tools","resources/list":"resources","prompts/list":"prompts"},fof=new Set(["ping"])});function gcu(i){let u=Object.values(i),[t]=u;if(!t)return null;return u.find((f)=>f.sandboxProviderKind!=="user-desktop")??t}async function wof(i){if(oS0.has(i))return!0;let u=Date.now();if(u-(sS0.get(i)??0)<cof)return!1;sS0.set(i,u);try{let t=await fetch(i,{method:"POST",headers:{"content-type":"application/json",accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"studio-dev-probe",version:"1"}}}),signal:AbortSignal.timeout(4000)}),f=t.ok?await t.text():"",l=/"protocolVersion"|"serverInfo"/.test(f);if(l)oS0.add(i);return l}catch{return!1}}async function _Y(i,u,t,f){let l=i.organization?.id;if(!l)return null;let E=await i.storage.virtualMcps.findById(u);if(!E||E.organization_id!==l)return null;let c=E.metadata??{},w=o1(c)[t];if(!w)return null;let $=f?$of(w,f):hof(w);if(!$?.entry.previewUrl)return null;let h=await vof(i,c,l,t),v=$.entry.previewUrl.replace(/\/+$/,""),d=h?`${v}/api/mcp?token=${encodeURIComponent(h)}`:`${v}/api/mcp`;if(!await wof(d))return null;return{id:vu0(u),organization_id:l,title:`${E.title} (dev)`,description:"Ephemeral sandbox dev-server connection",icon:E.icon??null,app_name:E.title??null,app_id:null,slug:null,connection_type:"HTTP",connection_url:d,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:{isDevConnection:!0,virtualMcpId:u,branch:$.branch},tools:null,bindings:null,status:"active",created_at:new Date().toISOString(),updated_at:new Date().toISOString(),created_by:"system"}}function $of(i,u){let t=gcu(nh(i[u]));return t?{branch:u,entry:t}:null}function hof(i){let u=null;for(let[t,f]of Object.entries(i)){let l=gcu(nh(f));if(!l)continue;if(!u||(l.createdAt??0)>(u.entry.createdAt??0))u={branch:t,entry:l}}return u}async function vof(i,u,t,f){let l=ETi(u)?.find((E)=>E.key===Eof);if(!l)return null;if(l.kind==="literal")return l.value||null;try{let{value:E}=await i.storage.secrets.resolveById(l.secretId,t,f);return E||null}catch(E){if(E instanceof G5||E instanceof a9)return null;throw E}}var Eof="MCP_AUTH_TOKEN",oS0,sS0,cof=1e4;var MTi=O(()=>{nt();am();Gn();G$();oS0=new Set,sS0=new Map});import{SpanStatusCode as qTi}from"@opentelemetry/api";async function VTi(i,u){let t=i.get("studioContext");try{let f=t.organization?.id??null,l=u?u:f?TB(f):null;if(!l)return i.json({error:"Agent ID or organization ID is required"},400);if(u&&!f)return i.json({error:"Organization context is required"},400);let E=await t.tracer.startActiveSpan("studio.virtual_mcp.lookup",{attributes:{"virtual_mcp.id":l}},async(_)=>{try{let N=await t.storage.virtualMcps.findById(l,f??void 0);return _.setStatus({code:qTi.OK}),N}catch(N){throw _.setStatus({code:qTi.ERROR,message:N.message}),_.recordException(N),N}finally{_.end()}});if(!E)return i.json({error:"Agent not found"},404);if(f&&E.organization_id!==f)return i.json({error:"Agent not found"},404);if(E.status!=="active")return i.json({error:`Agent is inactive: ${E.id??"Decopilot"}`},503);if(t.organization?.id&&E.organization_id!==t.organization.id)return i.json({error:"Forbidden: Agent does not belong to your organization"},403);t.connectionId=E.id??void 0;let c=await t.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",E.organization_id).executeTakeFirst();if(c)t.organization={id:c.id,slug:c.slug,name:c.name};let w=Qu(t),$=null;if(E.id&&w&&o1(E.metadata)[w])$=await _Y(t,E.id,w,i.req.query("branch")??void 0).catch(()=>null);let h=await t.tracer.startActiveSpan("studio.virtual_mcp.create_client",{attributes:{"virtual_mcp.id":E.id??"decopilot"}},async(_)=>{try{let N=await W2(E,t,"passthrough",!1,{includeSkillsCatalog:!0,additionalConnections:$?[$]:[]});return _.setStatus({code:qTi.OK}),N}catch(N){throw _.setStatus({code:qTi.ERROR,message:N.message}),_.recordException(N),N}finally{_.end()}}),v={name:E.id??"Decopilot",version:"1.0.0",title:E.title??void 0,description:E.description??void 0,icons:E.icon?[{src:E.icon}]:void 0},d=VB(h,v,{capabilities:{tools:{},resources:{},prompts:{}},instructions:h.getInstructions(),toolCallTimeoutMs:$Q}),D=new Y$({enableJsonResponse:i.req.header("Accept")?.includes("application/json")??!1});return await d.connect(D),await J8(d,D,i.req.raw,`virtual-mcp:${E.id??"decopilot"}`,{onClose:()=>h.close()})}catch(f){let l=f;return console.error("[virtual-mcp] Error handling virtual MCP request:",l),i.json({error:"Internal server error",message:l.message},500)}}var rTi=()=>{let i=new Yu;return i.all("/gateway/:virtualMcpId?",async(u)=>{let t=u.req.param("virtualMcpId")||u.req.header("x-virtual-mcp-id");return VTi(u,t)}),i.all("/virtual-mcp/:virtualMcpId?",async(u)=>{let t=u.req.param("virtualMcpId")||u.req.header("x-virtual-mcp-id");return VTi(u,t)}),i};var mTi=O(()=>{h3();nt();Qn();Ef();Hz();MTi();G$();ws()});import{SpanStatusCode as eTi}from"@opentelemetry/api";var pS0=(i,u)=>{if(i instanceof rH)return u.header("Retry-After",String(Math.ceil(i.cooldownRemainingMs/1000))),u.json({error:i.message},503);if(i.message.includes("not found"))return u.json({error:i.message},404);if(i.message.includes("does not belong to the active organization"))return u.json({error:"Connection not found"},404);if(i.message.includes("inactive"))return u.json({error:i.message},503);return u.json({error:"Internal server error",message:i.message},500)},aTi=()=>{let i=new Yu;return i.all("/",async(u)=>{return VTi(u,void 0)}),i.get("/:connectionId/ui-resource",async(u)=>{let t=u.get("studioContext"),f=u.req.param("connectionId"),l=u.req.query("uri");if(!l)return u.json({error:"uri query param is required"},400);if(!t.organization?.id)return u.json({error:"Organization context is required"},403);let E=lri(f),c;if(E){let _=Qu(t);if(!_)return u.json({error:"Authentication required"},401);if(c=await _Y(t,E,_,u.req.query("branch")??void 0),!c)return u.json({error:"Dev server not running"},503)}else if(c=await t.storage.connections.findById(f,t.organization.id),!c||c.organization_id!==t.organization.id)return u.json({error:"Connection not found"},404);let w=r9(c,t,!1,Dl()??void 0),$,h;try{let N=(await w.readResource({uri:l})).contents?.[0];$=N?.text,h=N?._meta?.ui?.csp}catch(_){return u.json({error:_.message},502)}finally{await w.close().catch(()=>{})}if(typeof $!=="string")return u.json({error:"Resource has no text content"},404);let v=bS0($,{resourceCsp:h}),d=`"${Bun.hash(v).toString(36)}"`,D="private, no-cache";if(u.req.header("if-none-match")===d)return new Response(null,{status:304,headers:{ETag:d,"Cache-Control":D}});return new Response(v,{headers:{"Content-Type":"text/html; charset=utf-8",ETag:d,"Cache-Control":D}})}),i.all("/:connectionId",async(u)=>{let t=u.req.param("connectionId"),f=u.get("studioContext");if(t.endsWith("_self")){let E=t.slice(0,-5);if(!f.organization||f.organization.id!==E)return u.json({error:"Connection not found"},404);let c=await Hn(f),w=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await c.connect(w),NY.run(f,()=>J8(c,w,u.req.raw,`mcp:self:${t}`))}let l=lri(t);if(l){if(!f.organization?.id)return u.json({error:"Organization context is required"},403);let E=Qu(f);if(!E)return u.json({error:"Authentication required"},401);let c=await _Y(f,l,E,u.req.query("branch")??void 0);if(!c)return u.json({error:"Dev server not running"},503);let w=s5i(c,f,!1),$=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await w.connect($),J8(w,$,u.req.raw,`mcp:dev:${t}`)}try{try{if(!f.organization?.id)return u.json({error:"Organization context is required"},403);let E=await f.tracer.startActiveSpan("studio.connection.lookup",{attributes:{"connection.id":t}},async(N)=>{_5(u,"mcp.find_connection");try{let Z=await f.storage.connections.findById(t,f.organization.id);return N.setStatus({code:eTi.OK}),Z}catch(Z){throw N.setStatus({code:eTi.ERROR,message:Z.message}),N.recordException(Z),Z}finally{t$(u,"mcp.find_connection"),N.end()}});if(!E)throw Error("Connection not found");if(E.organization_id!==f.organization.id)throw Error("Connection does not belong to the active organization");let c=!1;if(E.status!=="active"){let N=Date.now()-new Date(E.updated_at).getTime();if(E.status==="error"&&!!E.connection_url&&N>=Lmi)c=!0;else{if(E.status==="error"&&E.connection_url){let B=Lmi-N;u.header("Retry-After",String(Math.ceil(B/1000)))}throw Error(`Connection inactive: ${E.status}`)}}let w=await eS0(u.req.raw),{decision:$,listType:h}=mS0(w),v=$==="probe";if($==="skip-if-list-cached"&&h){let N=Dl();v=N?await N.get(h,t)===null:!0}if(c)v=!0;if(E.connection_url&&v)$$i(t),await f.tracer.startActiveSpan("studio.connection.handshake",{attributes:{"connection.id":t,"connection.url":E.connection_url}},async(N)=>{_5(u,"mcp.client_handshake");try{if(await F6(E,f,!1),h$i(t),Bcu().recordSuccess(t),c)await f.storage.connections.update(t,{status:"active"}),console.info("[proxy] auto-recovered connection after successful re-probe",{connectionId:t,org:f.organization?.slug});N.setStatus({code:eTi.OK})}catch(Z){throw N.setStatus({code:eTi.ERROR,message:Z.message}),N.recordException(Z),Z}finally{t$(u,"mcp.client_handshake"),N.end()}});_5(u,"mcp.create_server");let d=s5i(E,f,!1);t$(u,"mcp.create_server");let D=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});_5(u,"mcp.server_connect"),await d.connect(D),t$(u,"mcp.server_connect"),_5(u,"mcp.handle_request");let _=await J8(d,D,u.req.raw,`mcp:${t}`);return t$(u,"mcp.handle_request"),_}catch(E){if(E instanceof rH)throw E;let c=await f.storage.connections.findById(t,f.organization?.id);if(c?.connection_url){let w=await Dtu({error:E,reqUrl:new URL(u.req.raw.url),connectionId:t,connectionUrl:c.connection_url,headers:{},orgSlug:f.organization?.slug});if(w)return w;v$i(t);let{shouldDisable:$}=await Bcu().recordFailure(t);if($&&c.status==="active")await f.storage.connections.update(t,{status:"error"}),console.warn("[proxy] auto-disabled connection after sustained failures",{connectionId:t,org:f.organization?.slug,error:E.message})}throw E}}catch(E){return pS0(E,u)}}),i.all("/:connectionId/call-tool/:toolName",async(u)=>{let t=u.req.param("connectionId"),f=u.req.param("toolName"),l=u.get("studioContext");try{let E=await l.storage.connections.findById(t,l.organization?.id);if(!E)return u.json({error:"Connection not found"},404);let w=await(await F6(E,l,!1)).callTool({name:f,arguments:await u.req.json()});if(w.isError)return new Response(JSON.stringify(w.content),{headers:{"Content-Type":"application/json"},status:500});return new Response(JSON.stringify(w.structuredContent??w.content),{headers:{"Content-Type":"application/json"}})}catch(E){let c=await l.storage.connections.findById(t,l.organization?.id);if(c?.connection_url){let w=await Dtu({error:E,reqUrl:new URL(u.req.raw.url),connectionId:t,connectionUrl:c.connection_url,headers:{},orgSlug:l.organization?.slug});if(w)return w}return pS0(E,u)}}),i};var oTi=O(()=>{gN();Qn();Ef();Iri();$g();ws();Ia();E$();Vm();CS0();bpi();Fcu();aS0();mTi();MTi();nt();epi()});async function vO(i,u,t,f){if(u.type!=="event"||!u.connection_id)return{success:!0};let l=await i.storage.connections.findById(u.connection_id);if(!l)return{success:!0};let E=i.organization?.id,c=i.organization?.slug;try{let w=await F6(l,i,!0),$=Ktu.forClient(mpi(w)),h,v,d;if(t&&f&&E){let F=await f.generateTokenPair();v=F.plaintext,d=F.hash,h=c?`${i.baseUrl}/api/${c}/trigger-callback`:`${i.baseUrl}/api/trigger-callback`}let D=5000,_=!1,N=new Promise((F,g)=>setTimeout(()=>{_=!0,g(Error("TRIGGER_CONFIGURE timeout"))},D)),Z;try{Z=await Promise.race([$.TRIGGER_CONFIGURE({type:u.event_type,params:JSON.parse(u.params??"{}"),enabled:t,callbackUrl:h,callbackToken:v}),N])}catch(F){if(_&&t&&f&&E&&d)await f.persistTokenHash(E,u.connection_id,d);return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE threw on connection=${u.connection_id} type=${u.event_type}:`,F),{success:!1,error:String(F)}}let B=Z;if(!B||B.success!==!0)return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE did not return success=true on connection=${u.connection_id} type=${u.event_type}. Raw payload:`,JSON.stringify(Z)),{success:!1,error:`TRIGGER_CONFIGURE did not return success=true (got ${JSON.stringify(Z)})`};try{if(t&&f&&E&&d)await f.persistTokenHash(E,u.connection_id,d);if(!t&&f&&E)await f.deleteByConnection(u.connection_id,E)}catch(F){console.error("[configureTriggerOnMcp] Token persistence failed after successful TRIGGER_CONFIGURE:",F)}return{success:!0}}catch(w){return{success:!1,error:String(w)}}}var hs=O(()=>{gN();oTi();Ytu()});import{z as l1}from"zod";var Ucu;var iL0=O(()=>{DY();fu();U$();hs();Ucu=p({name:"AUTOMATION_UPDATE",description:"Update an automation's config. Toggling active state reconfigures event triggers on MCPs.",annotations:{title:"Update Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l1.object({id:l1.string(),name:l1.string().min(1).max(255).optional(),active:l1.boolean().optional(),messages:l1.union([l1.string(),l1.array(l1.looseObject({id:l1.string().optional(),role:l1.enum(["user","assistant","system"]),parts:l1.array(l1.record(l1.string(),l1.unknown())),metadata:l1.unknown().optional()}))]).optional(),models:l1.object({tier:O8,modelId:l1.string().optional(),credentialId:l1.string().optional()}).loose().optional(),tools:l1.array(l1.string()).nullable().optional(),maxAgentSteps:l1.number().int().min(1).max(100).nullable().optional(),temperature:l1.number().optional()}),outputSchema:l1.object({id:l1.string(),name:l1.string(),active:l1.boolean(),updated_at:l1.string()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findById(i.id,t.id);if(!f)throw Error("Automation not found");let l={};if(i.name!==void 0)l.name=i.name;if(i.active!==void 0)l.active=i.active;if(i.messages!==void 0){let c=QTi(i.messages);l.messages=JSON.stringify(c)}if(i.models!==void 0)l.models=JSON.stringify(i.models);if(i.tools!==void 0)l.tools=i.tools===null?null:JSON.stringify(i.tools);if(i.temperature!==void 0)l.temperature=i.temperature;if(i.maxAgentSteps!==void 0)l.max_agent_steps=i.maxAgentSteps;let E=await u.storage.automations.update(i.id,t.id,l);if(i.active!==void 0&&i.active!==f.active){let c=await u.storage.automations.listTriggers(E.id),w=c.filter(($)=>$.type==="event");await Promise.allSettled(w.map(async($)=>{let h=await vO(u,$,i.active);if(!h.success)console.warn(`Failed to configure trigger ${$.id}: ${h.error}`)})),await LS0(c,i.active)}return{id:E.id,name:E.name,active:E.active,updated_at:E.updated_at}}})});import{z as sTi}from"zod";var Tcu;var uL0=O(()=>{DY();z4();fu();hs();Tcu=p({name:"AUTOMATION_DELETE",description:"Permanently delete an automation. Disables all event triggers on connected MCPs first.",annotations:{title:"Delete Automation",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:sTi.object({id:sTi.string()}),outputSchema:sTi.object({success:sTi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),!await u.storage.automations.findById(i.id,t.id))throw Error("Automation not found");let l=await u.storage.automations.listTriggers(i.id),E=l.filter(($)=>$.type==="event");await Promise.allSettled(E.map(async($)=>{let h=await vO(u,$,!1);if(!h.success)console.warn(`Failed to disable trigger ${$.id}: ${h.error}`)}));let{success:c}=await u.storage.automations.delete(i.id,t.id);await QS0(l);let w=Qu(u);if(w)mu.capture({distinctId:w,event:"automation_deleted",groups:{organization:t.id},properties:{organization_id:t.id,automation_id:i.id,trigger_count:l.length}});return{success:c}}})});function zn(i){return`webhook_${i}`}function pTi(i,u,t){if(!u)throw Error("Cannot build webhook URL: organization slug missing from request context");return`${i}/api/${u}/webhooks/${t}`}import{z as zE}from"zod";var tL0=300000,dof=10,Acu;var fL0=O(()=>{lcu();DY();fcu();fu();hs();Acu=p({name:"AUTOMATION_TRIGGER_ADD",description:"Add a cron, event, or webhook trigger to an automation. For webhook triggers the response includes a one-time URL + secret token.",annotations:{title:"Add Trigger",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:zE.object({automation_id:zE.string(),type:zE.enum(["cron","event","webhook"]),cron_expression:zE.string().optional(),connection_id:zE.string().optional(),event_type:zE.string().optional(),params:zE.record(zE.string(),zE.string()).optional()}),outputSchema:zE.object({id:zE.string(),automation_id:zE.string(),type:zE.enum(["cron","event","webhook"]),created_at:zE.string(),webhook:zE.object({url:zE.string(),token:zE.string()}).nullable().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findById(i.automation_id,t.id);if(!f)throw Error("Automation not found");if(i.type==="cron"){if(!i.cron_expression)throw Error("cron_expression is required for cron triggers");let $=new zTi(i.cron_expression,{timezone:"UTC"}).nextRuns(dof);if($.length===0)throw Error("Cron expression has no future runs");let h=1/0;for(let v=1;v<$.length;v++){let d=$[v].getTime()-$[v-1].getTime();if(d<h)h=d}if($.length>=2&&Number.isFinite(h)&&h<tL0){let v=tL0/1000;throw Error(`Cron fires too frequently \u2014 minimum interval is ${v}s between runs (observed ${h/1000}s)`)}}if(i.type==="event"){if(!i.connection_id)throw Error("connection_id is required for event triggers");if(!i.event_type)throw Error("event_type is required for event triggers");if(!await u.storage.connections.findById(i.connection_id,t.id))throw Error("Connection not found");let $={id:"",automation_id:i.automation_id,type:"event",cron_expression:null,connection_id:i.connection_id,event_type:i.event_type,params:i.params?JSON.stringify(i.params):null,last_run_at:null,next_run_at:null,api_key_id:null,created_at:""},h=await vO(u,$,!0,u.storage.triggerCallbackTokens);if(!h.success)throw Error(`Failed to configure trigger on connection: ${h.error}`)}let l=i.type==="cron"&&i.cron_expression?nTi(i.cron_expression,new Date):null,E=await u.storage.automations.addTrigger({automation_id:i.automation_id,type:i.type,cron_expression:i.type==="cron"?i.cron_expression:null,connection_id:i.type==="event"?i.connection_id:null,event_type:i.type==="event"?i.event_type:null,params:i.params?JSON.stringify(i.params):null,next_run_at:l?.toISOString()??null}),c=null;if(i.type==="webhook")try{let w=await u.boundAuth.apiKey.create({name:`webhook:${f.name}:${E.id.slice(0,8)}`,permissions:{[zn(E.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:f.id,trigger_id:E.id}});await u.storage.automations.setTriggerApiKeyId(E.id,w.id),c={url:pTi(u.baseUrl,t.slug,E.id),token:w.key}}catch(w){await u.storage.automations.removeTrigger(E.id,E.automation_id);let $=w instanceof Error?w.message:String(w);throw Error(`Failed to mint webhook token: ${$}`)}return await bTi(E,f),{id:E.id,automation_id:E.automation_id,type:E.type,created_at:E.created_at,webhook:c}}})});import{z as iAi}from"zod";var ycu;var lL0=O(()=>{DY();fu();hs();ycu=p({name:"AUTOMATION_TRIGGER_REMOVE",description:"Remove a trigger from an automation. Disables associated event listeners on MCPs.",annotations:{title:"Remove Trigger",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:iAi.object({trigger_id:iAi.string()}),outputSchema:iAi.object({success:iAi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findTriggerById(i.trigger_id);if(!f)throw Error("Trigger not found");if(!await u.storage.automations.findById(f.automation_id,t.id))throw Error("Automation not found");if(f.type==="event"){let c=await vO(u,f,!1,u.storage.triggerCallbackTokens);if(!c.success)console.warn(`Failed to disable trigger ${f.id}: ${c.error}`)}let{success:E}=await u.storage.automations.removeTrigger(f.id,f.automation_id);if(f.type==="cron")await Dcu(f.id);if(f.type==="webhook"&&f.api_key_id)try{await u.boundAuth.apiKey.delete(f.api_key_id)}catch(c){console.warn(`[trigger-remove] failed to delete api key ${f.api_key_id} for trigger ${f.id}:`,c instanceof Error?c.message:c)}return{success:E}}})});import{z as nn}from"zod";var Pcu;var EL0=O(()=>{fu();Pcu=p({name:"AUTOMATION_TRIGGER_ROTATE_TOKEN",description:"Rotate the secret token for a webhook automation trigger. Returns a new token; the old token is revoked.",annotations:{title:"Rotate Webhook Token",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:nn.object({trigger_id:nn.string()}),outputSchema:nn.object({trigger_id:nn.string(),url:nn.string(),token:nn.string()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findTriggerById(i.trigger_id);if(!f)throw Error("Trigger not found");if(f.type!=="webhook")throw Error("Trigger is not a webhook trigger");let l=await u.storage.automations.findById(f.automation_id,t.id);if(!l)throw Error("Automation not found");let E=f.api_key_id,c=await u.boundAuth.apiKey.create({name:`webhook:${l.name}:${f.id.slice(0,8)}`,permissions:{[zn(f.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:l.id,trigger_id:f.id}});if(await u.storage.automations.setTriggerApiKeyId(f.id,c.id),E)try{await u.boundAuth.apiKey.delete(E)}catch(w){console.warn(`[trigger-rotate] failed to delete old key ${E} for trigger ${f.id}:`,w instanceof Error?w.message:w)}return{trigger_id:f.id,url:pTi(u.baseUrl,t.slug,f.id),token:c.key}}})});import{z as Rn}from"zod";var Gcu;var cL0=O(()=>{z4();fu();Gcu=p({name:"AUTOMATION_RUN",description:"Manually trigger an automation run. Bypasses configured triggers.",annotations:{title:"Run Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:Rn.object({id:Rn.string()}),outputSchema:Rn.object({threadId:Rn.string().optional(),error:Rn.string().optional(),skipped:Rn.string().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),!u.automationRunner)throw Error("Automation runner not available");let f=Qu(u);if(!f)throw Error("User ID not available");let l=await u.automationRunner(i.id,t.id,f);if(mu.capture({distinctId:f,event:"automation_run",groups:{organization:t.id},properties:{organization_id:t.id,automation_id:i.id,thread_id:"taskId"in l?l.taskId:void 0,status:"skipped"in l?"skipped":("error"in l)?"error":"started",skip_reason:"skipped"in l?l.skipped:void 0,error_message:"error"in l?l.error:void 0}}),"skipped"in l)return{skipped:l.skipped};if("error"in l)return{threadId:l.taskId,error:l.error};return{threadId:l.taskId}}})});import{z as EE}from"zod";var Dof=500,Icu;var wL0=O(()=>{J1();fu();Icu=p({name:"AUTOMATION_RUN_STATS",description:"Aggregate run counts (by status) and LLM token/cost totals for a single automation.",annotations:{title:"Automation Run Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:EE.object({automation_id:EE.string(),startDate:EE.string().datetime().optional().describe("Filter runs at or after this ISO timestamp"),endDate:EE.string().datetime().optional().describe("Filter runs at or before this ISO timestamp")}),outputSchema:EE.object({runs:EE.object({total:EE.number(),completed:EE.number(),failed:EE.number(),inProgress:EE.number()}),usage:EE.object({calls:EE.number(),inputTokens:EE.number(),outputTokens:EE.number(),totalTokens:EE.number(),costUsd:EE.number(),sampledRuns:EE.number(),truncated:EE.boolean()})}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),await E5(),!await u.storage.automations.findById(i.automation_id,t.id))throw Error("Automation not found");let l=await u.storage.automations.getRunStats(i.automation_id,t.id,{startDate:i.startDate,endDate:i.endDate}),E=await u.storage.automations.listRunThreadIds(i.automation_id,t.id,{startDate:i.startDate,endDate:i.endDate,limit:Dof}),c={calls:0,inputTokens:0,outputTokens:0,totalTokens:0,costUsd:0,sampledRuns:E.length,truncated:l.total>E.length};if(E.length>0){let w=await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:"decopilot",threadIds:E,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});for(let $ of w)c.calls+=$.calls,c.inputTokens+=$.inputTokens,c.outputTokens+=$.outputTokens,c.totalTokens+=$.totalTokens,c.costUsd+=$.costUsd}return{runs:l,usage:c}}})});var $L0=O(()=>{yS0();PS0();GS0();iL0();uL0();fL0();lL0();EL0();cL0();wL0()});import{z as dO}from"zod";var Nof,Oof,xcu;var hL0=O(()=>{fu();Nof=dO.object({id:dO.string().min(1)}),Oof=dO.object({user:dO.object({id:dO.string(),name:dO.string(),email:dO.string(),image:dO.string().nullable()}).nullable()}),xcu=p({name:"USER_GET",description:"Get a user's profile by ID. Only returns users who share an organization with the caller.",annotations:{title:"Get User",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Nof,outputSchema:Oof,handler:async(i,u)=>{await u.access.check(),gi(u);let t=Qu(u);if(!t)throw Error("Authentication required");let f=await u.storage.users.findById(i.id,t);if(!f)return{user:null};return{user:{id:f.id,name:f.name,email:f.email,image:f.image??null}}}})});import{z as Zof}from"zod";var Bof,kcu;var vL0=O(()=>{fu();U$();Bof={tiers:{}},kcu=p({name:"USER_MODEL_PREFERENCES_GET",description:"Get the calling user's personal chat tier \u2192 model overrides for the current organization. Absent tiers fall back to the org default.",annotations:{title:"Get User Model Preferences",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Zof.object({}),outputSchema:ra,handler:async(i,u)=>{gi(u),await u.access.check();let t=Zi(u),f=u.auth?.user?.id;if(!f)throw Error("No authenticated user in context");return await u.storage.userModelPreferences.get(f,t.id)??Bof}})});function Fof(i){if(!i)return;if(!("models"in i))return;return i.models??void 0}function dL0(i,u){if(!i)return!0;if(i.includes("*:*"))return!0;return i.some((t)=>t.startsWith(`${u}:`))}function Lv(i,u,t){if(!i)return!0;return i.includes("*:*")||i.includes(`${u}:*`)||i.includes(`${u}:${t}`)}function uAi(i,u){if(i===void 0)return u;let t=u;if(t.image&&!Lv(i,t.image.credentialId,t.image.id)){let{image:f,...l}=t;t=l}if(t.webSearch&&!Lv(i,t.webSearch.credentialId,t.webSearch.id)){let{webSearch:f,...l}=t;t=l}if(t.deepResearch&&!Lv(i,t.deepResearch.credentialId,t.deepResearch.id)){let{deepResearch:f,...l}=t;t=l}return t}function DL0(i){if(!i)return{allowAll:!0,models:{}};if(i.includes("*:*"))return{allowAll:!0,models:{}};let u={};for(let t of i){let f=t.indexOf(":");if(f===-1)continue;let l=t.slice(0,f),E=t.slice(f+1);if(!u[l])u[l]=[];u[l].push(E)}return{allowAll:!1,models:u}}function gof(i){if(i.some((t)=>t===void 0))return;let u=new Set;for(let t of i)for(let f of t??[])u.add(f);return[...u]}async function Qv(i,u,t){if(!t||A5(t))return;let f=t.split(","),l=await i.selectFrom("organizationRole").select(["role","permission"]).where("organizationId","=",u).where("role","in",f).execute(),E=new Map(l.map((w)=>[w.role,w.permission])),c=f.map((w)=>{let $=E.get(w);if(!$)return;try{let h=JSON.parse($);return Fof(h)}catch{return console.error(`[model-permissions] Failed to parse permissions for role: ${w}`),[]}});return gof(c)}var bn=O(()=>{y5()});function Uof(i,u,t){let f={};for(let l of O8.options){let E=i[l];if(!E||Lv(t,E.keyId,E.modelId)){f[l]=E;continue}let c=u?.[l];if(!(c?.keyId===E.keyId&&c?.modelId===E.modelId))throw Error("Model not allowed for your role");f[l]=null}return f}var jcu;var _L0=O(()=>{fu();U$();bn();jcu=p({name:"USER_MODEL_PREFERENCES_UPDATE",description:"Set the calling user's personal chat tier \u2192 model overrides for the current organization. Only affects this user's chats; the org default and every non-chat path (automations, background tools) are unchanged. Omit a tier (or set it null) to fall back to the org default. Models the caller's role is not allowed to use are rejected.",annotations:{title:"Update User Model Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ra,outputSchema:ra,handler:async(i,u)=>{gi(u),await u.access.check();let t=Zi(u),f=u.auth?.user?.id;if(!f)throw Error("No authenticated user in context");let[l,E]=await Promise.all([Qv(u.db,t.id,t.role??u.auth.user?.role),u.storage.userModelPreferences.get(f,t.id)]);return await u.storage.userModelPreferences.upsert(f,t.id,{tiers:Uof(i.tiers,E?.tiers,l)})}})});var NL0=O(()=>{hL0();vL0();_L0()});import W$ from"zod";var Xcu;var OL0=O(()=>{fu();v8();Xcu=p({name:"AI_PROVIDERS_LIST",description:"List all supported AI providers and their connection methods (API key, OAuth).",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:W$.object({}),outputSchema:W$.object({providers:W$.array(W$.object({id:W$.string(),name:W$.string(),description:W$.string(),logo:W$.string().optional(),supportedMethods:W$.array(W$.enum(["api-key","oauth-pkce"])),supportsTopUp:W$.boolean().optional(),supportsCredits:W$.boolean().optional(),supportsProvision:W$.boolean().optional()}))}),handler:async(i,u)=>{return gi(u),Zi(u),await u.access.check(),{providers:Object.values(x6()).filter((f)=>!!f).map((f)=>({...f.info,supportedMethods:f.supportedMethods,supportsTopUp:!!f.getTopUpUrl,supportsCredits:!!f.getCreditsBalance,supportsProvision:!!f.provisionKey}))}}})});var Jcu;var ZL0=O(()=>{Jcu=[{providerId:"claude-code",modelId:"claude-code:haiku",title:"Claude Code Haiku",description:"Fast and lightweight",capabilities:["text"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:sonnet",title:"Claude Code Sonnet 5",description:"Balanced performance",capabilities:["text","reasoning"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:opus",title:"Claude Code Opus",description:"Most capable",capabilities:["text","reasoning"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:opus-1m",title:"Claude Code Opus 4.8 1M",description:"Most capable, 1M context window",capabilities:["text","reasoning"],limits:{contextWindow:1e6,maxOutputTokens:null},costs:null}]});var BL0=O(()=>{ZL0()});var Kcu;var FL0=O(()=>{Kcu=[{providerId:"codex",modelId:"codex:gpt-5.6-sol",title:"GPT-5.6 Sol",description:"Frontier Codex model for deep reasoning, complex coding, and real-world work",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.6-terra",title:"GPT-5.6 Terra",description:"Balanced Codex model for everyday coding and agent work",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.6-luna",title:"GPT-5.6 Luna",description:"Fast Codex model for lightweight coding tasks and titles",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.3-codex-spark",title:"GPT-5.3 Codex Spark",description:"Ultra-fast coding model",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null}]});var gL0=O(()=>{FL0()});import X6 from"zod";var Ycu;var UL0=O(()=>{fu();bn();BL0();gL0();Ycu=p({name:"AI_PROVIDERS_LIST_MODELS",description:"List models available from an AI provider. Requires a valid stored API key.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:X6.object({keyId:X6.string().describe("The provider key ID to use")}),outputSchema:X6.object({models:X6.array(X6.object({providerId:X6.string(),modelId:X6.string(),title:X6.string(),description:X6.string().nullish(),logo:X6.string().nullish(),capabilities:X6.array(X6.string()),limits:X6.object({contextWindow:X6.coerce.number(),maxOutputTokens:X6.coerce.number().nullable()}).nullish(),costs:X6.object({input:X6.coerce.number(),output:X6.coerce.number()}).nullish(),asyncResearch:X6.boolean().optional()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.findById(i.keyId,t.id).catch(()=>null);if(f?.providerId==="claude-code")return{models:Jcu};if(f?.providerId==="codex")return{models:Kcu};let[l,E]=await Promise.all([u.aiProviders.listModels(i.keyId,t.id),Qv(u.db,t.id,t.role??u.auth.user?.role)]);return{models:l.filter((w)=>Lv(E,i.keyId,w.modelId))}}})});import l7 from"zod";var Wcu;var TL0=O(()=>{fu();v8();Wcu=p({name:"AI_PROVIDERS_ACTIVE",description:"List AI providers that have at least one API key configured and ready to use.",inputSchema:l7.object({}),outputSchema:l7.object({providers:l7.array(l7.object({id:l7.string(),name:l7.string(),description:l7.string(),logo:l7.string().optional(),keyCount:l7.number()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.list({organizationId:t.id}),l=new Map;for(let c of f)l.set(c.providerId,(l.get(c.providerId)??0)+1);return{providers:[...l.entries()].flatMap(([c,w])=>{let h=x6()[c];if(!h)return console.warn(`AI provider "${c}" has stored keys but is not in the registry; skipping.`),[];return[{...h.info,keyCount:w}]})}}})});var DO=O(()=>{nt()});import Hv from"zod";var OY,Scu;var vs=O(()=>{z4();fu();DO();OY=Hv.object({id:Hv.string(),providerId:Hv.string(),label:Hv.string(),presetId:Hv.string().nullable(),createdAt:Hv.string()}),Scu=p({name:"AI_PROVIDER_KEY_CREATE",description:"Store an API key for an AI provider. The key is encrypted at rest in the vault.",inputSchema:Hv.object({providerId:Hv.enum(vc),label:Hv.string().min(1).max(100),apiKey:Hv.string().min(1),presetId:Hv.string().min(1).max(64).optional()}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.create({providerId:i.providerId,label:i.label,apiKey:i.apiKey,organizationId:t.id,createdBy:u.auth.user.id,presetId:i.presetId??null});return mu.capture({distinctId:u.auth.user.id,event:"ai_provider_key_created",groups:{organization:t.id},properties:{organization_id:t.id,provider_id:f.providerId,preset_id:f.presetId,key_id:f.id,label:f.label}}),{id:f.id,providerId:f.providerId,label:f.label,presetId:f.presetId,createdAt:f.createdAt}}})});import tAi from"zod";var Cn=(i,u)=>i&&i.keyId===u?null:i,Aof=(i,u)=>{let t={tiers:{fast:Cn(i.tiers.fast,u),smart:Cn(i.tiers.smart,u),thinking:Cn(i.tiers.thinking,u),image:Cn(i.tiers.image,u),web_search:Cn(i.tiers.web_search,u),deep_research:Cn(i.tiers.deep_research,u)}},f=t.tiers.fast!==i.tiers.fast||t.tiers.smart!==i.tiers.smart||t.tiers.thinking!==i.tiers.thinking||t.tiers.image!==i.tiers.image||t.tiers.web_search!==i.tiers.web_search||t.tiers.deep_research!==i.tiers.deep_research;return{config:t,changed:f}},Lcu;var AL0=O(()=>{z4();fu();Lcu=p({name:"AI_PROVIDER_KEY_DELETE",description:"Delete a stored AI provider API key. Cannot be undone.",inputSchema:tAi.object({keyId:tAi.string().describe("The provider key ID to delete")}),outputSchema:tAi.object({success:tAi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.organizationSettings.get(t.id);if(f?.simple_mode){let{config:l,changed:E}=Aof(f.simple_mode,i.keyId);if(E)await u.storage.organizationSettings.upsert(t.id,{simple_mode:l})}return await u.storage.aiProviderKeys.delete(i.keyId,t.id),mu.capture({distinctId:u.auth.user.id,event:"ai_provider_key_deleted",groups:{organization:t.id},properties:{organization_id:t.id,key_id:i.keyId}}),{success:!0}}})});import fAi from"zod";var Qcu;var yL0=O(()=>{fu();vs();Qcu=p({name:"AI_PROVIDER_KEY_UPDATE",description:"Update the label and/or API key of a stored AI provider key. Pass apiKey to rotate the stored credential.",inputSchema:fAi.object({keyId:fAi.string(),label:fAi.string().min(1).max(100).optional(),apiKey:fAi.string().min(1).optional()}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.updateKey(i.keyId,t.id,{label:i.label,apiKey:i.apiKey});return{id:f.id,providerId:f.providerId,label:f.label,presetId:f.presetId,createdAt:f.createdAt}}})});import Mn from"zod";var Hcu;var PL0=O(()=>{fu();Hcu=p({name:"AI_PROVIDER_KEY_PREVIEW",description:"Get the label and a masked preview of a stored AI provider API key. The API key is partially obscured (only the last 4 characters are visible). For openai-compatible keys the baseUrl is also returned.",inputSchema:Mn.object({keyId:Mn.string()}),outputSchema:Mn.object({label:Mn.string(),maskedKey:Mn.string(),baseUrl:Mn.string().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);return await u.access.check(),u.storage.aiProviderKeys.getPreview(i.keyId,t.id)}})});import zv from"zod";var zcu;var GL0=O(()=>{fu();DO();bn();zcu=p({name:"AI_PROVIDER_KEY_LIST",description:"List stored AI provider API keys. Returns metadata only \u2014 secrets are never exposed.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:zv.object({providerId:zv.enum(vc).optional()}),outputSchema:zv.object({keys:zv.array(zv.object({id:zv.string(),providerId:zv.string(),label:zv.string(),presetId:zv.string().nullable(),createdBy:zv.string(),createdAt:zv.string()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let[f,l]=await Promise.all([u.storage.aiProviderKeys.list({organizationId:t.id,providerId:i.providerId}),Qv(u.db,t.id,t.role??u.auth.user?.role)]);return{keys:f.filter((w)=>dL0(l,w.id)).map(({organizationId:w,...$})=>$)}}})});import{createHash as yof,randomBytes as Pof}from"crypto";function IL0(){return Pof(32).toString("base64url")}function xL0(i){return yof("sha256").update(i).digest("base64url")}var kL0=()=>{};import qn from"zod";function jL0(i){return i==="localhost"||i.endsWith(".localhost")||i==="127.0.0.1"||i==="[::1]"||i==="::1"}function Gof(i){let u=vu(),t=u.baseUrl??`http://localhost:${u.port}`,f=new URL(i),l=new URL(t);if(f.origin===l.origin)return!0;return f.protocol===l.protocol&&jL0(f.hostname)&&jL0(l.hostname)}var ncu;var XL0=O(()=>{fu();DO();v8();kL0();n0();ncu=p({name:"AI_PROVIDER_OAUTH_URL",description:"Get the OAuth PKCE authorization URL for a provider. Returns URL and state token.",inputSchema:qn.object({providerId:qn.enum(vc),callbackUrl:qn.string().url().refine((i)=>{return Gof(i)},{message:"callbackUrl must be on the same origin as BASE_URL"})}),outputSchema:qn.object({url:qn.string(),stateToken:qn.string().describe("Opaque token \u2014 pass to AI_PROVIDER_OAUTH_EXCHANGE")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=x6()[i.providerId];if(!f)throw Error(`Unknown provider: ${i.providerId}`);if(!f.supportedMethods.includes("oauth-pkce")||!f.getOAuthUrl)throw Error(`Provider ${i.providerId} does not support OAuth PKCE`);let l=IL0(),E=xL0(l),c=await u.storage.oauthPkceStates.create(l,t.id,u.auth.user.id),w=new URL(i.callbackUrl);w.searchParams.set("state",c);let $={callbackUrl:w.toString(),codeChallenge:E,codeChallengeMethod:"S256",organizationId:t.id};return{url:f.getOAuthUrl($),stateToken:c}}})});import ds from"zod";var Rcu;var JL0=O(()=>{fu();DO();v8();vs();Rcu=p({name:"AI_PROVIDER_OAUTH_EXCHANGE",description:"Exchange an OAuth authorization code for an API key. Completes the OAuth flow started by AI_PROVIDER_OAUTH_URL.",inputSchema:ds.object({providerId:ds.enum(vc),code:ds.string(),stateToken:ds.string().describe("The stateToken returned by AI_PROVIDER_OAUTH_URL"),label:ds.string().min(1).max(100)}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=x6()[i.providerId];if(!f)throw Error(`Unknown provider: ${i.providerId}`);if(!f.supportedMethods.includes("oauth-pkce")||!f.exchangeOAuthCode)throw Error(`Provider ${i.providerId} does not support OAuth PKCE`);let l=Qu(u);if(!l)throw Error("Unable to determine user ID");let E=await u.storage.oauthPkceStates.consume(i.stateToken,t.id,l),{apiKey:c}=await f.exchangeOAuthCode({code:i.code,codeVerifier:E,codeChallengeMethod:"S256"}),w=await u.storage.aiProviderKeys.upsert({providerId:i.providerId,label:i.label,apiKey:c,organizationId:t.id,createdBy:l});return{id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdAt:w.createdAt}}})});import KL0 from"zod";var bcu;var YL0=O(()=>{fu();DO();v8();O9();vs();bcu=p({name:"AI_PROVIDER_PROVISION_KEY",description:"Auto-provision an API key for a provider that supports server-to-server key creation (e.g. Deco AI Gateway).",inputSchema:KL0.object({providerId:KL0.enum(vc)}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=x6()[i.providerId];if(!l)throw Error(`Unknown provider: ${i.providerId}`);if(!l.provisionKey)throw Error(`Provider ${i.providerId} does not support key provisioning`);let E=await nd(f),c=await l.provisionKey(E,t.id),w=await u.storage.aiProviderKeys.upsert({providerId:i.providerId,label:"Auto-provisioned",apiKey:c,organizationId:t.id,createdBy:f});return{id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdAt:w.createdAt}}})});import Vn from"zod";var Ccu;var WL0=O(()=>{Q6i();Cz();fu();Ml();DO();v8();O9();n0();Ccu=p({name:"AI_PROVIDER_TOPUP_URL",description:"Get a checkout URL to top up credits for a provider that supports it (e.g. Deco AI Gateway)",inputSchema:Vn.object({providerId:Vn.enum(vc),amountCents:Vn.number().int().positive().describe("Amount in cents (e.g. 1000 = $10.00)"),currency:Vn.enum(["usd","brl"]).default("usd")}),outputSchema:Vn.object({url:Vn.string().describe("Checkout URL \u2014 open in browser to complete payment")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=vu();if(i.providerId==="deco"&&l.stripeSecretKey&&LL()&&t.slug){let $=await u.storage.organizationBilling.getBilling(t.id),h=`${gE()}/${encodeURIComponent(t.slug)}/settings`,{url:v}=await Hg0({organizationId:t.id,amountCents:i.amountCents,currency:i.currency,feePercent:l.topupFeePercent,customerId:$?.stripeCustomerId??null,successUrl:`${h}?topup=success`,cancelUrl:`${h}?topup=canceled`});return{url:v}}let E=x6()[i.providerId];if(!E)throw Error(`Unknown provider: ${i.providerId}`);if(!E.getTopUpUrl)throw Error(`Provider ${i.providerId} does not support credit top-ups`);let c=await nd(f,u.auth.user?.email);return{url:await E.getTopUpUrl(c,t.id,i.amountCents,i.currency)}}})});import lAi from"zod";var Mcu;var SL0=O(()=>{fu();DO();v8();O9();Mcu=p({name:"AI_PROVIDER_CREDITS",description:"Get the current credit balance for a provider (providers that support it, e.g. Deco AI Gateway)",inputSchema:lAi.object({providerId:lAi.enum(vc)}),outputSchema:lAi.object({balanceCents:lAi.number().describe("Remaining balance in cents (e.g. 1000 = $10.00)")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=x6()[i.providerId];if(!l)throw Error(`Unknown provider: ${i.providerId}`);if(!l.getCreditsBalance)throw Error(`Provider ${i.providerId} does not expose a credits balance`);let E=await nd(f);return l.getCreditsBalance(E,t.id)}})});var LL0=O(()=>{OL0();UL0();TL0();vs();AL0();yL0();PL0();GL0();XL0();JL0();YL0();WL0();SL0()});import K8 from"zod";var EAi;var qcu=O(()=>{EAi=K8.object({id:K8.string(),scope:K8.enum(["user","organization"]),userId:K8.string().nullable(),name:K8.string(),description:K8.string().nullable(),createdBy:K8.string(),createdAt:K8.string(),updatedBy:K8.string(),updatedAt:K8.string()})});import Ds from"zod";var Vcu;var QL0=O(()=>{fu();qcu();Vcu=p({name:"SECRET_CREATE",description:"Create a secret. The value is encrypted at rest in the credential vault and never returned by any tool. Scope 'user' is private to the caller within this organization; scope 'organization' is visible to all org members.",inputSchema:Ds.object({scope:Ds.enum(["user","organization"]),name:Ds.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/,{message:"Name may only contain letters, digits, underscore, dot, and hyphen."}),value:Ds.string().min(1),description:Ds.string().max(500).optional()}),outputSchema:EAi,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=u.auth.user.id,l=i.scope==="user"?{kind:"user",userId:f}:{kind:"organization"};return await u.storage.secrets.create({organizationId:t.id,scope:l,name:i.name,value:i.value,description:i.description??null,createdBy:f})}})});import cAi from"zod";var rcu;var HL0=O(()=>{fu();qcu();rcu=p({name:"SECRET_LIST",description:"List secrets visible to the caller: all organization-scoped secrets, plus user-scoped secrets owned by the caller. Values are never returned.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:cAi.object({scope:cAi.enum(["user","organization"]).optional()}),outputSchema:cAi.object({secrets:cAi.array(EAi)}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=u.auth.user.id,l=i.scope==="user"?{kind:"user",userId:f}:i.scope==="organization"?{kind:"organization"}:void 0;return{secrets:await u.storage.secrets.list({organizationId:t.id,callerUserId:f,scope:l})}}})});var zL0=O(()=>{QL0();HL0()});var ZY=Y((Yof)=>{var mcu;(function(i){i.HEADER="header",i.QUERY="query"})(mcu||(mcu={}));var ecu;(function(i){i.HEADER="header",i.QUERY="query"})(ecu||(ecu={}));var acu;(function(i){i.HTTP="http",i.HTTPS="https"})(acu||(acu={}));var _s;(function(i){i.MD5="md5",i.CRC32="crc32",i.CRC32C="crc32c",i.SHA1="sha1",i.SHA256="sha256"})(_s||(_s={}));var kof=(i)=>{let u=[];if(i.sha256!==void 0)u.push({algorithmId:()=>_s.SHA256,checksumConstructor:()=>i.sha256});if(i.md5!=null)u.push({algorithmId:()=>_s.MD5,checksumConstructor:()=>i.md5});return{addChecksumAlgorithm(t){u.push(t)},checksumAlgorithms(){return u}}},jof=(i)=>{let u={};return i.checksumAlgorithms().forEach((t)=>{u[t.algorithmId()]=t.checksumConstructor()}),u},Xof=(i)=>{return kof(i)},Jof=(i)=>{return jof(i)},ocu;(function(i){i[i.HEADER=0]="HEADER",i[i.TRAILER=1]="TRAILER"})(ocu||(ocu={}));var Kof="__smithy_context",scu;(function(i){i.PROFILE="profile",i.SSO_SESSION="sso-session",i.SERVICES="services"})(scu||(scu={}));var pcu;(function(i){i.HTTP_0_9="http/0.9",i.HTTP_1_0="http/1.0",i.TDS_8_0="tds/8.0"})(pcu||(pcu={}));Yof.AlgorithmId=_s;Yof.EndpointURLScheme=acu;Yof.FieldPosition=ocu;Yof.HttpApiKeyAuthLocation=ecu;Yof.HttpAuthLocation=mcu;Yof.IniSectionType=scu;Yof.RequestHandlerProtocol=pcu;Yof.SMITHY_CONTEXT_KEY=Kof;Yof.getDefaultClientConfiguration=Xof;Yof.resolveDefaultRuntimeConfig=Jof});var Y8=Y((aof)=>{var{SMITHY_CONTEXT_KEY:nL0}=ZY(),Mof=(i)=>i[nL0]||(i[nL0]={});class wAi{method;protocol;hostname;port;path;query;headers;username;password;fragment;body;constructor(i){this.method=i.method||"GET",this.hostname=i.hostname||"localhost",this.port=i.port,this.query=i.query||{},this.headers=i.headers||{},this.body=i.body,this.protocol=i.protocol?i.protocol.slice(-1)!==":"?`${i.protocol}:`:i.protocol:"https:",this.path=i.path?i.path.charAt(0)!=="/"?`/${i.path}`:i.path:"/",this.username=i.username,this.password=i.password,this.fragment=i.fragment}static clone(i){let u=new wAi({...i,headers:{...i.headers}});if(u.query)u.query=qof(u.query);return u}static isInstance(i){if(!i)return!1;let u=i;return"method"in u&&"protocol"in u&&"hostname"in u&&"path"in u&&typeof u.query==="object"&&typeof u.headers==="object"}clone(){return wAi.clone(this)}}function qof(i){return Object.keys(i).reduce((u,t)=>{let f=i[t];return{...u,[t]:Array.isArray(f)?[...f]:f}},{})}class RL0{statusCode;reason;headers;body;constructor(i){this.statusCode=i.statusCode,this.reason=i.reason,this.headers=i.headers||{},this.body=i.body}static isInstance(i){if(!i)return!1;let u=i;return typeof u.statusCode==="number"&&typeof u.headers==="object"}}var Vof=new RegExp("^(?!.*-$)(?!-)[a-zA-Z0-9-]{1,63}$"),bL0=(i,u=!1)=>{if(!u)return Vof.test(i);let t=i.split(".");for(let f of t)if(!bL0(f))return!1;return!0};function rof(i){return/^[a-z0-9][a-z0-9\.\-]*[a-z0-9]$/.test(i)}var mof=(i)=>{if(typeof i==="function")return i;let u=Promise.resolve(i);return()=>u};function CL0(i){let u={};if(i=i.replace(/^\?/,""),i)for(let t of i.split("&")){let[f,l=null]=t.split("=");if(f=decodeURIComponent(f),l)l=decodeURIComponent(l);if(!(f in u))u[f]=l;else if(Array.isArray(u[f]))u[f].push(l);else u[f]=[u[f],l]}return u}var $Ai=(i)=>{if(typeof i==="string")return $Ai(new URL(i));let{hostname:u,pathname:t,port:f,protocol:l,search:E}=i,c;if(E)c=CL0(E);return{hostname:u,port:f?parseInt(f):void 0,protocol:l,path:t,query:c}},eof=(i)=>{if(typeof i==="object"){if("url"in i){let u=$Ai(i.url);if(i.headers){u.headers={};for(let t in i.headers)u.headers[t.toLowerCase()]=i.headers[t].join(", ")}return u}return i}return $Ai(i)};aof.HttpRequest=wAi;aof.HttpResponse=RL0;aof.getSmithyContext=Mof;aof.isValidHostLabel=bL0;aof.isValidHostname=rof;aof.normalizeProvider=mof;aof.parseQueryString=CL0;aof.parseUrl=$Ai;aof.toEndpointV1=eof});var nv=Y((gsf)=>{var{getSmithyContext:ML0,HttpResponse:csf,toEndpointV1:wsf}=Y8(),hAi=(i)=>{if(typeof i==="function")return i();return i},t3u=(i,u,t,f,l)=>({name:u,namespace:i,traits:t,input:f,output:l}),$sf=(i)=>(u,t)=>async(f)=>{let{response:l}=await u(f),{operationSchema:E}=ML0(t),[,c,w,$,h,v]=E??[];try{let d=await i.protocol.deserializeResponse(t3u(c,w,$,h,v),{...i,...t},l);return{response:l,output:d}}catch(d){if(Object.defineProperty(d,"$response",{value:l,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in d)){try{d.message+=`
+`+i}function CTi(i){if(!i||i.length===0)return[];return i.filter((u)=>oaf.test(u))}function saf(i){if(i.csp)return i.csp;let u=i.resourceCsp;if(!u)return RS0;let t=CTi(u.resourceDomains),f=CTi(u.connectDomains),l=CTi(u.frameDomains),E=CTi(u.baseUriDomains),c=t.length>0,w=f.length>0,$=l.length>0,h=E.length>0;if(!c&&!w&&!$&&!h)return RS0;let v=t.join(" ");return["default-src 'none'",c?`script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' ${v}`:"script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",c?`style-src 'unsafe-inline' ${v}`:"style-src 'unsafe-inline'",c?`img-src * data: blob: ${v}`:"img-src * data: blob:",c?`media-src * data: blob: ${v}`:"media-src * data: blob:",c?`font-src data: ${v}`:"font-src data:",w?`connect-src ${f.join(" ")}`:"connect-src 'none'",$?`frame-src ${l.join(" ")}`:"frame-src 'none'","worker-src blob:","form-action 'none'",h?`base-uri ${E.join(" ")}`:"base-uri 'none'"].join("; ")}var RS0,oaf;var CS0=O(()=>{RS0=["default-src 'none'","script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'","style-src 'unsafe-inline'","img-src * data: blob:","media-src * data: blob:","font-src data:","connect-src 'none'","frame-src 'none'","worker-src blob:","form-action 'none'","base-uri 'none'"].join("; ");oaf=/^https?:\/\/(\*\.)?[a-zA-Z0-9._-]+(:\d+)?\/?$/});function paf(i){let u=i.lastFailureAt-i.firstFailureAt;return i.count>=Q10&&u>=H10}class Ocu{options;kv=null;codec=C3i();constructor(i){this.options=i}async init(){let i=this.options.getJetStream();if(!i)return;this.kv=await new qS0.Kvm(i).create(iof,{storage:MS0.StorageType.Memory,ttl:VS0.nanos(z10)})}async recordFailure(i){if(!this.kv)return Ncu;let u=Date.now();for(let t=0;t<uof;t++)try{let f=await this.kv.get(i);if(!(f&&f.operation!=="DEL"&&f.operation!=="PURGE"&&f.value?.length)){let w={count:1,firstFailureAt:u,lastFailureAt:u};return await this.kv.create(i,this.codec.encode(w)),{count:w.count,shouldDisable:!1}}let E=this.codec.decode(f.value),c={count:E.count+1,firstFailureAt:E.firstFailureAt,lastFailureAt:u};return await this.kv.update(i,this.codec.encode(c),f.revision),{count:c.count,shouldDisable:paf(c)}}catch{}return Ncu}async recordSuccess(i){if(!this.kv)return;try{await this.kv.delete(i)}catch{}}teardown(){this.kv=null}}class $s{async recordFailure(){return Ncu}async recordSuccess(){}teardown(){}}function Zcu(i){rS0=i??new $s}function Bcu(){return rS0}var MS0,qS0,VS0,Ncu,iof="DECOCMS_CONN_CIRCUIT",uof=5,rS0;var Fcu=O(()=>{MS0=X(j_(),1),qS0=X(Joi(),1),VS0=X(EB(),1),Ncu={count:0,shouldDisable:!1};rS0=new $s});function mS0(i){if(!i)return{decision:"skip"};if(i.startsWith("notifications/"))return{decision:"skip"};if(fof.has(i))return{decision:"skip"};let u=tof[i];if(u)return{decision:"skip-if-list-cached",listType:u};return{decision:"probe"}}async function eS0(i){if(i.method!=="POST")return;let u=i.headers.get("content-length");if(u&&Number(u)>lof)return;try{let t=await i.clone().json(),l=(Array.isArray(t)?t[0]:t)?.method;return typeof l==="string"?l:void 0}catch{return}}var tof,fof,lof=64000;var aS0=O(()=>{tof={"tools/list":"tools","resources/list":"resources","prompts/list":"prompts"},fof=new Set(["ping"])});function gcu(i){let u=Object.values(i),[t]=u;if(!t)return null;return u.find((f)=>f.sandboxProviderKind!=="user-desktop")??t}async function wof(i){if(oS0.has(i))return!0;let u=Date.now();if(u-(sS0.get(i)??0)<cof)return!1;sS0.set(i,u);try{let t=await fetch(i,{method:"POST",headers:{"content-type":"application/json",accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"studio-dev-probe",version:"1"}}}),signal:AbortSignal.timeout(4000)}),f=t.ok?await t.text():"",l=/"protocolVersion"|"serverInfo"/.test(f);if(l)oS0.add(i);return l}catch{return!1}}async function _Y(i,u,t,f){let l=i.organization?.id;if(!l)return null;let E=await i.storage.virtualMcps.findById(u);if(!E||E.organization_id!==l)return null;let c=E.metadata??{},w=o1(c)[t];if(!w)return null;let $=f?$of(w,f):hof(w);if(!$?.entry.previewUrl)return null;let h=await vof(i,c,l,t),v=$.entry.previewUrl.replace(/\/+$/,""),d=h?`${v}/api/mcp?token=${encodeURIComponent(h)}`:`${v}/api/mcp`;if(!await wof(d))return null;return{id:vu0(u),organization_id:l,title:`${E.title} (dev)`,description:"Ephemeral sandbox dev-server connection",icon:E.icon??null,app_name:E.title??null,app_id:null,slug:null,connection_type:"HTTP",connection_url:d,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:{isDevConnection:!0,virtualMcpId:u,branch:$.branch},tools:null,bindings:null,status:"active",created_at:new Date().toISOString(),updated_at:new Date().toISOString(),created_by:"system"}}function $of(i,u){let t=gcu(nh(i[u]));return t?{branch:u,entry:t}:null}function hof(i){let u=null;for(let[t,f]of Object.entries(i)){let l=gcu(nh(f));if(!l)continue;if(!u||(l.createdAt??0)>(u.entry.createdAt??0))u={branch:t,entry:l}}return u}async function vof(i,u,t,f){let l=ETi(u)?.find((E)=>E.key===Eof);if(!l)return null;if(l.kind==="literal")return l.value||null;try{let{value:E}=await i.storage.secrets.resolveById(l.secretId,t,f);return E||null}catch(E){if(E instanceof G5||E instanceof a9)return null;throw E}}var Eof="MCP_AUTH_TOKEN",oS0,sS0,cof=1e4;var MTi=O(()=>{nt();am();Gn();G$();oS0=new Set,sS0=new Map});import{SpanStatusCode as qTi}from"@opentelemetry/api";async function VTi(i,u){let t=i.get("studioContext");try{let f=t.organization?.id??null,l=u?u:f?TB(f):null;if(!l)return i.json({error:"Agent ID or organization ID is required"},400);if(u&&!f)return i.json({error:"Organization context is required"},400);let E=await t.tracer.startActiveSpan("studio.virtual_mcp.lookup",{attributes:{"virtual_mcp.id":l}},async(_)=>{try{let N=await t.storage.virtualMcps.findById(l,f??void 0);return _.setStatus({code:qTi.OK}),N}catch(N){throw _.setStatus({code:qTi.ERROR,message:N.message}),_.recordException(N),N}finally{_.end()}});if(!E)return i.json({error:"Agent not found"},404);if(f&&E.organization_id!==f)return i.json({error:"Agent not found"},404);if(E.status!=="active")return i.json({error:`Agent is inactive: ${E.id??"Decopilot"}`},503);if(t.organization?.id&&E.organization_id!==t.organization.id)return i.json({error:"Forbidden: Agent does not belong to your organization"},403);t.connectionId=E.id??void 0;let c=await t.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",E.organization_id).executeTakeFirst();if(c)t.organization={id:c.id,slug:c.slug,name:c.name};let w=Qu(t),$=null;if(E.id&&w&&o1(E.metadata)[w])$=await _Y(t,E.id,w,i.req.query("branch")??void 0).catch(()=>null);let h=await t.tracer.startActiveSpan("studio.virtual_mcp.create_client",{attributes:{"virtual_mcp.id":E.id??"decopilot"}},async(_)=>{try{let N=await W2(E,t,"passthrough",!1,{includeSkillsCatalog:!0,additionalConnections:$?[$]:[]});return _.setStatus({code:qTi.OK}),N}catch(N){throw _.setStatus({code:qTi.ERROR,message:N.message}),_.recordException(N),N}finally{_.end()}}),v={name:E.id??"Decopilot",version:"1.0.0",title:E.title??void 0,description:E.description??void 0,icons:E.icon?[{src:E.icon}]:void 0},d=VB(h,v,{capabilities:{tools:{},resources:{},prompts:{}},instructions:h.getInstructions(),toolCallTimeoutMs:$Q}),D=new Y$({enableJsonResponse:i.req.header("Accept")?.includes("application/json")??!1});return await d.connect(D),await J8(d,D,i.req.raw,`virtual-mcp:${E.id??"decopilot"}`,{onClose:()=>h.close()})}catch(f){let l=f;return console.error("[virtual-mcp] Error handling virtual MCP request:",l),i.json({error:"Internal server error",message:l.message},500)}}var rTi=()=>{let i=new Yu;return i.all("/gateway/:virtualMcpId?",async(u)=>{let t=u.req.param("virtualMcpId")||u.req.header("x-virtual-mcp-id");return VTi(u,t)}),i.all("/virtual-mcp/:virtualMcpId?",async(u)=>{let t=u.req.param("virtualMcpId")||u.req.header("x-virtual-mcp-id");return VTi(u,t)}),i};var mTi=O(()=>{h3();nt();Qn();Ef();Hz();MTi();G$();ws()});import{SpanStatusCode as eTi}from"@opentelemetry/api";var pS0=(i,u)=>{if(i instanceof rH)return u.header("Retry-After",String(Math.ceil(i.cooldownRemainingMs/1000))),u.json({error:i.message},503);if(i.message.includes("not found"))return u.json({error:i.message},404);if(i.message.includes("does not belong to the active organization"))return u.json({error:"Connection not found"},404);if(i.message.includes("inactive"))return u.json({error:i.message},503);return u.json({error:"Internal server error",message:i.message},500)},aTi=()=>{let i=new Yu;return i.all("/",async(u)=>{return VTi(u,void 0)}),i.get("/:connectionId/ui-resource",async(u)=>{let t=u.get("studioContext"),f=u.req.param("connectionId"),l=u.req.query("uri");if(!l)return u.json({error:"uri query param is required"},400);if(!t.organization?.id)return u.json({error:"Organization context is required"},403);let E=lri(f),c;if(E){let _=Qu(t);if(!_)return u.json({error:"Authentication required"},401);if(c=await _Y(t,E,_,u.req.query("branch")??void 0),!c)return u.json({error:"Dev server not running"},503)}else if(c=await t.storage.connections.findById(f,t.organization.id),!c||c.organization_id!==t.organization.id)return u.json({error:"Connection not found"},404);let w=r9(c,t,!1,Dl()??void 0),$,h;try{let N=(await w.readResource({uri:l})).contents?.[0];$=N?.text,h=N?._meta?.ui?.csp}catch(_){return u.json({error:_.message},502)}finally{await w.close().catch(()=>{})}if(typeof $!=="string")return u.json({error:"Resource has no text content"},404);let v=bS0($,{resourceCsp:h}),d=`"${Bun.hash(v).toString(36)}"`,D="private, no-cache";if(u.req.header("if-none-match")===d)return new Response(null,{status:304,headers:{ETag:d,"Cache-Control":D}});return new Response(v,{headers:{"Content-Type":"text/html; charset=utf-8",ETag:d,"Cache-Control":D}})}),i.all("/:connectionId",async(u)=>{let t=u.req.param("connectionId"),f=u.get("studioContext");if(t.endsWith("_self")){let E=t.slice(0,-5);if(!f.organization||f.organization.id!==E)return u.json({error:"Connection not found"},404);let c=await Hn(f),w=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await c.connect(w),NY.run(f,()=>J8(c,w,u.req.raw,`mcp:self:${t}`))}let l=lri(t);if(l){if(!f.organization?.id)return u.json({error:"Organization context is required"},403);let E=Qu(f);if(!E)return u.json({error:"Authentication required"},401);let c=await _Y(f,l,E,u.req.query("branch")??void 0);if(!c)return u.json({error:"Dev server not running"},503);let w=s5i(c,f,!1),$=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await w.connect($),J8(w,$,u.req.raw,`mcp:dev:${t}`)}try{try{if(!f.organization?.id)return u.json({error:"Organization context is required"},403);let E=await f.tracer.startActiveSpan("studio.connection.lookup",{attributes:{"connection.id":t}},async(N)=>{_5(u,"mcp.find_connection");try{let Z=await f.storage.connections.findById(t,f.organization.id);return N.setStatus({code:eTi.OK}),Z}catch(Z){throw N.setStatus({code:eTi.ERROR,message:Z.message}),N.recordException(Z),Z}finally{t$(u,"mcp.find_connection"),N.end()}});if(!E)throw Error("Connection not found");if(E.organization_id!==f.organization.id)throw Error("Connection does not belong to the active organization");let c=!1;if(E.status!=="active"){let N=Date.now()-new Date(E.updated_at).getTime();if(E.status==="error"&&!!E.connection_url&&N>=Lmi)c=!0;else{if(E.status==="error"&&E.connection_url){let B=Lmi-N;u.header("Retry-After",String(Math.ceil(B/1000)))}throw Error(`Connection inactive: ${E.status}`)}}let w=await eS0(u.req.raw),{decision:$,listType:h}=mS0(w),v=$==="probe";if($==="skip-if-list-cached"&&h){let N=Dl();v=N?await N.get(h,t)===null:!0}if(c)v=!0;if(E.connection_url&&v)$$i(t),await f.tracer.startActiveSpan("studio.connection.handshake",{attributes:{"connection.id":t,"connection.url":E.connection_url}},async(N)=>{_5(u,"mcp.client_handshake");try{if(await F6(E,f,!1),h$i(t),Bcu().recordSuccess(t),c)await f.storage.connections.update(t,{status:"active"}),console.info("[proxy] auto-recovered connection after successful re-probe",{connectionId:t,org:f.organization?.slug});N.setStatus({code:eTi.OK})}catch(Z){throw N.setStatus({code:eTi.ERROR,message:Z.message}),N.recordException(Z),Z}finally{t$(u,"mcp.client_handshake"),N.end()}});_5(u,"mcp.create_server");let d=s5i(E,f,!1);t$(u,"mcp.create_server");let D=new Y$({enableJsonResponse:u.req.raw.headers.get("Accept")?.includes("application/json")??!1});_5(u,"mcp.server_connect"),await d.connect(D),t$(u,"mcp.server_connect"),_5(u,"mcp.handle_request");let _=await J8(d,D,u.req.raw,`mcp:${t}`);return t$(u,"mcp.handle_request"),_}catch(E){if(E instanceof rH)throw E;let c=await f.storage.connections.findById(t,f.organization?.id);if(c?.connection_url){let w=await Dtu({error:E,reqUrl:new URL(u.req.raw.url),connectionId:t,connectionUrl:c.connection_url,headers:{},orgSlug:f.organization?.slug});if(w)return w;v$i(t);let{shouldDisable:$}=await Bcu().recordFailure(t);if($&&c.status==="active")await f.storage.connections.update(t,{status:"error"}),console.warn("[proxy] auto-disabled connection after sustained failures",{connectionId:t,org:f.organization?.slug,error:E.message})}throw E}}catch(E){return pS0(E,u)}}),i.all("/:connectionId/call-tool/:toolName",async(u)=>{let t=u.req.param("connectionId"),f=u.req.param("toolName"),l=u.get("studioContext");try{let E=await l.storage.connections.findById(t,l.organization?.id);if(!E)return u.json({error:"Connection not found"},404);let w=await(await F6(E,l,!1)).callTool({name:f,arguments:await u.req.json()});if(w.isError)return new Response(JSON.stringify(w.content),{headers:{"Content-Type":"application/json"},status:500});return new Response(JSON.stringify(w.structuredContent??w.content),{headers:{"Content-Type":"application/json"}})}catch(E){let c=await l.storage.connections.findById(t,l.organization?.id);if(c?.connection_url){let w=await Dtu({error:E,reqUrl:new URL(u.req.raw.url),connectionId:t,connectionUrl:c.connection_url,headers:{},orgSlug:l.organization?.slug});if(w)return w}return pS0(E,u)}}),i};var oTi=O(()=>{gN();Qn();Ef();Iri();$g();ws();Ia();E$();Vm();CS0();bpi();Fcu();aS0();mTi();MTi();nt();epi()});async function vO(i,u,t,f){if(u.type!=="event"||!u.connection_id)return{success:!0};let l=await i.storage.connections.findById(u.connection_id);if(!l)return{success:!0};let E=i.organization?.id,c=i.organization?.slug;try{let w=await F6(l,i,!0),$=Ktu.forClient(mpi(w)),h,v,d;if(t&&f&&E){let F=await f.generateTokenPair();v=F.plaintext,d=F.hash,h=c?`${i.baseUrl}/api/${c}/trigger-callback`:`${i.baseUrl}/api/trigger-callback`}let D=5000,_=!1,N=new Promise((F,g)=>setTimeout(()=>{_=!0,g(Error("TRIGGER_CONFIGURE timeout"))},D)),Z;try{Z=await Promise.race([$.TRIGGER_CONFIGURE({type:u.event_type,params:JSON.parse(u.params??"{}"),enabled:t,callbackUrl:h,callbackToken:v}),N])}catch(F){if(_&&t&&f&&E&&d)await f.persistTokenHash(E,u.connection_id,d);return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE threw on connection=${u.connection_id} type=${u.event_type}:`,F),{success:!1,error:String(F)}}let B=Z;if(!B||B.success!==!0)return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE did not return success=true on connection=${u.connection_id} type=${u.event_type}. Raw payload:`,JSON.stringify(Z)),{success:!1,error:`TRIGGER_CONFIGURE did not return success=true (got ${JSON.stringify(Z)})`};try{if(t&&f&&E&&d)await f.persistTokenHash(E,u.connection_id,d);if(!t&&f&&E)await f.deleteByConnection(u.connection_id,E)}catch(F){console.error("[configureTriggerOnMcp] Token persistence failed after successful TRIGGER_CONFIGURE:",F)}return{success:!0}}catch(w){return{success:!1,error:String(w)}}}var hs=O(()=>{gN();oTi();Ytu()});import{z as l1}from"zod";var Ucu;var iL0=O(()=>{DY();fu();U$();hs();Ucu=p({name:"AUTOMATION_UPDATE",description:"Update an automation's config. Toggling active state reconfigures event triggers on MCPs.",annotations:{title:"Update Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l1.object({id:l1.string(),name:l1.string().min(1).max(255).optional(),active:l1.boolean().optional(),messages:l1.union([l1.string(),l1.array(l1.looseObject({id:l1.string().optional(),role:l1.enum(["user","assistant","system"]),parts:l1.array(l1.record(l1.string(),l1.unknown())),metadata:l1.unknown().optional()}))]).optional(),models:l1.object({tier:O8,modelId:l1.string().optional(),credentialId:l1.string().optional()}).loose().optional(),tools:l1.array(l1.string()).nullable().optional(),maxAgentSteps:l1.number().int().min(1).max(100).nullable().optional(),temperature:l1.number().optional()}),outputSchema:l1.object({id:l1.string(),name:l1.string(),active:l1.boolean(),updated_at:l1.string()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findById(i.id,t.id);if(!f)throw Error("Automation not found");let l={};if(i.name!==void 0)l.name=i.name;if(i.active!==void 0)l.active=i.active;if(i.messages!==void 0){let c=QTi(i.messages);l.messages=JSON.stringify(c)}if(i.models!==void 0)l.models=JSON.stringify(i.models);if(i.tools!==void 0)l.tools=i.tools===null?null:JSON.stringify(i.tools);if(i.temperature!==void 0)l.temperature=i.temperature;if(i.maxAgentSteps!==void 0)l.max_agent_steps=i.maxAgentSteps;let E=await u.storage.automations.update(i.id,t.id,l);if(i.active!==void 0&&i.active!==f.active){let c=await u.storage.automations.listTriggers(E.id),w=c.filter(($)=>$.type==="event");await Promise.allSettled(w.map(async($)=>{let h=await vO(u,$,i.active);if(!h.success)console.warn(`Failed to configure trigger ${$.id}: ${h.error}`)})),await LS0(c,i.active)}return{id:E.id,name:E.name,active:E.active,updated_at:E.updated_at}}})});import{z as sTi}from"zod";var Tcu;var uL0=O(()=>{DY();z4();fu();hs();Tcu=p({name:"AUTOMATION_DELETE",description:"Permanently delete an automation. Disables all event triggers on connected MCPs first.",annotations:{title:"Delete Automation",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:sTi.object({id:sTi.string()}),outputSchema:sTi.object({success:sTi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),!await u.storage.automations.findById(i.id,t.id))throw Error("Automation not found");let l=await u.storage.automations.listTriggers(i.id),E=l.filter(($)=>$.type==="event");await Promise.allSettled(E.map(async($)=>{let h=await vO(u,$,!1);if(!h.success)console.warn(`Failed to disable trigger ${$.id}: ${h.error}`)}));let{success:c}=await u.storage.automations.delete(i.id,t.id);await QS0(l);let w=Qu(u);if(w)mu.capture({distinctId:w,event:"automation_deleted",groups:{organization:t.id},properties:{organization_id:t.id,automation_id:i.id,trigger_count:l.length}});return{success:c}}})});function zn(i){return`webhook_${i}`}function pTi(i,u,t){if(!u)throw Error("Cannot build webhook URL: organization slug missing from request context");return`${i}/api/${u}/webhooks/${t}`}import{z as zE}from"zod";var tL0=300000,dof=10,Acu;var fL0=O(()=>{lcu();DY();fcu();fu();hs();Acu=p({name:"AUTOMATION_TRIGGER_ADD",description:"Add a cron, event, or webhook trigger to an automation. For webhook triggers the response includes a one-time URL + secret token.",annotations:{title:"Add Trigger",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:zE.object({automation_id:zE.string(),type:zE.enum(["cron","event","webhook"]),cron_expression:zE.string().optional(),connection_id:zE.string().optional(),event_type:zE.string().optional(),params:zE.record(zE.string(),zE.string()).optional()}),outputSchema:zE.object({id:zE.string(),automation_id:zE.string(),type:zE.enum(["cron","event","webhook"]),created_at:zE.string(),webhook:zE.object({url:zE.string(),token:zE.string()}).nullable().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findById(i.automation_id,t.id);if(!f)throw Error("Automation not found");if(i.type==="cron"){if(!i.cron_expression)throw Error("cron_expression is required for cron triggers");let $=new zTi(i.cron_expression,{timezone:"UTC"}).nextRuns(dof);if($.length===0)throw Error("Cron expression has no future runs");let h=1/0;for(let v=1;v<$.length;v++){let d=$[v].getTime()-$[v-1].getTime();if(d<h)h=d}if($.length>=2&&Number.isFinite(h)&&h<tL0){let v=tL0/1000;throw Error(`Cron fires too frequently \u2014 minimum interval is ${v}s between runs (observed ${h/1000}s)`)}}if(i.type==="event"){if(!i.connection_id)throw Error("connection_id is required for event triggers");if(!i.event_type)throw Error("event_type is required for event triggers");if(!await u.storage.connections.findById(i.connection_id,t.id))throw Error("Connection not found");let $={id:"",automation_id:i.automation_id,type:"event",cron_expression:null,connection_id:i.connection_id,event_type:i.event_type,params:i.params?JSON.stringify(i.params):null,last_run_at:null,next_run_at:null,api_key_id:null,created_at:""},h=await vO(u,$,!0,u.storage.triggerCallbackTokens);if(!h.success)throw Error(`Failed to configure trigger on connection: ${h.error}`)}let l=i.type==="cron"&&i.cron_expression?nTi(i.cron_expression,new Date):null,E=await u.storage.automations.addTrigger({automation_id:i.automation_id,type:i.type,cron_expression:i.type==="cron"?i.cron_expression:null,connection_id:i.type==="event"?i.connection_id:null,event_type:i.type==="event"?i.event_type:null,params:i.params?JSON.stringify(i.params):null,next_run_at:l?.toISOString()??null}),c=null;if(i.type==="webhook")try{let w=await u.boundAuth.apiKey.create({name:`webhook:${f.name}:${E.id.slice(0,8)}`,permissions:{[zn(E.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:f.id,trigger_id:E.id}});await u.storage.automations.setTriggerApiKeyId(E.id,w.id),c={url:pTi(u.baseUrl,t.slug,E.id),token:w.key}}catch(w){await u.storage.automations.removeTrigger(E.id,E.automation_id);let $=w instanceof Error?w.message:String(w);throw Error(`Failed to mint webhook token: ${$}`)}return await bTi(E,f),{id:E.id,automation_id:E.automation_id,type:E.type,created_at:E.created_at,webhook:c}}})});import{z as iAi}from"zod";var ycu;var lL0=O(()=>{DY();fu();hs();ycu=p({name:"AUTOMATION_TRIGGER_REMOVE",description:"Remove a trigger from an automation. Disables associated event listeners on MCPs.",annotations:{title:"Remove Trigger",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:iAi.object({trigger_id:iAi.string()}),outputSchema:iAi.object({success:iAi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findTriggerById(i.trigger_id);if(!f)throw Error("Trigger not found");if(!await u.storage.automations.findById(f.automation_id,t.id))throw Error("Automation not found");if(f.type==="event"){let c=await vO(u,f,!1,u.storage.triggerCallbackTokens);if(!c.success)console.warn(`Failed to disable trigger ${f.id}: ${c.error}`)}let{success:E}=await u.storage.automations.removeTrigger(f.id,f.automation_id);if(f.type==="cron")await Dcu(f.id);if(f.type==="webhook"&&f.api_key_id)try{await u.boundAuth.apiKey.delete(f.api_key_id)}catch(c){console.warn(`[trigger-remove] failed to delete api key ${f.api_key_id} for trigger ${f.id}:`,c instanceof Error?c.message:c)}return{success:E}}})});import{z as nn}from"zod";var Pcu;var EL0=O(()=>{fu();Pcu=p({name:"AUTOMATION_TRIGGER_ROTATE_TOKEN",description:"Rotate the secret token for a webhook automation trigger. Returns a new token; the old token is revoked.",annotations:{title:"Rotate Webhook Token",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:nn.object({trigger_id:nn.string()}),outputSchema:nn.object({trigger_id:nn.string(),url:nn.string(),token:nn.string()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.automations.findTriggerById(i.trigger_id);if(!f)throw Error("Trigger not found");if(f.type!=="webhook")throw Error("Trigger is not a webhook trigger");let l=await u.storage.automations.findById(f.automation_id,t.id);if(!l)throw Error("Automation not found");let E=f.api_key_id,c=await u.boundAuth.apiKey.create({name:`webhook:${l.name}:${f.id.slice(0,8)}`,permissions:{[zn(f.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:l.id,trigger_id:f.id}});if(await u.storage.automations.setTriggerApiKeyId(f.id,c.id),E)try{await u.boundAuth.apiKey.delete(E)}catch(w){console.warn(`[trigger-rotate] failed to delete old key ${E} for trigger ${f.id}:`,w instanceof Error?w.message:w)}return{trigger_id:f.id,url:pTi(u.baseUrl,t.slug,f.id),token:c.key}}})});import{z as Rn}from"zod";var Gcu;var cL0=O(()=>{z4();fu();Gcu=p({name:"AUTOMATION_RUN",description:"Manually trigger an automation run. Bypasses configured triggers.",annotations:{title:"Run Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:Rn.object({id:Rn.string()}),outputSchema:Rn.object({threadId:Rn.string().optional(),error:Rn.string().optional(),skipped:Rn.string().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),!u.automationRunner)throw Error("Automation runner not available");let f=Qu(u);if(!f)throw Error("User ID not available");let l=await u.automationRunner(i.id,t.id,f);if(mu.capture({distinctId:f,event:"automation_run",groups:{organization:t.id},properties:{organization_id:t.id,automation_id:i.id,thread_id:"taskId"in l?l.taskId:void 0,status:"skipped"in l?"skipped":("error"in l)?"error":"started",skip_reason:"skipped"in l?l.skipped:void 0,error_message:"error"in l?l.error:void 0}}),"skipped"in l)return{skipped:l.skipped};if("error"in l)return{threadId:l.taskId,error:l.error};return{threadId:l.taskId}}})});import{z as EE}from"zod";var Dof=500,Icu;var wL0=O(()=>{J1();fu();Icu=p({name:"AUTOMATION_RUN_STATS",description:"Aggregate run counts (by status) and LLM token/cost totals for a single automation.",annotations:{title:"Automation Run Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:EE.object({automation_id:EE.string(),startDate:EE.string().datetime().optional().describe("Filter runs at or after this ISO timestamp"),endDate:EE.string().datetime().optional().describe("Filter runs at or before this ISO timestamp")}),outputSchema:EE.object({runs:EE.object({total:EE.number(),completed:EE.number(),failed:EE.number(),inProgress:EE.number()}),usage:EE.object({calls:EE.number(),inputTokens:EE.number(),outputTokens:EE.number(),totalTokens:EE.number(),costUsd:EE.number(),sampledRuns:EE.number(),truncated:EE.boolean()})}),handler:async(i,u)=>{gi(u);let t=Zi(u);if(await u.access.check(),await E5(),!await u.storage.automations.findById(i.automation_id,t.id))throw Error("Automation not found");let l=await u.storage.automations.getRunStats(i.automation_id,t.id,{startDate:i.startDate,endDate:i.endDate}),E=await u.storage.automations.listRunThreadIds(i.automation_id,t.id,{startDate:i.startDate,endDate:i.endDate,limit:Dof}),c={calls:0,inputTokens:0,outputTokens:0,totalTokens:0,costUsd:0,sampledRuns:E.length,truncated:l.total>E.length};if(E.length>0){let w=await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:"decopilot",threadIds:E,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});for(let $ of w)c.calls+=$.calls,c.inputTokens+=$.inputTokens,c.outputTokens+=$.outputTokens,c.totalTokens+=$.totalTokens,c.costUsd+=$.costUsd}return{runs:l,usage:c}}})});var $L0=O(()=>{yS0();PS0();GS0();iL0();uL0();fL0();lL0();EL0();cL0();wL0()});import{z as dO}from"zod";var Nof,Oof,xcu;var hL0=O(()=>{fu();Nof=dO.object({id:dO.string().min(1)}),Oof=dO.object({user:dO.object({id:dO.string(),name:dO.string(),email:dO.string(),image:dO.string().nullable()}).nullable()}),xcu=p({name:"USER_GET",description:"Get a user's profile by ID. Only returns users who share an organization with the caller.",annotations:{title:"Get User",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Nof,outputSchema:Oof,handler:async(i,u)=>{await u.access.check(),gi(u);let t=Qu(u);if(!t)throw Error("Authentication required");let f=await u.storage.users.findById(i.id,t);if(!f)return{user:null};return{user:{id:f.id,name:f.name,email:f.email,image:f.image??null}}}})});import{z as Zof}from"zod";var Bof,kcu;var vL0=O(()=>{fu();U$();Bof={tiers:{}},kcu=p({name:"USER_MODEL_PREFERENCES_GET",description:"Get the calling user's personal chat tier \u2192 model overrides for the current organization. Absent tiers fall back to the org default.",annotations:{title:"Get User Model Preferences",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Zof.object({}),outputSchema:ra,handler:async(i,u)=>{gi(u),await u.access.check();let t=Zi(u),f=u.auth?.user?.id;if(!f)throw Error("No authenticated user in context");return await u.storage.userModelPreferences.get(f,t.id)??Bof}})});function Fof(i){if(!i)return;if(!("models"in i))return;return i.models??void 0}function dL0(i,u){if(!i)return!0;if(i.includes("*:*"))return!0;return i.some((t)=>t.startsWith(`${u}:`))}function Lv(i,u,t){if(!i)return!0;return i.includes("*:*")||i.includes(`${u}:*`)||i.includes(`${u}:${t}`)}function uAi(i,u){if(i===void 0)return u;let t=u;if(t.image&&!Lv(i,t.image.credentialId,t.image.id)){let{image:f,...l}=t;t=l}if(t.webSearch&&!Lv(i,t.webSearch.credentialId,t.webSearch.id)){let{webSearch:f,...l}=t;t=l}if(t.deepResearch&&!Lv(i,t.deepResearch.credentialId,t.deepResearch.id)){let{deepResearch:f,...l}=t;t=l}return t}function DL0(i){if(!i)return{allowAll:!0,models:{}};if(i.includes("*:*"))return{allowAll:!0,models:{}};let u={};for(let t of i){let f=t.indexOf(":");if(f===-1)continue;let l=t.slice(0,f),E=t.slice(f+1);if(!u[l])u[l]=[];u[l].push(E)}return{allowAll:!1,models:u}}function gof(i){if(i.some((t)=>t===void 0))return;let u=new Set;for(let t of i)for(let f of t??[])u.add(f);return[...u]}async function Qv(i,u,t){if(!t||A5(t))return;let f=t.split(","),l=await i.selectFrom("organizationRole").select(["role","permission"]).where("organizationId","=",u).where("role","in",f).execute(),E=new Map(l.map((w)=>[w.role,w.permission])),c=f.map((w)=>{let $=E.get(w);if(!$)return;try{let h=JSON.parse($);return Fof(h)}catch{return console.error(`[model-permissions] Failed to parse permissions for role: ${w}`),[]}});return gof(c)}var bn=O(()=>{y5()});function Uof(i,u,t){let f={};for(let l of O8.options){let E=i[l];if(!E||Lv(t,E.keyId,E.modelId)){f[l]=E;continue}let c=u?.[l];if(!(c?.keyId===E.keyId&&c?.modelId===E.modelId))throw Error("Model not allowed for your role");f[l]=null}return f}var jcu;var _L0=O(()=>{fu();U$();bn();jcu=p({name:"USER_MODEL_PREFERENCES_UPDATE",description:"Set the calling user's personal chat tier \u2192 model overrides for the current organization. Only affects this user's chats; the org default and every non-chat path (automations, background tools) are unchanged. Omit a tier (or set it null) to fall back to the org default. Models the caller's role is not allowed to use are rejected.",annotations:{title:"Update User Model Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ra,outputSchema:ra,handler:async(i,u)=>{gi(u),await u.access.check();let t=Zi(u),f=u.auth?.user?.id;if(!f)throw Error("No authenticated user in context");let[l,E]=await Promise.all([Qv(u.db,t.id,t.role??u.auth.user?.role),u.storage.userModelPreferences.get(f,t.id)]);return await u.storage.userModelPreferences.upsert(f,t.id,{tiers:Uof(i.tiers,E?.tiers,l)})}})});var NL0=O(()=>{hL0();vL0();_L0()});import W$ from"zod";var Xcu;var OL0=O(()=>{fu();v8();Xcu=p({name:"AI_PROVIDERS_LIST",description:"List all supported AI providers and their connection methods (API key, OAuth).",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:W$.object({}),outputSchema:W$.object({providers:W$.array(W$.object({id:W$.string(),name:W$.string(),description:W$.string(),logo:W$.string().optional(),supportedMethods:W$.array(W$.enum(["api-key","oauth-pkce"])),supportsTopUp:W$.boolean().optional(),supportsCredits:W$.boolean().optional(),supportsProvision:W$.boolean().optional()}))}),handler:async(i,u)=>{return gi(u),Zi(u),await u.access.check(),{providers:Object.values(x6()).filter((f)=>!!f).map((f)=>({...f.info,supportedMethods:f.supportedMethods,supportsTopUp:!!f.getTopUpUrl,supportsCredits:!!f.getCreditsBalance,supportsProvision:!!f.provisionKey}))}}})});var Jcu;var ZL0=O(()=>{Jcu=[{providerId:"claude-code",modelId:"claude-code:haiku",title:"Claude Code Haiku",description:"Fast and lightweight",capabilities:["text"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:sonnet",title:"Claude Code Sonnet 5",description:"Balanced performance",capabilities:["text","reasoning"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:opus",title:"Claude Code Opus",description:"Most capable",capabilities:["text","reasoning"],limits:null,costs:null},{providerId:"claude-code",modelId:"claude-code:opus-1m",title:"Claude Code Opus 5 1M",description:"Most capable, 1M context window",capabilities:["text","reasoning"],limits:{contextWindow:1e6,maxOutputTokens:null},costs:null}]});var BL0=O(()=>{ZL0()});var Kcu;var FL0=O(()=>{Kcu=[{providerId:"codex",modelId:"codex:gpt-5.6-sol",title:"GPT-5.6 Sol",description:"Frontier Codex model for deep reasoning, complex coding, and real-world work",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.6-terra",title:"GPT-5.6 Terra",description:"Balanced Codex model for everyday coding and agent work",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.6-luna",title:"GPT-5.6 Luna",description:"Fast Codex model for lightweight coding tasks and titles",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null},{providerId:"codex",modelId:"codex:gpt-5.3-codex-spark",title:"GPT-5.3 Codex Spark",description:"Ultra-fast coding model",capabilities:["text","reasoning"],logo:"https://assets.decocache.com/decocms/6ac44f1c-c0cf-4480-84b5-2ae6fe742d0b/codex-app.png.png",limits:null,costs:null}]});var gL0=O(()=>{FL0()});import X6 from"zod";var Ycu;var UL0=O(()=>{fu();bn();BL0();gL0();Ycu=p({name:"AI_PROVIDERS_LIST_MODELS",description:"List models available from an AI provider. Requires a valid stored API key.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:X6.object({keyId:X6.string().describe("The provider key ID to use")}),outputSchema:X6.object({models:X6.array(X6.object({providerId:X6.string(),modelId:X6.string(),title:X6.string(),description:X6.string().nullish(),logo:X6.string().nullish(),capabilities:X6.array(X6.string()),limits:X6.object({contextWindow:X6.coerce.number(),maxOutputTokens:X6.coerce.number().nullable()}).nullish(),costs:X6.object({input:X6.coerce.number(),output:X6.coerce.number()}).nullish(),asyncResearch:X6.boolean().optional()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.findById(i.keyId,t.id).catch(()=>null);if(f?.providerId==="claude-code")return{models:Jcu};if(f?.providerId==="codex")return{models:Kcu};let[l,E]=await Promise.all([u.aiProviders.listModels(i.keyId,t.id),Qv(u.db,t.id,t.role??u.auth.user?.role)]);return{models:l.filter((w)=>Lv(E,i.keyId,w.modelId))}}})});import l7 from"zod";var Wcu;var TL0=O(()=>{fu();v8();Wcu=p({name:"AI_PROVIDERS_ACTIVE",description:"List AI providers that have at least one API key configured and ready to use.",inputSchema:l7.object({}),outputSchema:l7.object({providers:l7.array(l7.object({id:l7.string(),name:l7.string(),description:l7.string(),logo:l7.string().optional(),keyCount:l7.number()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.list({organizationId:t.id}),l=new Map;for(let c of f)l.set(c.providerId,(l.get(c.providerId)??0)+1);return{providers:[...l.entries()].flatMap(([c,w])=>{let h=x6()[c];if(!h)return console.warn(`AI provider "${c}" has stored keys but is not in the registry; skipping.`),[];return[{...h.info,keyCount:w}]})}}})});var DO=O(()=>{nt()});import Hv from"zod";var OY,Scu;var vs=O(()=>{z4();fu();DO();OY=Hv.object({id:Hv.string(),providerId:Hv.string(),label:Hv.string(),presetId:Hv.string().nullable(),createdAt:Hv.string()}),Scu=p({name:"AI_PROVIDER_KEY_CREATE",description:"Store an API key for an AI provider. The key is encrypted at rest in the vault.",inputSchema:Hv.object({providerId:Hv.enum(vc),label:Hv.string().min(1).max(100),apiKey:Hv.string().min(1),presetId:Hv.string().min(1).max(64).optional()}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.create({providerId:i.providerId,label:i.label,apiKey:i.apiKey,organizationId:t.id,createdBy:u.auth.user.id,presetId:i.presetId??null});return mu.capture({distinctId:u.auth.user.id,event:"ai_provider_key_created",groups:{organization:t.id},properties:{organization_id:t.id,provider_id:f.providerId,preset_id:f.presetId,key_id:f.id,label:f.label}}),{id:f.id,providerId:f.providerId,label:f.label,presetId:f.presetId,createdAt:f.createdAt}}})});import tAi from"zod";var Cn=(i,u)=>i&&i.keyId===u?null:i,Aof=(i,u)=>{let t={tiers:{fast:Cn(i.tiers.fast,u),smart:Cn(i.tiers.smart,u),thinking:Cn(i.tiers.thinking,u),image:Cn(i.tiers.image,u),web_search:Cn(i.tiers.web_search,u),deep_research:Cn(i.tiers.deep_research,u)}},f=t.tiers.fast!==i.tiers.fast||t.tiers.smart!==i.tiers.smart||t.tiers.thinking!==i.tiers.thinking||t.tiers.image!==i.tiers.image||t.tiers.web_search!==i.tiers.web_search||t.tiers.deep_research!==i.tiers.deep_research;return{config:t,changed:f}},Lcu;var AL0=O(()=>{z4();fu();Lcu=p({name:"AI_PROVIDER_KEY_DELETE",description:"Delete a stored AI provider API key. Cannot be undone.",inputSchema:tAi.object({keyId:tAi.string().describe("The provider key ID to delete")}),outputSchema:tAi.object({success:tAi.boolean()}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.organizationSettings.get(t.id);if(f?.simple_mode){let{config:l,changed:E}=Aof(f.simple_mode,i.keyId);if(E)await u.storage.organizationSettings.upsert(t.id,{simple_mode:l})}return await u.storage.aiProviderKeys.delete(i.keyId,t.id),mu.capture({distinctId:u.auth.user.id,event:"ai_provider_key_deleted",groups:{organization:t.id},properties:{organization_id:t.id,key_id:i.keyId}}),{success:!0}}})});import fAi from"zod";var Qcu;var yL0=O(()=>{fu();vs();Qcu=p({name:"AI_PROVIDER_KEY_UPDATE",description:"Update the label and/or API key of a stored AI provider key. Pass apiKey to rotate the stored credential.",inputSchema:fAi.object({keyId:fAi.string(),label:fAi.string().min(1).max(100).optional(),apiKey:fAi.string().min(1).optional()}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=await u.storage.aiProviderKeys.updateKey(i.keyId,t.id,{label:i.label,apiKey:i.apiKey});return{id:f.id,providerId:f.providerId,label:f.label,presetId:f.presetId,createdAt:f.createdAt}}})});import Mn from"zod";var Hcu;var PL0=O(()=>{fu();Hcu=p({name:"AI_PROVIDER_KEY_PREVIEW",description:"Get the label and a masked preview of a stored AI provider API key. The API key is partially obscured (only the last 4 characters are visible). For openai-compatible keys the baseUrl is also returned.",inputSchema:Mn.object({keyId:Mn.string()}),outputSchema:Mn.object({label:Mn.string(),maskedKey:Mn.string(),baseUrl:Mn.string().optional()}),handler:async(i,u)=>{gi(u);let t=Zi(u);return await u.access.check(),u.storage.aiProviderKeys.getPreview(i.keyId,t.id)}})});import zv from"zod";var zcu;var GL0=O(()=>{fu();DO();bn();zcu=p({name:"AI_PROVIDER_KEY_LIST",description:"List stored AI provider API keys. Returns metadata only \u2014 secrets are never exposed.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:zv.object({providerId:zv.enum(vc).optional()}),outputSchema:zv.object({keys:zv.array(zv.object({id:zv.string(),providerId:zv.string(),label:zv.string(),presetId:zv.string().nullable(),createdBy:zv.string(),createdAt:zv.string()}))}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let[f,l]=await Promise.all([u.storage.aiProviderKeys.list({organizationId:t.id,providerId:i.providerId}),Qv(u.db,t.id,t.role??u.auth.user?.role)]);return{keys:f.filter((w)=>dL0(l,w.id)).map(({organizationId:w,...$})=>$)}}})});import{createHash as yof,randomBytes as Pof}from"crypto";function IL0(){return Pof(32).toString("base64url")}function xL0(i){return yof("sha256").update(i).digest("base64url")}var kL0=()=>{};import qn from"zod";function jL0(i){return i==="localhost"||i.endsWith(".localhost")||i==="127.0.0.1"||i==="[::1]"||i==="::1"}function Gof(i){let u=vu(),t=u.baseUrl??`http://localhost:${u.port}`,f=new URL(i),l=new URL(t);if(f.origin===l.origin)return!0;return f.protocol===l.protocol&&jL0(f.hostname)&&jL0(l.hostname)}var ncu;var XL0=O(()=>{fu();DO();v8();kL0();n0();ncu=p({name:"AI_PROVIDER_OAUTH_URL",description:"Get the OAuth PKCE authorization URL for a provider. Returns URL and state token.",inputSchema:qn.object({providerId:qn.enum(vc),callbackUrl:qn.string().url().refine((i)=>{return Gof(i)},{message:"callbackUrl must be on the same origin as BASE_URL"})}),outputSchema:qn.object({url:qn.string(),stateToken:qn.string().describe("Opaque token \u2014 pass to AI_PROVIDER_OAUTH_EXCHANGE")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=x6()[i.providerId];if(!f)throw Error(`Unknown provider: ${i.providerId}`);if(!f.supportedMethods.includes("oauth-pkce")||!f.getOAuthUrl)throw Error(`Provider ${i.providerId} does not support OAuth PKCE`);let l=IL0(),E=xL0(l),c=await u.storage.oauthPkceStates.create(l,t.id,u.auth.user.id),w=new URL(i.callbackUrl);w.searchParams.set("state",c);let $={callbackUrl:w.toString(),codeChallenge:E,codeChallengeMethod:"S256",organizationId:t.id};return{url:f.getOAuthUrl($),stateToken:c}}})});import ds from"zod";var Rcu;var JL0=O(()=>{fu();DO();v8();vs();Rcu=p({name:"AI_PROVIDER_OAUTH_EXCHANGE",description:"Exchange an OAuth authorization code for an API key. Completes the OAuth flow started by AI_PROVIDER_OAUTH_URL.",inputSchema:ds.object({providerId:ds.enum(vc),code:ds.string(),stateToken:ds.string().describe("The stateToken returned by AI_PROVIDER_OAUTH_URL"),label:ds.string().min(1).max(100)}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=x6()[i.providerId];if(!f)throw Error(`Unknown provider: ${i.providerId}`);if(!f.supportedMethods.includes("oauth-pkce")||!f.exchangeOAuthCode)throw Error(`Provider ${i.providerId} does not support OAuth PKCE`);let l=Qu(u);if(!l)throw Error("Unable to determine user ID");let E=await u.storage.oauthPkceStates.consume(i.stateToken,t.id,l),{apiKey:c}=await f.exchangeOAuthCode({code:i.code,codeVerifier:E,codeChallengeMethod:"S256"}),w=await u.storage.aiProviderKeys.upsert({providerId:i.providerId,label:i.label,apiKey:c,organizationId:t.id,createdBy:l});return{id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdAt:w.createdAt}}})});import KL0 from"zod";var bcu;var YL0=O(()=>{fu();DO();v8();O9();vs();bcu=p({name:"AI_PROVIDER_PROVISION_KEY",description:"Auto-provision an API key for a provider that supports server-to-server key creation (e.g. Deco AI Gateway).",inputSchema:KL0.object({providerId:KL0.enum(vc)}),outputSchema:OY,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=x6()[i.providerId];if(!l)throw Error(`Unknown provider: ${i.providerId}`);if(!l.provisionKey)throw Error(`Provider ${i.providerId} does not support key provisioning`);let E=await nd(f),c=await l.provisionKey(E,t.id),w=await u.storage.aiProviderKeys.upsert({providerId:i.providerId,label:"Auto-provisioned",apiKey:c,organizationId:t.id,createdBy:f});return{id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdAt:w.createdAt}}})});import Vn from"zod";var Ccu;var WL0=O(()=>{Q6i();Cz();fu();Ml();DO();v8();O9();n0();Ccu=p({name:"AI_PROVIDER_TOPUP_URL",description:"Get a checkout URL to top up credits for a provider that supports it (e.g. Deco AI Gateway)",inputSchema:Vn.object({providerId:Vn.enum(vc),amountCents:Vn.number().int().positive().describe("Amount in cents (e.g. 1000 = $10.00)"),currency:Vn.enum(["usd","brl"]).default("usd")}),outputSchema:Vn.object({url:Vn.string().describe("Checkout URL \u2014 open in browser to complete payment")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=vu();if(i.providerId==="deco"&&l.stripeSecretKey&&LL()&&t.slug){let $=await u.storage.organizationBilling.getBilling(t.id),h=`${gE()}/${encodeURIComponent(t.slug)}/settings`,{url:v}=await Hg0({organizationId:t.id,amountCents:i.amountCents,currency:i.currency,feePercent:l.topupFeePercent,customerId:$?.stripeCustomerId??null,successUrl:`${h}?topup=success`,cancelUrl:`${h}?topup=canceled`});return{url:v}}let E=x6()[i.providerId];if(!E)throw Error(`Unknown provider: ${i.providerId}`);if(!E.getTopUpUrl)throw Error(`Provider ${i.providerId} does not support credit top-ups`);let c=await nd(f,u.auth.user?.email);return{url:await E.getTopUpUrl(c,t.id,i.amountCents,i.currency)}}})});import lAi from"zod";var Mcu;var SL0=O(()=>{fu();DO();v8();O9();Mcu=p({name:"AI_PROVIDER_CREDITS",description:"Get the current credit balance for a provider (providers that support it, e.g. Deco AI Gateway)",inputSchema:lAi.object({providerId:lAi.enum(vc)}),outputSchema:lAi.object({balanceCents:lAi.number().describe("Remaining balance in cents (e.g. 1000 = $10.00)")}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=Qu(u);if(!f)throw Error("Unable to determine user ID");let l=x6()[i.providerId];if(!l)throw Error(`Unknown provider: ${i.providerId}`);if(!l.getCreditsBalance)throw Error(`Provider ${i.providerId} does not expose a credits balance`);let E=await nd(f);return l.getCreditsBalance(E,t.id)}})});var LL0=O(()=>{OL0();UL0();TL0();vs();AL0();yL0();PL0();GL0();XL0();JL0();YL0();WL0();SL0()});import K8 from"zod";var EAi;var qcu=O(()=>{EAi=K8.object({id:K8.string(),scope:K8.enum(["user","organization"]),userId:K8.string().nullable(),name:K8.string(),description:K8.string().nullable(),createdBy:K8.string(),createdAt:K8.string(),updatedBy:K8.string(),updatedAt:K8.string()})});import Ds from"zod";var Vcu;var QL0=O(()=>{fu();qcu();Vcu=p({name:"SECRET_CREATE",description:"Create a secret. The value is encrypted at rest in the credential vault and never returned by any tool. Scope 'user' is private to the caller within this organization; scope 'organization' is visible to all org members.",inputSchema:Ds.object({scope:Ds.enum(["user","organization"]),name:Ds.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/,{message:"Name may only contain letters, digits, underscore, dot, and hyphen."}),value:Ds.string().min(1),description:Ds.string().max(500).optional()}),outputSchema:EAi,handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=u.auth.user.id,l=i.scope==="user"?{kind:"user",userId:f}:{kind:"organization"};return await u.storage.secrets.create({organizationId:t.id,scope:l,name:i.name,value:i.value,description:i.description??null,createdBy:f})}})});import cAi from"zod";var rcu;var HL0=O(()=>{fu();qcu();rcu=p({name:"SECRET_LIST",description:"List secrets visible to the caller: all organization-scoped secrets, plus user-scoped secrets owned by the caller. Values are never returned.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:cAi.object({scope:cAi.enum(["user","organization"]).optional()}),outputSchema:cAi.object({secrets:cAi.array(EAi)}),handler:async(i,u)=>{gi(u);let t=Zi(u);await u.access.check();let f=u.auth.user.id,l=i.scope==="user"?{kind:"user",userId:f}:i.scope==="organization"?{kind:"organization"}:void 0;return{secrets:await u.storage.secrets.list({organizationId:t.id,callerUserId:f,scope:l})}}})});var zL0=O(()=>{QL0();HL0()});var ZY=Y((Yof)=>{var mcu;(function(i){i.HEADER="header",i.QUERY="query"})(mcu||(mcu={}));var ecu;(function(i){i.HEADER="header",i.QUERY="query"})(ecu||(ecu={}));var acu;(function(i){i.HTTP="http",i.HTTPS="https"})(acu||(acu={}));var _s;(function(i){i.MD5="md5",i.CRC32="crc32",i.CRC32C="crc32c",i.SHA1="sha1",i.SHA256="sha256"})(_s||(_s={}));var kof=(i)=>{let u=[];if(i.sha256!==void 0)u.push({algorithmId:()=>_s.SHA256,checksumConstructor:()=>i.sha256});if(i.md5!=null)u.push({algorithmId:()=>_s.MD5,checksumConstructor:()=>i.md5});return{addChecksumAlgorithm(t){u.push(t)},checksumAlgorithms(){return u}}},jof=(i)=>{let u={};return i.checksumAlgorithms().forEach((t)=>{u[t.algorithmId()]=t.checksumConstructor()}),u},Xof=(i)=>{return kof(i)},Jof=(i)=>{return jof(i)},ocu;(function(i){i[i.HEADER=0]="HEADER",i[i.TRAILER=1]="TRAILER"})(ocu||(ocu={}));var Kof="__smithy_context",scu;(function(i){i.PROFILE="profile",i.SSO_SESSION="sso-session",i.SERVICES="services"})(scu||(scu={}));var pcu;(function(i){i.HTTP_0_9="http/0.9",i.HTTP_1_0="http/1.0",i.TDS_8_0="tds/8.0"})(pcu||(pcu={}));Yof.AlgorithmId=_s;Yof.EndpointURLScheme=acu;Yof.FieldPosition=ocu;Yof.HttpApiKeyAuthLocation=ecu;Yof.HttpAuthLocation=mcu;Yof.IniSectionType=scu;Yof.RequestHandlerProtocol=pcu;Yof.SMITHY_CONTEXT_KEY=Kof;Yof.getDefaultClientConfiguration=Xof;Yof.resolveDefaultRuntimeConfig=Jof});var Y8=Y((aof)=>{var{SMITHY_CONTEXT_KEY:nL0}=ZY(),Mof=(i)=>i[nL0]||(i[nL0]={});class wAi{method;protocol;hostname;port;path;query;headers;username;password;fragment;body;constructor(i){this.method=i.method||"GET",this.hostname=i.hostname||"localhost",this.port=i.port,this.query=i.query||{},this.headers=i.headers||{},this.body=i.body,this.protocol=i.protocol?i.protocol.slice(-1)!==":"?`${i.protocol}:`:i.protocol:"https:",this.path=i.path?i.path.charAt(0)!=="/"?`/${i.path}`:i.path:"/",this.username=i.username,this.password=i.password,this.fragment=i.fragment}static clone(i){let u=new wAi({...i,headers:{...i.headers}});if(u.query)u.query=qof(u.query);return u}static isInstance(i){if(!i)return!1;let u=i;return"method"in u&&"protocol"in u&&"hostname"in u&&"path"in u&&typeof u.query==="object"&&typeof u.headers==="object"}clone(){return wAi.clone(this)}}function qof(i){return Object.keys(i).reduce((u,t)=>{let f=i[t];return{...u,[t]:Array.isArray(f)?[...f]:f}},{})}class RL0{statusCode;reason;headers;body;constructor(i){this.statusCode=i.statusCode,this.reason=i.reason,this.headers=i.headers||{},this.body=i.body}static isInstance(i){if(!i)return!1;let u=i;return typeof u.statusCode==="number"&&typeof u.headers==="object"}}var Vof=new RegExp("^(?!.*-$)(?!-)[a-zA-Z0-9-]{1,63}$"),bL0=(i,u=!1)=>{if(!u)return Vof.test(i);let t=i.split(".");for(let f of t)if(!bL0(f))return!1;return!0};function rof(i){return/^[a-z0-9][a-z0-9\.\-]*[a-z0-9]$/.test(i)}var mof=(i)=>{if(typeof i==="function")return i;let u=Promise.resolve(i);return()=>u};function CL0(i){let u={};if(i=i.replace(/^\?/,""),i)for(let t of i.split("&")){let[f,l=null]=t.split("=");if(f=decodeURIComponent(f),l)l=decodeURIComponent(l);if(!(f in u))u[f]=l;else if(Array.isArray(u[f]))u[f].push(l);else u[f]=[u[f],l]}return u}var $Ai=(i)=>{if(typeof i==="string")return $Ai(new URL(i));let{hostname:u,pathname:t,port:f,protocol:l,search:E}=i,c;if(E)c=CL0(E);return{hostname:u,port:f?parseInt(f):void 0,protocol:l,path:t,query:c}},eof=(i)=>{if(typeof i==="object"){if("url"in i){let u=$Ai(i.url);if(i.headers){u.headers={};for(let t in i.headers)u.headers[t.toLowerCase()]=i.headers[t].join(", ")}return u}return i}return $Ai(i)};aof.HttpRequest=wAi;aof.HttpResponse=RL0;aof.getSmithyContext=Mof;aof.isValidHostLabel=bL0;aof.isValidHostname=rof;aof.normalizeProvider=mof;aof.parseQueryString=CL0;aof.parseUrl=$Ai;aof.toEndpointV1=eof});var nv=Y((gsf)=>{var{getSmithyContext:ML0,HttpResponse:csf,toEndpointV1:wsf}=Y8(),hAi=(i)=>{if(typeof i==="function")return i();return i},t3u=(i,u,t,f,l)=>({name:u,namespace:i,traits:t,input:f,output:l}),$sf=(i)=>(u,t)=>async(f)=>{let{response:l}=await u(f),{operationSchema:E}=ML0(t),[,c,w,$,h,v]=E??[];try{let d=await i.protocol.deserializeResponse(t3u(c,w,$,h,v),{...i,...t},l);return{response:l,output:d}}catch(d){if(Object.defineProperty(d,"$response",{value:l,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in d)){try{d.message+=`
   Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.`}catch(_){if(!t.logger||t.logger?.constructor?.name==="NoOpLogger")console.warn("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.");else t.logger?.warn?.("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.")}if(typeof d.$responseBodyText<"u"){if(d.$response)d.$response.body=d.$responseBodyText}try{if(csf.isInstance(l)){let{headers:_={},statusCode:N}=l,Z=Object.entries(_);d.$metadata={httpStatusCode:N,requestId:i3u(/^x-[\w-]+-request-?id$/,Z),extendedRequestId:i3u(/^x-[\w-]+-id-2$/,Z),cfId:i3u(/^x-[\w-]+-cf-id$/,Z)}}}catch(_){}}throw d}},i3u=(i,u)=>{return(u.find(([t])=>{return t.match(i)})||[void 0,void 0])[1]},hsf=(i)=>(u,t)=>async(f)=>{let{operationSchema:l}=ML0(t),[,E,c,w,$,h]=l??[],v=t.endpointV2?async()=>wsf(t.endpointV2):i.endpoint,d=await i.protocol.serializeRequest(t3u(E,c,w,$,h),f.input,{...i,...t,endpoint:v});return u({...f,request:d})},qL0={name:"deserializerMiddleware",step:"deserialize",tags:["DESERIALIZER"],override:!0},VL0={name:"serializerMiddleware",step:"serialize",tags:["SERIALIZER"],override:!0};function vsf(i){return{applyToStack:(u)=>{u.add(hsf(i),VL0),u.add($sf(i),qL0),i.protocol.setSerdeContext(i)}}}class Gw{name;namespace;traits;static assign(i,u){return Object.assign(i,u)}static[Symbol.hasInstance](i){let u=this.prototype.isPrototypeOf(i);if(!u&&typeof i==="object"&&i!==null)return i.symbol===this.symbol;return u}getName(){return this.namespace+"#"+this.name}}class _Ai extends Gw{static symbol=Symbol.for("@smithy/lis");name;traits;valueSchema;symbol=_Ai.symbol}var dsf=(i,u,t,f)=>Gw.assign(new _Ai,{name:u,namespace:i,traits:t,valueSchema:f});class NAi extends Gw{static symbol=Symbol.for("@smithy/map");name;traits;keySchema;valueSchema;symbol=NAi.symbol}var Dsf=(i,u,t,f,l)=>Gw.assign(new NAi,{name:u,namespace:i,traits:t,keySchema:f,valueSchema:l});class OAi extends Gw{static symbol=Symbol.for("@smithy/ope");name;traits;input;output;symbol=OAi.symbol}var _sf=(i,u,t,f,l)=>Gw.assign(new OAi,{name:u,namespace:i,traits:t,input:f,output:l});class Bs extends Gw{static symbol=Symbol.for("@smithy/str");name;traits;memberNames;memberList;symbol=Bs.symbol}var Nsf=(i,u,t,f,l)=>Gw.assign(new Bs,{name:u,namespace:i,traits:t,memberNames:f,memberList:l});class ZAi extends Bs{static symbol=Symbol.for("@smithy/err");ctor;symbol=ZAi.symbol}var Osf=(i,u,t,f,l,E)=>Gw.assign(new ZAi,{name:u,namespace:i,traits:t,memberNames:f,memberList:l,ctor:null}),vAi=[];function Zs(i){if(typeof i==="object")return i;if(i=i|0,vAi[i])return vAi[i];let u={},t=0;for(let f of["httpLabel","idempotent","idempotencyToken","sensitive","httpPayload","httpResponseCode","httpQueryParams"])if((i>>t++&1)===1)u[f]=1;return vAi[i]=u}var Ns={it:Symbol.for("@smithy/nor-struct-it"),ns:Symbol.for("@smithy/ns")},dAi=[],DAi={};class c7{ref;memberName;static symbol=Symbol.for("@smithy/nor");symbol=c7.symbol;name;schema;_isMemberSchema;traits;memberTraits;normalizedTraits;constructor(i,u){this.ref=i,this.memberName=u;let t=[],f=i,l=i;this._isMemberSchema=!1;while(u3u(f))t.push(f[1]),f=f[0],l=hAi(f),this._isMemberSchema=!0;if(t.length>0){this.memberTraits={};for(let E=t.length-1;E>=0;--E){let c=t[E];Object.assign(this.memberTraits,Zs(c))}}else this.memberTraits=0;if(l instanceof c7){let E=this.memberTraits;Object.assign(this,l),this.memberTraits=Object.assign({},E,l.getMemberTraits(),this.getMemberTraits()),this.normalizedTraits=void 0,this.memberName=u??l.memberName;return}if(this.schema=hAi(l),rL0(this.schema))this.name=`${this.schema[1]}#${this.schema[2]}`,this.traits=this.schema[3];else this.name=this.memberName??String(l),this.traits=0;if(this._isMemberSchema&&!u)throw Error(`@smithy/core/schema - NormalizedSchema member init ${this.getName(!0)} missing member name.`)}static[Symbol.hasInstance](i){let u=this.prototype.isPrototypeOf(i);if(!u&&typeof i==="object"&&i!==null)return i.symbol===this.symbol;return u}static of(i){let u=typeof i==="function"||typeof i==="object"&&i!==null;if(typeof i==="number"){if(dAi[i])return dAi[i]}else if(typeof i==="string"){if(DAi[i])return DAi[i]}else if(u){if(i[Ns.ns])return i[Ns.ns]}let t=hAi(i);if(t instanceof c7)return t;if(u3u(t)){let[l,E]=t;if(l instanceof c7)return Object.assign(l.getMergedTraits(),Zs(E)),l;throw Error(`@smithy/core/schema - may not init unwrapped member schema=${JSON.stringify(i,null,2)}.`)}let f=new c7(t);if(u)return i[Ns.ns]=f;if(typeof t==="string")return DAi[t]=f;if(typeof t==="number")return dAi[t]=f;return f}getSchema(){let i=this.schema;if(Array.isArray(i)&&i[0]===0)return i[4];return i}getName(i=!1){let{name:u}=this;return!i&&u&&u.includes("#")?u.split("#")[1]:u||void 0}getMemberName(){return this.memberName}isMemberSchema(){return this._isMemberSchema}isListSchema(){let i=this.getSchema();return typeof i==="number"?i>=64&&i<128:i[0]===1}isMapSchema(){let i=this.getSchema();return typeof i==="number"?i>=128&&i<=255:i[0]===2}isStructSchema(){let i=this.getSchema();if(typeof i!=="object")return!1;let u=i[0];return u===3||u===-3||u===4}isUnionSchema(){let i=this.getSchema();if(typeof i!=="object")return!1;return i[0]===4}isBlobSchema(){let i=this.getSchema();return i===21||i===42}isTimestampSchema(){let i=this.getSchema();return typeof i==="number"&&i>=4&&i<=7}isUnitSchema(){return this.getSchema()==="unit"}isDocumentSchema(){return this.getSchema()===15}isStringSchema(){return this.getSchema()===0}isBooleanSchema(){return this.getSchema()===2}isNumericSchema(){return this.getSchema()===1}isBigIntegerSchema(){return this.getSchema()===17}isBigDecimalSchema(){return this.getSchema()===19}isStreaming(){let{streaming:i}=this.getMergedTraits();return!!i||this.getSchema()===42}isIdempotencyToken(){return!!this.getMergedTraits().idempotencyToken}getMergedTraits(){return this.normalizedTraits??(this.normalizedTraits={...this.getOwnTraits(),...this.getMemberTraits()})}getMemberTraits(){return Zs(this.memberTraits)}getOwnTraits(){return Zs(this.traits)}getKeySchema(){let[i,u]=[this.isDocumentSchema(),this.isMapSchema()];if(!i&&!u)throw Error(`@smithy/core/schema - cannot get key for non-map: ${this.getName(!0)}`);let t=this.getSchema(),f=i?15:t[4]??0;return Os([f,0],"key")}getValueSchema(){let i=this.getSchema(),[u,t,f]=[this.isDocumentSchema(),this.isMapSchema(),this.isListSchema()],l=typeof i==="number"?63&i:i&&typeof i==="object"&&(t||f)?i[3+i[0]]:u?15:void 0;if(l!=null)return Os([l,0],t?"value":"member");throw Error(`@smithy/core/schema - ${this.getName(!0)} has no value member.`)}getMemberSchema(i){let u=this.getSchema();if(this.isStructSchema()&&u[4].includes(i)){let t=u[4].indexOf(i),f=u[5][t];return Os(u3u(f)?f:[f,0],i)}if(this.isDocumentSchema())return Os([15,0],i);throw Error(`@smithy/core/schema - ${this.getName(!0)} has no member=${i}.`)}getMemberSchemas(){let i={};try{for(let[u,t]of this.structIterator())i[u]=t}catch(u){}return i}getEventStreamMember(){if(this.isStructSchema()){for(let[i,u]of this.structIterator())if(u.isStreaming()&&u.isStructSchema())return i}return""}*structIterator(){if(this.isUnitSchema())return;if(!this.isStructSchema())throw Error("@smithy/core/schema - cannot iterate non-struct schema.");let i=this.getSchema(),u=i[4].length,t=i[Ns.it];if(t&&u===t.length){yield*t;return}t=Array(u);for(let f=0;f<u;++f){let l=i[4][f],E=Os([i[5][f],0],l);yield t[f]=[l,E]}i[Ns.it]=t}}function Os(i,u){if(i instanceof c7)return Object.assign(i,{memberName:u,_isMemberSchema:!0});return new c7(i,u)}var u3u=(i)=>Array.isArray(i)&&i.length===2,rL0=(i)=>Array.isArray(i)&&i.length>=5;class Fs extends Gw{static symbol=Symbol.for("@smithy/sim");name;schemaRef;traits;symbol=Fs.symbol}var Zsf=(i,u,t,f)=>Gw.assign(new Fs,{name:u,namespace:i,traits:f,schemaRef:t}),Bsf=(i,u,t,f)=>Gw.assign(new Fs,{name:u,namespace:i,traits:t,schemaRef:f}),Fsf={BLOB:21,STREAMING_BLOB:42,BOOLEAN:2,STRING:0,NUMERIC:1,BIG_INTEGER:17,BIG_DECIMAL:19,DOCUMENT:15,TIMESTAMP_DEFAULT:4,TIMESTAMP_DATE_TIME:5,TIMESTAMP_HTTP_DATE:6,TIMESTAMP_EPOCH_SECONDS:7,LIST_MODIFIER:64,MAP_MODIFIER:128};class E7{namespace;schemas;exceptions;static registries=new Map;constructor(i,u=new Map,t=new Map){this.namespace=i,this.schemas=u,this.exceptions=t}static for(i){if(!E7.registries.has(i))E7.registries.set(i,new E7(i));return E7.registries.get(i)}copyFrom(i){let{schemas:u,exceptions:t}=this;for(let[f,l]of i.schemas)if(!u.has(f))u.set(f,l);for(let[f,l]of i.exceptions)if(!t.has(f))t.set(f,l)}register(i,u){let t=this.normalizeShapeId(i);for(let f of[this,E7.for(t.split("#")[0])])f.schemas.set(t,u)}getSchema(i){let u=this.normalizeShapeId(i);if(!this.schemas.has(u)){if(!i.includes("#")){let t="#"+i,f=[];for(let[l,E]of this.schemas.entries())if(l.endsWith(t))f.push(E);if(f.length===1)return f[0]}throw Error(`@smithy/core/schema - schema not found for ${u}`)}return this.schemas.get(u)}registerError(i,u){let t=i,f=t[1];for(let l of[this,E7.for(f)])l.schemas.set(f+"#"+t[2],t),l.exceptions.set(t,u)}getErrorCtor(i){let u=i;if(this.exceptions.has(u))return this.exceptions.get(u);return E7.for(u[1]).exceptions.get(u)}getBaseException(){for(let i of this.exceptions.keys())if(Array.isArray(i)){let[,u,t]=i,f=u+"#"+t;if(f.startsWith("smithy.ts.sdk.synthetic.")&&f.endsWith("ServiceException"))return i}return}find(i){for(let u of this.schemas.values())if(i(u))return u;return}clear(){this.schemas.clear(),this.exceptions.clear()}normalizeShapeId(i){if(i.includes("#"))return i;return this.namespace+"#"+i}}gsf.ErrorSchema=ZAi;gsf.ListSchema=_Ai;gsf.MapSchema=NAi;gsf.NormalizedSchema=c7;gsf.OperationSchema=OAi;gsf.SCHEMA=Fsf;gsf.Schema=Gw;gsf.SimpleSchema=Fs;gsf.StructureSchema=Bs;gsf.TypeRegistry=E7;gsf.deref=hAi;gsf.deserializerMiddlewareOption=qL0;gsf.error=Osf;gsf.getSchemaSerdePlugin=vsf;gsf.isStaticSchema=rL0;gsf.list=dsf;gsf.map=Dsf;gsf.op=_sf;gsf.operation=t3u;gsf.serializerMiddlewareOption=VL0;gsf.sim=Zsf;gsf.simAdapter=Bsf;gsf.simpleSchemaCacheN=dAi;gsf.simpleSchemaCacheS=DAi;gsf.struct=Nsf;gsf.traitsCache=vAi;gsf.translateTraits=Zs});var E1=Y((Gpf)=>{var{getSmithyContext:rsf,normalizeProvider:msf}=Y8();Gpf.getSmithyContext=rsf;Gpf.normalizeProvider=msf;var{SMITHY_CONTEXT_KEY:esf,AlgorithmId:FAi}=ZY();Gpf.AlgorithmId=FAi;var{NormalizedSchema:asf}=nv(),BY=(i,u)=>{let t=[];if(i)t.push(i);if(u)for(let f of u)t.push(f);return t},_O=(i,u)=>{return`${i||"anonymous"}${u&&u.length>0?` (a.k.a. ${u.join(",")})`:""}`},gs=()=>{let i=[],u=[],t=!1,f=new Set,l=(d)=>d.sort((D,_)=>mL0[_.step]-mL0[D.step]||eL0[_.priority||"normal"]-eL0[D.priority||"normal"]),E=(d)=>{let D=!1,_=(N)=>{let Z=BY(N.name,N.aliases);if(Z.includes(d)){D=!0;for(let B of Z)f.delete(B);return!1}return!0};return i=i.filter(_),u=u.filter(_),D},c=(d)=>{let D=!1,_=(N)=>{if(N.middleware===d){D=!0;for(let Z of BY(N.name,N.aliases))f.delete(Z);return!1}return!0};return i=i.filter(_),u=u.filter(_),D},w=(d)=>{return i.forEach((D)=>{d.add(D.middleware,{...D})}),u.forEach((D)=>{d.addRelativeTo(D.middleware,{...D})}),d.identifyOnResolve?.(v.identifyOnResolve()),d},$=(d)=>{let D=[];return d.before.forEach((_)=>{if(_.before.length===0&&_.after.length===0)D.push(_);else D.push(...$(_))}),D.push(d),d.after.reverse().forEach((_)=>{if(_.before.length===0&&_.after.length===0)D.push(_);else D.push(...$(_))}),D},h=(d=!1)=>{let D=[],_=[],N={};return i.forEach((B)=>{let F={...B,before:[],after:[]};for(let g of BY(F.name,F.aliases))N[g]=F;D.push(F)}),u.forEach((B)=>{let F={...B,before:[],after:[]};for(let g of BY(F.name,F.aliases))N[g]=F;_.push(F)}),_.forEach((B)=>{if(B.toMiddleware){let F=N[B.toMiddleware];if(F===void 0){if(d)return;throw Error(`${B.toMiddleware} is not found when adding ${_O(B.name,B.aliases)} middleware ${B.relation} ${B.toMiddleware}`)}if(B.relation==="after")F.after.push(B);if(B.relation==="before")F.before.push(B)}}),l(D).map($).reduce((B,F)=>{return B.push(...F),B},[])},v={add:(d,D={})=>{let{name:_,override:N,aliases:Z}=D,B={step:"initialize",priority:"normal",middleware:d,...D},F=BY(_,Z);if(F.length>0){if(F.some((g)=>f.has(g))){if(!N)throw Error(`Duplicate middleware name '${_O(_,Z)}'`);for(let g of F){let U=i.findIndex((A)=>A.name===g||A.aliases?.some((G)=>G===g));if(U===-1)continue;let T=i[U];if(T.step!==B.step||B.priority!==T.priority)throw Error(`"${_O(T.name,T.aliases)}" middleware with ${T.priority} priority in ${T.step} step cannot be overridden by "${_O(_,Z)}" middleware with ${B.priority} priority in ${B.step} step.`);i.splice(U,1)}}for(let g of F)f.add(g)}i.push(B)},addRelativeTo:(d,D)=>{let{name:_,override:N,aliases:Z}=D,B={middleware:d,...D},F=BY(_,Z);if(F.length>0){if(F.some((g)=>f.has(g))){if(!N)throw Error(`Duplicate middleware name '${_O(_,Z)}'`);for(let g of F){let U=u.findIndex((A)=>A.name===g||A.aliases?.some((G)=>G===g));if(U===-1)continue;let T=u[U];if(T.toMiddleware!==B.toMiddleware||T.relation!==B.relation)throw Error(`"${_O(T.name,T.aliases)}" middleware ${T.relation} "${T.toMiddleware}" middleware cannot be overridden by "${_O(_,Z)}" middleware ${B.relation} "${B.toMiddleware}" middleware.`);u.splice(U,1)}}for(let g of F)f.add(g)}u.push(B)},clone:()=>w(gs()),use:(d)=>{d.applyToStack(v)},remove:(d)=>{if(typeof d==="string")return E(d);else return c(d)},removeByTag:(d)=>{let D=!1,_=(N)=>{let{tags:Z,name:B,aliases:F}=N;if(Z&&Z.includes(d)){let g=BY(B,F);for(let U of g)f.delete(U);return D=!0,!1}return!0};return i=i.filter(_),u=u.filter(_),D},concat:(d)=>{let D=w(gs());return D.use(d),D.identifyOnResolve(t||D.identifyOnResolve()||(d.identifyOnResolve?.()??!1)),D},applyToStack:w,identify:()=>{return h(!0).map((d)=>{let D=d.step??d.relation+" "+d.toMiddleware;return _O(d.name,d.aliases)+" - "+D})},identifyOnResolve(d){if(typeof d==="boolean")t=d;return t},resolve:(d,D)=>{for(let _ of h().map((N)=>N.middleware).reverse())d=_(d,D);if(t)console.log(v.identify());return d}};return v},mL0={initialize:5,serialize:4,build:3,finalizeRequest:2,deserialize:1},eL0={high:3,normal:2,low:1},osf=(i)=>()=>{throw Error(i)},ssf=(i)=>()=>Promise.reject(i),BAi=()=>{let i=new WeakSet;return(u,t)=>{if(typeof t==="object"&&t!==null){if(i.has(t))return"[Circular]";i.add(t)}return t}},psf=(i)=>{return new Promise((u)=>setTimeout(u,i*1000))},sL0={minDelay:2,maxDelay:120},W8;(function(i){i.ABORTED="ABORTED",i.FAILURE="FAILURE",i.SUCCESS="SUCCESS",i.RETRY="RETRY",i.TIMEOUT="TIMEOUT"})(W8||(W8={}));var ipf=(i)=>{if(i.state===W8.ABORTED){let u=Error(`${JSON.stringify({...i,reason:"Request was aborted"},BAi())}`);throw u.name="AbortError",u}else if(i.state===W8.TIMEOUT){let u=Error(`${JSON.stringify({...i,reason:"Waiter has timed out"},BAi())}`);throw u.name="TimeoutError",u}else if(i.state!==W8.SUCCESS)throw Error(`${JSON.stringify(i,BAi())}`);return i},upf=async({minDelay:i,maxDelay:u,maxWaitTime:t,abortController:f,client:l,abortSignal:E},c,w)=>{let $={},[h,v]=[i*1000,u*1000],d=0,D=Date.now()+t*1000,_=Date.now()+60000,N=!1;while(!0){if(d>0){let F=lpf(h,v,d,D);if(f?.signal?.aborted||E?.aborted)return $["AbortController signal aborted."]|=0,$["AbortController signal aborted."]+=1,{state:W8.ABORTED,observedResponses:$};if(Date.now()+F>D)return{state:W8.TIMEOUT,observedResponses:$};await psf(F/1000)}let{state:Z,reason:B}=await w(l,c);if(B){let F=fpf(B);$[F]|=0,$[F]+=1}if(Z!==W8.RETRY)return{state:Z,reason:B,final:B,observedResponses:$};if(d+=1,!N&&Date.now()>=_)tpf($,l),N=!0}},tpf=(i={},u)=>{let t=Object.keys(i),f=0;for(let c of t){let w=i[c]|0;if(c.startsWith("403:"))f+=w}let l=u?.config?.logger,E=typeof l?.warn==="function"&&!l.constructor?.name?.includes?.("NoOpLogger")?l:console;if(f>=3||t[t.length-1]?.startsWith("403:"))E.warn("@smithy/util-waiter WARN - 403 status code encountered during waiter polling.")},fpf=(i)=>{let u=i?.$response?.statusCode??i?.$metadata?.httpStatusCode;if(i?.$responseBodyText)return`${u?u+": ":""}Deserialization error for body: ${i.$responseBodyText}`;if(u){if(i?.$response||i?.message)return`${u??"Unknown"}: ${i?.message}`;return`${u}: OK`}return String(i?.message??JSON.stringify(i,BAi())??"Unknown")},lpf=(i,u,t,f)=>{let l=Math.log(u/i)/Math.log(2)+1;if(t>l)return u;let E=i*2**(t-1),c=Math.min(E,u),w=Epf(i,c);if(Date.now()+w>f){let $=f-Date.now();return Math.max(0,$-500)}return w},Epf=(i,u)=>i+Math.random()*(u-i),cpf=(i)=>{if(i.maxWaitTime<=0)throw Error("WaiterConfiguration.maxWaitTime must be greater than 0");else if(i.minDelay<=0)throw Error("WaiterConfiguration.minDelay must be greater than 0");else if(i.maxDelay<=0)throw Error("WaiterConfiguration.maxDelay must be greater than 0");else if(i.maxWaitTime<=i.minDelay)throw Error(`WaiterConfiguration.maxWaitTime [${i.maxWaitTime}] must be greater than WaiterConfiguration.minDelay [${i.minDelay}] for this waiter`);else if(i.maxDelay<i.minDelay)throw Error(`WaiterConfiguration.maxDelay [${i.maxDelay}] must be greater than WaiterConfiguration.minDelay [${i.minDelay}] for this waiter`)},aL0=(i)=>{let u,t=new Promise((f)=>{if(u=()=>f({state:W8.ABORTED}),typeof i.addEventListener==="function")i.addEventListener("abort",u);else i.onabort=u});return{clearListener(){if(typeof i.removeEventListener==="function")i.removeEventListener("abort",u)},aborted:t}},wpf=async(i,u,t)=>{let f={...sL0,...i};cpf(f);let l=[upf(f,u,t)],E=[];if(i.abortSignal){let{aborted:c,clearListener:w}=aL0(i.abortSignal);E.push(w),l.push(c)}if(i.abortController?.signal){let{aborted:c,clearListener:w}=aL0(i.abortController.signal);E.push(w),l.push(c)}return Promise.race(l).then((c)=>{for(let w of E)w();return c})};class pL0{config;middlewareStack=gs();initConfig;handlers;constructor(i){this.config=i;let{protocol:u,protocolSettings:t}=i;if(t){if(typeof u==="function")i.protocol=new u(t)}}send(i,u,t){let f=typeof u!=="function"?u:void 0,l=typeof u==="function"?u:t,E=f===void 0&&this.config.cacheMiddleware===!0,c;if(E){if(!this.handlers)this.handlers=new WeakMap;let w=this.handlers;if(w.has(i.constructor))c=w.get(i.constructor);else c=i.resolveMiddleware(this.middlewareStack,this.config,f),w.set(i.constructor,c)}else delete this.handlers,c=i.resolveMiddleware(this.middlewareStack,this.config,f);if(l)c(i).then((w)=>l(null,w.output),(w)=>l(w)).catch(()=>{});else return c(i).then((w)=>w.output)}destroy(){this.config?.requestHandler?.destroy?.(),delete this.handlers}}var f3u="***SensitiveInformation***";function gAi(i,u){if(u==null)return u;let t=asf.of(i);if(t.getMergedTraits().sensitive)return f3u;if(t.isListSchema()){if(!!t.getValueSchema().getMergedTraits().sensitive)return f3u}else if(t.isMapSchema()){if(!!t.getKeySchema().getMergedTraits().sensitive||!!t.getValueSchema().getMergedTraits().sensitive)return f3u}else if(t.isStructSchema()&&typeof u==="object"){let f=u,l={};for(let[E,c]of t.structIterator())if(f[E]!=null)l[E]=gAi(c,f[E]);return l}return u}class E3u{middlewareStack=gs();schema;static classBuilder(){return new iQ0}resolveMiddlewareWithContext(i,u,t,{middlewareFn:f,clientName:l,commandName:E,inputFilterSensitiveLog:c,outputFilterSensitiveLog:w,smithyContext:$,additionalContext:h,CommandCtor:v}){for(let B of f.bind(this)(v,i,u,t))this.middlewareStack.use(B);let d=i.concat(this.middlewareStack),{logger:D}=u,_={logger:D,clientName:l,commandName:E,inputFilterSensitiveLog:c,outputFilterSensitiveLog:w,[esf]:{commandInstance:this,...$},...h},{requestHandler:N}=u,Z=t??{};if($.eventStream)Z={isEventStream:!0,...Z};return d.resolve((B)=>N.handle(B.request,Z),_)}}class iQ0{_init=()=>{};_ep={};_middlewareFn=()=>[];_commandName="";_clientName="";_additionalContext={};_smithyContext={};_inputFilterSensitiveLog=void 0;_outputFilterSensitiveLog=void 0;_serializer=null;_deserializer=null;_operationSchema;init(i){this._init=i}ep(i){return this._ep=i,this}m(i){return this._middlewareFn=i,this}s(i,u,t={}){return this._smithyContext={service:i,operation:u,...t},this}c(i={}){return this._additionalContext=i,this}n(i,u){return this._clientName=i,this._commandName=u,this}f(i=(t)=>t,u=(t)=>t){return this._inputFilterSensitiveLog=i,this._outputFilterSensitiveLog=u,this}ser(i){return this._serializer=i,this}de(i){return this._deserializer=i,this}sc(i){return this._operationSchema=i,this._smithyContext.operationSchema=i,this}build(){let i=this,u;return u=class extends E3u{input;static getEndpointParameterInstructions(){return i._ep}constructor(...[t]){super();this.input=t??{},i._init(this),this.schema=i._operationSchema}resolveMiddleware(t,f,l){let E=i._operationSchema,c=E?.[4]??E?.input,w=E?.[5]??E?.output;return this.resolveMiddlewareWithContext(t,f,l,{CommandCtor:u,middlewareFn:i._middlewareFn,clientName:i._clientName,commandName:i._commandName,inputFilterSensitiveLog:i._inputFilterSensitiveLog??(E?gAi.bind(null,c):($)=>$),outputFilterSensitiveLog:i._outputFilterSensitiveLog??(E?gAi.bind(null,w):($)=>$),smithyContext:i._smithyContext,additionalContext:i._additionalContext})}serialize=i._serializer;deserialize=i._deserializer}}}var $pf="***SensitiveInformation***",hpf=(i,u,t)=>{for(let[E,c]of Object.entries(i)){let w=async function(h,v,d){let D=new c(h);if(typeof v==="function")this.send(D,v);else if(typeof d==="function"){if(typeof v!=="object")throw Error(`Expected http options but got ${typeof v}`);this.send(D,v||{},d)}else return this.send(D,v)},$=(E[0].toLowerCase()+E.slice(1)).replace(/Command$/,"");u.prototype[$]=w}let{paginators:f={},waiters:l={}}=t??{};for(let[E,c]of Object.entries(f))if(u.prototype[E]===void 0)u.prototype[E]=function(w={},$,...h){return c({...$,client:this},w,...h)};for(let[E,c]of Object.entries(l))if(u.prototype[E]===void 0)u.prototype[E]=async function(w={},$,...h){let v=$;if(typeof $==="number")v={maxWaitTime:$};return c({...v,client:this},w,...h)}};class rn extends Error{$fault;$response;$retryable;$metadata;constructor(i){super(i.message);Object.setPrototypeOf(this,Object.getPrototypeOf(this).constructor.prototype),this.name=i.name,this.$fault=i.$fault,this.$metadata=i.$metadata}static isInstance(i){if(!i)return!1;let u=i;return rn.prototype.isPrototypeOf(u)||Boolean(u.$fault)&&Boolean(u.$metadata)&&(u.$fault==="client"||u.$fault==="server")}static[Symbol.hasInstance](i){if(!i)return!1;let u=i;if(this===rn)return rn.isInstance(i);if(rn.isInstance(i)){if(u.name&&this.name)return this.prototype.isPrototypeOf(i)||u.name===this.name;return this.prototype.isPrototypeOf(i)}return!1}}var uQ0=(i,u={})=>{Object.entries(u).filter(([,f])=>f!==void 0).forEach(([f,l])=>{if(i[f]==null||i[f]==="")i[f]=l});let t=i.message||i.Message||"UnknownError";return i.message=t,delete i.Message,i},tQ0=({output:i,parsedBody:u,exceptionCtor:t,errorCode:f})=>{let l=dpf(i),E=l.httpStatusCode?l.httpStatusCode+"":void 0,c=new t({name:u?.code||u?.Code||f||E||"UnknownError",$fault:"client",$metadata:l});throw uQ0(c,u)},vpf=(i)=>{return({output:u,parsedBody:t,errorCode:f})=>{tQ0({output:u,parsedBody:t,exceptionCtor:i,errorCode:f})}},dpf=(i)=>({httpStatusCode:i.statusCode,requestId:i.headers["x-amzn-requestid"]??i.headers["x-amzn-request-id"]??i.headers["x-amz-request-id"],extendedRequestId:i.headers["x-amz-id-2"],cfId:i.headers["x-amz-cf-id"]}),Dpf=(i)=>{switch(i){case"standard":return{retryMode:"standard",connectionTimeout:3100};case"in-region":return{retryMode:"standard",connectionTimeout:1100};case"cross-region":return{retryMode:"standard",connectionTimeout:3100};case"mobile":return{retryMode:"standard",connectionTimeout:30000};default:return{}}},oL0=!1,_pf=(i)=>{if(i&&!oL0&&parseInt(i.substring(1,i.indexOf(".")))<16)oL0=!0},fQ0=Object.values(FAi),lQ0=(i)=>{let u=[];for(let t in FAi){let f=FAi[t];if(i[f]===void 0)continue;u.push({algorithmId:()=>f,checksumConstructor:()=>i[f]})}for(let[t,f]of Object.entries(i.checksumAlgorithms??{}))u.push({algorithmId:()=>t,checksumConstructor:()=>f});return{addChecksumAlgorithm(t){i.checksumAlgorithms=i.checksumAlgorithms??{};let f=t.algorithmId(),l=t.checksumConstructor();if(fQ0.includes(f))i.checksumAlgorithms[f.toUpperCase()]=l;else i.checksumAlgorithms[f]=l;u.push(t)},checksumAlgorithms(){return u}}},EQ0=(i)=>{let u={};return i.checksumAlgorithms().forEach((t)=>{let f=t.algorithmId();if(fQ0.includes(f))u[f]=t.checksumConstructor()}),u},cQ0=(i)=>{return{setRetryStrategy(u){i.retryStrategy=u},retryStrategy(){return i.retryStrategy}}},wQ0=(i)=>{let u={};return u.retryStrategy=i.retryStrategy(),u},$Q0=(i)=>{return Object.assign(lQ0(i),cQ0(i))},Npf=$Q0,Opf=(i)=>{return Object.assign(EQ0(i),wQ0(i))},Zpf=(i)=>Array.isArray(i)?i:[i],hQ0=(i)=>{for(let t in i)if(Object.prototype.hasOwnProperty.call(i,t)&&i[t]["#text"]!==void 0)i[t]=i[t]["#text"];else if(typeof i[t]==="object"&&i[t]!==null)i[t]=hQ0(i[t]);return i},Bpf=(i)=>{return i!=null};class vQ0{trace(){}debug(){}info(){}warn(){}error(){}}function dQ0(i,u,t){let f,l,E;if(typeof u>"u"&&typeof t>"u")f={},E=i;else if(f=i,typeof u==="function")return l=u,E=t,Upf(f,l,E);else E=u;for(let c of Object.keys(E)){if(!Array.isArray(E[c])){f[c]=E[c];continue}DQ0(f,null,E,c)}return f}var Fpf=(i)=>{let u={};for(let[t,f]of Object.entries(i||{}))u[t]=[,f];return u},gpf=(i,u)=>{let t={};for(let f in u)DQ0(t,i,u,f);return t},Upf=(i,u,t)=>{return dQ0(i,Object.entries(t).reduce((f,[l,E])=>{if(Array.isArray(E))f[l]=E;else if(typeof E==="function")f[l]=[u,E()];else f[l]=[u,E];return f},{}))},DQ0=(i,u,t,f)=>{if(u!==null){let c=t[f];if(typeof c==="function")c=[,c];let[w=Tpf,$=Apf,h=f]=c;if(typeof w==="function"&&w(u[h])||typeof w!=="function"&&!!w)i[f]=$(u[h]);return}let[l,E]=t[f];if(typeof E==="function"){let c,w=l===void 0&&(c=E())!=null,$=typeof l==="function"&&!!l(void 0)||typeof l!=="function"&&!!l;if(w)i[f]=c;else if($)i[f]=E()}else{let c=l===void 0&&E!=null,w=typeof l==="function"&&!!l(E)||typeof l!=="function"&&!!l;if(c||w)i[f]=E}},Tpf=(i)=>i!=null,Apf=(i)=>i,ypf=(i)=>{if(i!==i)return"NaN";switch(i){case 1/0:return"Infinity";case-1/0:return"-Infinity";default:return i}},Ppf=(i)=>i.toISOString().replace(".000Z","Z"),l3u=(i)=>{if(i==null)return{};if(Array.isArray(i))return i.filter((u)=>u!=null).map(l3u);if(typeof i==="object"){let u={};for(let t of Object.keys(i)){if(i[t]==null)continue;u[t]=l3u(i[t])}return u}return i};Gpf.Client=pL0;Gpf.Command=E3u;Gpf.NoOpLogger=vQ0;Gpf.SENSITIVE_STRING=$pf;Gpf.ServiceException=rn;Gpf.WaiterState=W8;Gpf._json=l3u;Gpf.checkExceptions=ipf;Gpf.constructStack=gs;Gpf.convertMap=Fpf;Gpf.createAggregatedClient=hpf;Gpf.createWaiter=wpf;Gpf.decorateServiceException=uQ0;Gpf.emitWarningIfUnsupportedVersion=_pf;Gpf.getArrayIfSingleItem=Zpf;Gpf.getChecksumConfiguration=lQ0;Gpf.getDefaultClientConfiguration=Npf;Gpf.getDefaultExtensionConfiguration=$Q0;Gpf.getRetryConfiguration=cQ0;Gpf.getValueFromTextNode=hQ0;Gpf.invalidFunction=osf;Gpf.invalidProvider=ssf;Gpf.isSerializableHeaderValue=Bpf;Gpf.loadConfigsForDefaultMode=Dpf;Gpf.map=dQ0;Gpf.resolveChecksumRuntimeConfig=EQ0;Gpf.resolveDefaultRuntimeConfig=Opf;Gpf.resolveRetryRuntimeConfig=wQ0;Gpf.schemaLogFilter=gAi;Gpf.serializeDateTime=Ppf;Gpf.serializeFloat=ypf;Gpf.take=gpf;Gpf.throwDefaultError=tQ0;Gpf.waiterServiceDefaults=sL0;Gpf.withBaseException=vpf});var hf=Y((wu4)=>{var{homedir:vi4}=Fi("os"),{sep:di4,join:Us}=Fi("path"),{createHash:Di4}=Fi("crypto"),{readFile:FQ0}=Fi("fs/promises"),{IniSectionType:UAi}=ZY(),{normalizeProvider:TAi}=E1(),{isValidHostLabel:_i4}=Y8();class mn extends Error{name="ProviderError";tryNextLink;constructor(i,u=!0){let t,f=!0;if(typeof u==="boolean")t=void 0,f=u;else if(u!=null&&typeof u==="object")t=u.logger,f=u.tryNextLink??!0;super(i);this.tryNextLink=f,Object.setPrototypeOf(this,mn.prototype),t?.debug?.(`@smithy/property-provider ${f?"->":"(!)"} ${i}`)}static from(i,u=!0){return Object.assign(new this(i.message,u),i)}}class Ts extends mn{name="CredentialsProviderError";constructor(i,u=!0){super(i,u);Object.setPrototypeOf(this,Ts.prototype)}}class v3u extends mn{name="TokenProviderError";constructor(i,u=!0){super(i,u);Object.setPrototypeOf(this,v3u.prototype)}}var gQ0=(...i)=>async()=>{if(i.length===0)throw new mn("No providers in chain");let u;for(let t of i)try{return await t()}catch(f){if(u=f,f?.tryNextLink)continue;throw f}throw u},UQ0=(i)=>()=>Promise.resolve(i),d3u=(i,u,t)=>{let f,l,E,c=!1,w=async()=>{if(!l)l=i();try{f=await l,E=!0,c=!1}finally{l=void 0}return f};if(u===void 0)return async($)=>{if(!E||$?.forceRefresh)f=await w();return f};return async($)=>{if(!E||$?.forceRefresh)f=await w();if(c)return f;if(t&&!t(f))return c=!0,f;if(u(f))return await w(),f;return f}},w7=(i,u,t)=>{if(!(u in i))return;if(i[u]==="true")return!0;if(i[u]==="false")return!1;throw Error(`Cannot load ${t} "${u}". Expected "true" or "false", got ${i[u]}.`)},Ni4=(i,u,t)=>{if(!(u in i))return;let f=parseInt(i[u],10);if(Number.isNaN(f))throw TypeError(`Cannot load ${t} '${u}'. Expected number, got '${i[u]}'.`);return f},Rv;(function(i){i.ENV="env",i.CONFIG="shared config entry"})(Rv||(Rv={}));var c3u={},Oi4=()=>{if(process&&process.geteuid)return`${process.geteuid()}`;return"DEFAULT"},As=()=>{let{HOME:i,USERPROFILE:u,HOMEPATH:t,HOMEDRIVE:f=`C:${di4}`}=process.env;if(i)return i;if(u)return u;if(t)return`${f}${t}`;let l=Oi4();if(!c3u[l])c3u[l]=vi4();return c3u[l]},TQ0="AWS_PROFILE",AQ0="default",yQ0=(i)=>i.profile||process.env[TQ0]||AQ0,PQ0=(i)=>{let t=Di4("sha1").update(i).digest("hex");return Us(As(),".aws","sso","cache",`${t}.json`)},AAi={},Zi4=async(i)=>{if(AAi[i])return AAi[i];let u=PQ0(i),t=await FQ0(u,"utf8");return JSON.parse(t)},FY=".",Bi4=(i)=>Object.entries(i).filter(([u])=>{let t=u.indexOf(FY);if(t===-1)return!1;return Object.values(UAi).includes(u.substring(0,t))}).reduce((u,[t,f])=>{let l=t.indexOf(FY),E=t.substring(0,l)===UAi.PROFILE?t.substring(l+1):t;return u[E]=f,u},{...i.default&&{default:i.default}}),Fi4="AWS_CONFIG_FILE",GQ0=()=>process.env[Fi4]||Us(As(),".aws","config"),gi4="AWS_SHARED_CREDENTIALS_FILE",Ui4=()=>process.env[gi4]||Us(As(),".aws","credentials"),Ti4=/^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/,Ai4=["__proto__","profile __proto__"],$3u=(i)=>{let u={},t,f;for(let l of i.split(/\r?\n/)){let E=l.split(/(^|\s)[;#]/)[0].trim();if(E[0]==="["&&E[E.length-1]==="]"){t=void 0,f=void 0;let w=E.substring(1,E.length-1),$=Ti4.exec(w);if($){let[,h,,v]=$;if(Object.values(UAi).includes(h))t=[h,v].join(FY)}else t=w;if(Ai4.includes(w))throw Error(`Found invalid profile name "${w}"`)}else if(t){let w=E.indexOf("=");if(![0,-1].includes(w)){let[$,h]=[E.substring(0,w).trim(),E.substring(w+1).trim()];if(h==="")f=$;else{if(f&&l.trimStart()===l)f=void 0;u[t]=u[t]||{};let v=f?[f,$].join(FY):$;u[t][v]=h}}}}return u},w3u={},yAi={},PAi=(i,u)=>{if(yAi[i]!==void 0)return yAi[i];if(!w3u[i]||u?.ignoreCache)w3u[i]=FQ0(i,"utf8");return w3u[i]},_Q0=()=>({}),D3u=async(i={})=>{let{filepath:u=Ui4(),configFilepath:t=GQ0()}=i,f=As(),l="~/",E=u;if(u.startsWith("~/"))E=Us(f,u.slice(2));let c=t;if(t.startsWith("~/"))c=Us(f,t.slice(2));let w=await Promise.all([PAi(c,{ignoreCache:i.ignoreCache}).then($3u).then(Bi4).catch(_Q0),PAi(E,{ignoreCache:i.ignoreCache}).then($3u).catch(_Q0)]);return{configFile:w[0],credentialsFile:w[1]}},yi4=(i)=>Object.entries(i).filter(([u])=>u.startsWith(UAi.SSO_SESSION+FY)).reduce((u,[t,f])=>({...u,[t.substring(t.indexOf(FY)+1)]:f}),{}),Pi4=()=>({}),Gi4=async(i={})=>PAi(i.configFilepath??GQ0()).then($3u).then(yi4).catch(Pi4),Ii4=(...i)=>{let u={};for(let t of i)for(let[f,l]of Object.entries(t))if(u[f]!==void 0)Object.assign(u[f],l);else u[f]=l;return u},xi4=async(i)=>{let u=await D3u(i);return Ii4(u.configFile,u.credentialsFile)},ki4={getFileRecord(){return yAi},interceptFile(i,u){yAi[i]=Promise.resolve(u)},getTokenRecord(){return AAi},interceptToken(i,u){AAi[i]=u}};function IQ0(i){try{let u=new Set(Array.from(i.match(/([A-Z_]){3,}/g)??[]));return u.delete("CONFIG"),u.delete("CONFIG_PREFIX_SEPARATOR"),u.delete("ENV"),[...u].join(", ")}catch(u){return i}}var ji4=(i,u)=>async()=>{try{let t=i(process.env,u);if(t===void 0)throw Error();return t}catch(t){throw new Ts(t.message||`Not found in ENV: ${IQ0(i.toString())}`,{logger:u?.logger})}},Xi4=(i,{preferredFile:u="config",...t}={})=>async()=>{let f=yQ0(t),{configFile:l,credentialsFile:E}=await D3u(t),c=E[f]||{},w=l[f]||{},$=u==="config"?{...c,...w}:{...w,...c};try{let v=i($,u==="config"?l:E);if(v===void 0)throw Error();return v}catch(h){throw new Ts(h.message||`Not found in config files w/ profile [${f}]: ${IQ0(i.toString())}`,{logger:t.logger})}},Ji4=(i)=>typeof i==="function",xQ0=(i)=>Ji4(i)?async()=>await i():UQ0(i),h3u=({environmentVariableSelector:i,configFileSelector:u,default:t},f={})=>{let{signingName:l,logger:E}=f;return d3u(gQ0(ji4(i,{signingName:l,logger:E}),Xi4(u,f),xQ0(t)))},_3u="AWS_USE_DUALSTACK_ENDPOINT",N3u="use_dualstack_endpoint",Ki4=!1,Yi4={environmentVariableSelector:(i)=>w7(i,_3u,Rv.ENV),configFileSelector:(i)=>w7(i,N3u,Rv.CONFIG),default:!1},Wi4={environmentVariableSelector:(i)=>w7(i,_3u,Rv.ENV),configFileSelector:(i)=>w7(i,N3u,Rv.CONFIG),default:void 0},O3u="AWS_USE_FIPS_ENDPOINT",Z3u="use_fips_endpoint",Si4=!1,Li4={environmentVariableSelector:(i)=>w7(i,O3u,Rv.ENV),configFileSelector:(i)=>w7(i,Z3u,Rv.CONFIG),default:!1},Qi4={environmentVariableSelector:(i)=>w7(i,O3u,Rv.ENV),configFileSelector:(i)=>w7(i,Z3u,Rv.CONFIG),default:void 0},Hi4=(i)=>{let{tls:u,endpoint:t,urlParser:f,useDualstackEndpoint:l}=i;return Object.assign(i,{tls:u??!0,endpoint:TAi(typeof t==="string"?f(t):t),isCustomEndpoint:!0,useDualstackEndpoint:TAi(l??!1)})},zi4=async(i)=>{let{tls:u=!0}=i,t=await i.region();if(!new RegExp(/^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9])$/).test(t))throw Error("Invalid region in client config");let l=await i.useDualstackEndpoint(),E=await i.useFipsEndpoint(),{hostname:c}=await i.regionInfoProvider(t,{useDualstackEndpoint:l,useFipsEndpoint:E})??{};if(!c)throw Error("Cannot resolve hostname from client config");return i.urlParser(`${u?"https:":"http:"}//${c}`)},ni4=(i)=>{let u=TAi(i.useDualstackEndpoint??!1),{endpoint:t,useFipsEndpoint:f,urlParser:l,tls:E}=i;return Object.assign(i,{tls:E??!0,endpoint:t?TAi(typeof t==="string"?l(t):t):()=>zi4({...i,useDualstackEndpoint:u,useFipsEndpoint:f}),isCustomEndpoint:!!t,useDualstackEndpoint:u})},kQ0="AWS_REGION",jQ0="region",XQ0={environmentVariableSelector:(i)=>i[kQ0],configFileSelector:(i)=>i[jQ0],default:()=>{throw Error("Region is missing")}},Ri4={preferredFile:"credentials"},NQ0=new Set,bi4=(i,u=_i4)=>{if(!NQ0.has(i)&&!u(i))if(i==="*")console.warn('@smithy/config-resolver WARN - Please use the caller region instead of "*". See "sigv4a" in https://github.com/aws/aws-sdk-js-v3/blob/main/supplemental-docs/CLIENTS.md.');else throw Error(`Region not accepted: region="${i}" is not a valid hostname component.`);else NQ0.add(i)},JQ0=(i)=>typeof i==="string"&&(i.startsWith("fips-")||i.endsWith("-fips")),Ci4=(i)=>JQ0(i)?["fips-aws-global","aws-fips"].includes(i)?"us-east-1":i.replace(/fips-(dkr-|prod-)?|-fips/,""):i,Mi4=(i)=>{let{region:u,useFipsEndpoint:t}=i;if(!u)throw Error("Region is missing");return Object.assign(i,{region:async()=>{let f=typeof u==="function"?await u():u,l=Ci4(f);return bi4(l),l},useFipsEndpoint:async()=>{let f=typeof u==="string"?u:await u();if(JQ0(f))return!0;return typeof t!=="function"?Promise.resolve(!!t):t()}})},OQ0=(i=[],{useFipsEndpoint:u,useDualstackEndpoint:t})=>i.find(({tags:f})=>u===f.includes("fips")&&t===f.includes("dualstack"))?.hostname,qi4=(i,{regionHostname:u,partitionHostname:t})=>u?u:t?t.replace("{region}",i):void 0,Vi4=(i,{partitionHash:u})=>Object.keys(u||{}).find((t)=>u[t].regions.includes(i))??"aws",ri4=(i,{signingRegion:u,regionRegex:t,useFipsEndpoint:f})=>{if(u)return u;else if(f){let l=t.replace("\\\\","\\").replace(/^\^/g,"\\.").replace(/\$$/g,"\\."),E=i.match(l);if(E)return E[0].slice(1,-1)}},mi4=(i,{useFipsEndpoint:u=!1,useDualstackEndpoint:t=!1,signingService:f,regionHash:l,partitionHash:E})=>{let c=Vi4(i,{partitionHash:E}),w=i in l?i:E[c]?.endpoint??i,$={useFipsEndpoint:u,useDualstackEndpoint:t},h=OQ0(l[w]?.variants,$),v=OQ0(E[c]?.variants,$),d=qi4(w,{regionHostname:h,partitionHostname:v});if(d===void 0)throw Error(`Endpoint resolution failed for: ${{resolvedRegion:w,useFipsEndpoint:u,useDualstackEndpoint:t}}`);let D=ri4(d,{signingRegion:l[w]?.signingRegion,regionRegex:E[c].regionRegex,useFipsEndpoint:u});return{partition:c,signingService:f,hostname:d,...D&&{signingRegion:D},...l[w]?.signingService&&{signingService:l[w].signingService}}},ei4="AWS_EXECUTION_ENV",ZQ0="AWS_REGION",BQ0="AWS_DEFAULT_REGION",ai4="AWS_EC2_METADATA_DISABLED",oi4=["in-region","cross-region","mobile","standard","legacy"],si4="/latest/meta-data/placement/region",pi4="AWS_DEFAULTS_MODE",iu4="defaults_mode",uu4={environmentVariableSelector:(i)=>{return i[pi4]},configFileSelector:(i)=>{return i[iu4]},default:"legacy"},tu4=({region:i=h3u(XQ0),defaultsMode:u=h3u(uu4)}={})=>d3u(async()=>{let t=typeof u==="function"?await u():u;switch(t?.toLowerCase()){case"auto":return fu4(i);case"in-region":case"cross-region":case"mobile":case"standard":case"legacy":return Promise.resolve(t?.toLocaleLowerCase());case void 0:return Promise.resolve("legacy");default:throw Error(`Invalid parameter for "defaultsMode", expect ${oi4.join(", ")}, got ${t}`)}}),fu4=async(i)=>{if(i){let u=typeof i==="function"?await i():i,t=await lu4();if(!t)return"standard";if(u===t)return"in-region";else return"cross-region"}return"standard"},lu4=async()=>{if(process.env[ei4]&&(process.env[ZQ0]||process.env[BQ0]))return process.env[ZQ0]??process.env[BQ0];if(!process.env[ai4])try{let i=await Eu4();return(await cu4({hostname:i.hostname,path:si4})).toString()}catch(i){}},Eu4=async()=>{let i=process.env.AWS_EC2_METADATA_SERVICE_ENDPOINT;if(i){let t=new URL(i);return{hostname:t.hostname,path:t.pathname}}if(process.env.AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE==="IPv6")return{hostname:"fd00:ec2::254",path:"/"};return{hostname:"169.254.169.254",path:"/"}},cu4=async({hostname:i,path:u})=>{let{request:t}=Fi("http");return new Promise((f,l)=>{let E=t({method:"GET",hostname:i.replace(/^\[(.+)]$/,"$1"),path:u,timeout:1000,signal:AbortSignal.timeout(1000)});E.on("error",(c)=>{l(c),E.destroy()}),E.on("timeout",()=>{l(Error("TimeoutError from instance metadata service")),E.destroy()}),E.on("response",(c)=>{let{statusCode:w=400}=c;if(w<200||300<=w){l(Object.assign(Error("Error response received from instance metadata service"),{statusCode:w})),E.destroy();return}let $=[];c.on("data",(h)=>$.push(h)),c.on("end",()=>{f(Buffer.concat($)),E.destroy()})}),E.end()})};wu4.CONFIG_PREFIX_SEPARATOR=FY;wu4.CONFIG_USE_DUALSTACK_ENDPOINT=N3u;wu4.CONFIG_USE_FIPS_ENDPOINT=Z3u;wu4.CredentialsProviderError=Ts;wu4.DEFAULT_PROFILE=AQ0;wu4.DEFAULT_USE_DUALSTACK_ENDPOINT=Ki4;wu4.DEFAULT_USE_FIPS_ENDPOINT=Si4;wu4.ENV_PROFILE=TQ0;wu4.ENV_USE_DUALSTACK_ENDPOINT=_3u;wu4.ENV_USE_FIPS_ENDPOINT=O3u;wu4.NODE_REGION_CONFIG_FILE_OPTIONS=Ri4;wu4.NODE_REGION_CONFIG_OPTIONS=XQ0;wu4.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS=Yi4;wu4.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS=Li4;wu4.ProviderError=mn;wu4.REGION_ENV_NAME=kQ0;wu4.REGION_INI_NAME=jQ0;wu4.SelectorType=Rv;wu4.TokenProviderError=v3u;wu4.booleanSelector=w7;wu4.chain=gQ0;wu4.externalDataInterceptor=ki4;wu4.fromStatic=xQ0;wu4.fromValue=UQ0;wu4.getHomeDir=As;wu4.getProfileName=yQ0;wu4.getRegionInfo=mi4;wu4.getSSOTokenFilepath=PQ0;wu4.getSSOTokenFromFile=Zi4;wu4.loadConfig=h3u;wu4.loadSharedConfigFiles=D3u;wu4.loadSsoSessionData=Gi4;wu4.memoize=d3u;wu4.nodeDualstackConfigSelectors=Wi4;wu4.nodeFipsConfigSelectors=Qi4;wu4.numberSelector=Ni4;wu4.parseKnownFiles=xi4;wu4.readFile=PAi;wu4.resolveCustomEndpointsConfig=Hi4;wu4.resolveDefaultsModeConfig=tu4;wu4.resolveEndpointsConfig=ni4;wu4.resolveRegionConfig=Mi4});var p1=Y((W04)=>{var{CONFIG_PREFIX_SEPARATOR:KQ0,loadConfig:au4}=hf(),{toEndpointV1:GAi,getSmithyContext:ou4,normalizeProvider:B3u,isValidHostLabel:SQ0}=Y8();W04.isValidHostLabel=SQ0;W04.middlewareEndpointToEndpointV1=GAi;W04.toEndpointV1=GAi;var{EndpointURLScheme:U3u}=ZY(),YQ0="AWS_ENDPOINT_URL",WQ0="endpoint_url",su4=(i)=>({environmentVariableSelector:(u)=>{let t=i.split(" ").map((E)=>E.toUpperCase()),f=u[[YQ0,...t].join("_")];if(f)return f;let l=u[YQ0];if(l)return l;return},configFileSelector:(u,t)=>{if(t&&u.services){let l=t[["services",u.services].join(KQ0)];if(l){let E=i.split(" ").map((w)=>w.toLowerCase()),c=l[[E.join("_"),WQ0].join(KQ0)];if(c)return c}}let f=u[WQ0];if(f)return f;return},default:void 0}),IAi=async(i)=>au4(su4(i??""))(),pu4=async(i)=>{let u=i?.Bucket||"";if(typeof i.Bucket==="string")i.Bucket=u.replace(/#/g,encodeURIComponent("#")).replace(/\?/g,encodeURIComponent("?"));if(l04(u)){if(i.ForcePathStyle===!0)throw Error("Path-style addressing cannot be used with ARN buckets")}else if(!f04(u)||u.indexOf(".")!==-1&&!String(i.Endpoint).startsWith("http:")||u.toLowerCase()!==u||u.length<3)i.ForcePathStyle=!0;if(i.DisableMultiRegionAccessPoints)i.disableMultiRegionAccessPoints=!0,i.DisableMRAP=!0;return i},i04=/^[a-z0-9][a-z0-9\.\-]{1,61}[a-z0-9]$/,u04=/(\d+\.){3}\d+/,t04=/\.\./,f04=(i)=>i04.test(i)&&!u04.test(i)&&!t04.test(i),l04=(i)=>{let[u,t,f,,,l]=i.split(":"),E=u==="arn"&&i.split(":").length>=6,c=Boolean(E&&t&&f&&l);if(E&&!c)throw Error(`Invalid ARN: ${i} was an invalid ARN.`);return c},E04=(i,u,t,f=!1)=>{let l=async()=>{let E;if(f)E=t.clientContextParams?.[i]??t[i]??t[u];else E=t[i]??t[u];if(typeof E==="function")return E();return E};if(i==="credentialScope"||u==="CredentialScope")return async()=>{let E=typeof t.credentials==="function"?await t.credentials():t.credentials;return E?.credentialScope??E?.CredentialScope};if(i==="accountId"||u==="AccountId")return async()=>{let E=typeof t.credentials==="function"?await t.credentials():t.credentials;return E?.accountId??E?.AccountId};if(i==="endpoint"||u==="endpoint")return async()=>{if(t.isCustomEndpoint===!1)return;let E=await l();if(E&&typeof E==="object"){if("url"in E)return E.url.href;if("hostname"in E){let{protocol:c,hostname:w,port:$,path:h}=E;return`${c}//${w}${$?":"+$:""}${h}`}}return E};return l};function LQ0(i){return async(u,t,f,l)=>{if(!f.isCustomEndpoint){let w;if(f.serviceConfiguredEndpoint)w=await f.serviceConfiguredEndpoint();else w=await i(f.serviceId);if(w)f.endpoint=()=>Promise.resolve(GAi(w)),f.isCustomEndpoint=!0}let E=await QQ0(u,t,f);if(typeof f.endpointProvider!=="function")throw Error("config.endpointProvider is not set.");let c=f.endpointProvider(E,l);if(f.isCustomEndpoint&&f.endpoint){let w=await f.endpoint();if(w?.headers){c.headers??={};for(let[$,h]of Object.entries(w.headers))c.headers[$]=Array.isArray(h)?h:[h]}}return c}}var QQ0=async(i,u,t)=>{let f={},l=u?.getEndpointParameterInstructions?.()||{};for(let[E,c]of Object.entries(l))switch(c.type){case"staticContextParams":f[E]=c.value;break;case"contextParams":f[E]=i[c.name];break;case"clientContextParams":case"builtInParams":f[E]=await E04(c.name,E,t,c.type!=="builtInParams")();break;case"operationContextParams":f[E]=c.get(i);break;default:throw Error("Unrecognized endpoint parameter instruction: "+JSON.stringify(c))}if(Object.keys(l).length===0)Object.assign(f,t);if(String(t.serviceId).toLowerCase()==="s3")await pu4(f);return f};function c04(i,u,t){if(!i.__smithy_context)i.__smithy_context={features:{}};else if(!i.__smithy_context.features)i.__smithy_context.features={};i.__smithy_context.features[u]=t}function HQ0(i){let u=LQ0(i);return({config:t,instructions:f})=>{return(l,E)=>async(c)=>{if(t.isCustomEndpoint)c04(E,"ENDPOINT_OVERRIDE","N");let w=await u(c.input,{getEndpointParameterInstructions(){return f}},{...t},E);E.endpointV2=w,E.authSchemes=w.properties?.authSchemes;let $=E.authSchemes?.[0];if($){E.signing_region=$.signingRegion,E.signing_service=$.signingName;let v=ou4(E)?.selectedHttpAuthScheme?.httpAuthOption;if(v)v.signingProperties=Object.assign(v.signingProperties||{},{signing_region:$.signingRegion,signingRegion:$.signingRegion,signing_service:$.signingName,signingName:$.signingName,signingRegionSet:$.signingRegionSet},$.properties)}return l({...c})}}}var w04={name:"serializerMiddleware"},zQ0={step:"serialize",tags:["ENDPOINT_PARAMETERS","ENDPOINT_V2","ENDPOINT"],name:"endpointV2Middleware",override:!0,relation:"before",toMiddleware:w04.name};function $04(i){let u=HQ0(i);return(t,f)=>({applyToStack:(l)=>{l.addRelativeTo(u({config:t,instructions:f}),zQ0)}})}function h04(i){return(u)=>{let t=u.tls??!0,{endpoint:f,useDualstackEndpoint:l,useFipsEndpoint:E}=u,c=f!=null?async()=>GAi(await B3u(f)()):void 0,$=Object.assign(u,{endpoint:c,tls:t,isCustomEndpoint:!!f,useDualstackEndpoint:B3u(l??!1),useFipsEndpoint:B3u(E??!1)}),h=void 0;return $.serviceConfiguredEndpoint=async()=>{if(u.serviceId&&!h)h=i(u.serviceId);return h},$}}class T3u{nodes;root;conditions;results;constructor(i,u,t,f){this.nodes=i,this.root=u,this.conditions=t,this.results=f}static from(i,u,t,f){return new T3u(i,u,t,f)}}class nQ0{capacity;data=new Map;parameters=[];constructor({size:i,params:u}){if(this.capacity=i??50,u)this.parameters=u}get(i,u){let t=this.hash(i);if(t===!1)return u();if(!this.data.has(t)){if(this.data.size>this.capacity+10){let f=this.data.keys(),l=0;while(!0){let{value:E,done:c}=f.next();if(this.data.delete(E),c||++l>10)break}}this.data.set(t,u())}return this.data.get(t)}size(){return this.data.size}hash(i){let u="",{parameters:t}=this;if(t.length===0)return!1;for(let f of t){let l=String(i[f]??"");if(l.includes("|;"))return!1;u+=l+"|;"}return u}}class nE extends Error{constructor(i){super(i);this.name="EndpointError"}}var ys="endpoints";function NO(i){if(typeof i!=="object"||i==null)return i;if("ref"in i)return`$${NO(i.ref)}`;if("fn"in i)return`${i.fn}(${(i.argv||[]).map(NO).join(", ")})`;return JSON.stringify(i,null,2)}var RQ0={},v04=(i,u)=>i===u;function d04(...i){for(let u of i)if(u!=null)return u;return}var D04=(i)=>{let u=i.split("."),t=[];for(let f of u){let l=f.indexOf("[");if(l!==-1){if(f.indexOf("]")!==f.length-1)throw new nE(`Path: '${i}' does not end with ']'`);let E=f.slice(l+1,-1);if(Number.isNaN(parseInt(E)))throw new nE(`Invalid array index: '${E}' in path: '${i}'`);if(l!==0)t.push(f.slice(0,l));t.push(E)}else t.push(f)}return t},bQ0=(i,u)=>D04(u).reduce((t,f)=>{if(typeof t!=="object")throw new nE(`Index '${f}' in '${u}' not found in '${JSON.stringify(i)}'`);else if(Array.isArray(t)){let l=parseInt(f);return t[l<0?t.length+l:l]}return t[f]},i),_04=(i)=>i!=null;function N04(i,u,t){return i?u:t}var O04=(i)=>!i,Z04=new RegExp("^(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)){3}$"),CQ0=(i)=>Z04.test(i)||i.startsWith("[")&&i.endsWith("]"),F3u={[U3u.HTTP]:80,[U3u.HTTPS]:443},B04=(i)=>{let u=(()=>{try{if(i instanceof URL)return i;if(typeof i==="object"&&"hostname"in i){let{hostname:D,port:_,protocol:N="",path:Z="",query:B={}}=i,F=new URL(`${N}//${D}${_?`:${_}`:""}${Z}`);return F.search=Object.entries(B).map(([g,U])=>`${g}=${U}`).join("&"),F}return new URL(i)}catch(D){return null}})();if(!u)return console.error(`Unable to parse ${JSON.stringify(i)} as a whatwg URL.`),null;let t=u.href,{host:f,hostname:l,pathname:E,protocol:c,search:w}=u;if(w)return null;let $=c.slice(0,-1);if(!Object.values(U3u).includes($))return null;let h=CQ0(l),v=t.includes(`${f}:${F3u[$]}`)||typeof i==="string"&&i.includes(`${f}:${F3u[$]}`),d=`${f}${v?`:${F3u[$]}`:""}`;return{scheme:$,authority:d,path:E,normalizedPath:E.endsWith("/")?E:`${E}/`,isIp:h}};function F04(i,u,t){if(t===1)return[i];if(i==="")return[""];let f=i.split(u);if(t===0)return f;return f.slice(0,t-1).concat(f.slice(1).join(u))}var g04=(i,u)=>i===u,U04=(i,u,t,f)=>{if(i==null||u>=t||i.length<t||/[^\u0000-\u007f]/.test(i))return null;if(!f)return i.substring(u,t);return i.substring(i.length-t,i.length-u)},T04=(i)=>encodeURIComponent(i).replace(/[!*'()]/g,(u)=>`%${u.charCodeAt(0).toString(16).toUpperCase()}`),A04={booleanEquals:v04,coalesce:d04,getAttr:bQ0,isSet:_04,isValidHostLabel:SQ0,ite:N04,not:O04,parseURL:B04,split:F04,stringEquals:g04,substring:U04,uriEncode:T04},MQ0=(i,u)=>{let t=[],{referenceRecord:f,endpointParams:l}=u,E=0;while(E<i.length){let c=i.indexOf("{",E);if(c===-1){t.push(i.slice(E));break}t.push(i.slice(E,c));let w=i.indexOf("}",c);if(w===-1){t.push(i.slice(c));break}if(i[c+1]==="{"&&i[w+1]==="}")t.push(i.slice(c+1,w)),E=w+2;let $=i.substring(c+1,w);if($.includes("#")){let[h,v]=$.split("#");t.push(bQ0(f[h]??l[h],v))}else t.push(f[$]??l[$]);E=w+1}return t.join("")},y04=({ref:i},u)=>{return u.referenceRecord[i]??u.endpointParams[i]},Ps=(i,u,t)=>{if(typeof i==="string")return MQ0(i,t);else if(i.fn)return VQ0.callFunction(i,t);else if(i.ref)return y04(i,t);throw new nE(`'${u}': ${String(i)} is not a string, function or reference.`)},qQ0=({fn:i,argv:u},t)=>{let f=Array(u.length);for(let c=0;c<f.length;++c){let w=u[c];if(typeof w==="boolean"||typeof w==="number")f[c]=w;else f[c]=VQ0.evaluateExpression(w,"arg",t)}let l=i.indexOf(".");if(l!==-1){let w=RQ0[i.slice(0,l)]?.[i.slice(l+1)];if(typeof w==="function")return w(...f)}let E=A04[i];if(typeof E==="function")return E(...f);throw Error(`function ${i} not loaded in endpointFunctions.`)},VQ0={evaluateExpression:Ps,callFunction:qQ0},rQ0=(i,u)=>{let{assign:t}=i;if(t&&t in u.referenceRecord)throw new nE(`'${t}' is already defined in Reference Record.`);let f=qQ0(i,u);u.logger?.debug?.(`${ys} evaluateCondition: ${NO(i)} = ${NO(f)}`);let l=f===""?!0:!!f;if(t!=null)return{result:l,toAssign:{name:t,value:f}};return{result:l}},mQ0=(i,u)=>Object.entries(i??{}).reduce((t,[f,l])=>{return t[f]=l.map((E)=>{let c=Ps(E,"Header value entry",u);if(typeof c!=="string")throw new nE(`Header '${f}' value '${c}' is not a string`);return c}),t},{}),A3u=(i,u)=>Object.entries(i).reduce((t,[f,l])=>{return t[f]=aQ0.getEndpointProperty(l,u),t},{}),eQ0=(i,u)=>{if(Array.isArray(i))return i.map((t)=>eQ0(t,u));switch(typeof i){case"string":return MQ0(i,u);case"object":if(i===null)throw new nE(`Unexpected endpoint property: ${i}`);return aQ0.getEndpointProperties(i,u);case"boolean":return i;default:throw new nE(`Unexpected endpoint property type: ${typeof i}`)}},aQ0={getEndpointProperty:eQ0,getEndpointProperties:A3u},oQ0=(i,u)=>{let t=Ps(i,"Endpoint URL",u);if(typeof t==="string")try{return new URL(t)}catch(f){throw console.error(`Failed to construct URL with ${t}`,f),f}throw new nE(`Endpoint URL must be a string, got ${typeof t}`)},g3u=1e8,P04=(i,u)=>{let{nodes:t,root:f,results:l,conditions:E}=i,c=f,w={},$={referenceRecord:w,endpointParams:u.endpointParams,logger:u.logger};while(c!==1&&c!==-1&&c<g3u){let h=3*(Math.abs(c)-1),[v,d,D]=[t[h],t[h+1],t[h+2]],[_,N,Z]=E[v],B=rQ0({fn:_,assign:Z,argv:N},$);if(B.toAssign){let{name:F,value:g}=B.toAssign;w[F]=g}c=c>=0===B.result?d:D}if(c>=g3u){let h=l[c-g3u];if(h[0]===-1){let[,_]=h;throw new nE(Ps(_,"Error",$))}let[v,d,D]=h;return{url:oQ0(v,$),properties:A3u(d,$),headers:mQ0(D??{},$)}}throw new nE("No matching endpoint.")},y3u=(i=[],u)=>{let t={},f={...u,referenceRecord:{...u.referenceRecord}},l=!1;for(let E of i){let{result:c,toAssign:w}=rQ0(E,f);if(!c)return{result:c};if(w)l=!0,t[w.name]=w.value,f.referenceRecord[w.name]=w.value,u.logger?.debug?.(`${ys} assign: ${w.name} := ${NO(w.value)}`)}if(l)return{result:!0,referenceRecord:t};return{result:!0}},G04=(i,u)=>{let{conditions:t,endpoint:f}=i,{result:l,referenceRecord:E}=y3u(t,u);if(!l)return;let c=E?{...u,referenceRecord:{...u.referenceRecord,...E}}:u,{url:w,properties:$,headers:h}=f;u.logger?.debug?.(`${ys} Resolving endpoint from template: ${NO(f)}`);let v={url:oQ0(w,c)};if(h!=null)v.headers=mQ0(h,c);if($!=null)v.properties=A3u($,c);return v},I04=(i,u)=>{let{conditions:t,error:f}=i,{result:l,referenceRecord:E}=y3u(t,u);if(!l)return;let c=E?{...u,referenceRecord:{...u.referenceRecord,...E}}:u;throw new nE(Ps(f,"Error",c))},sQ0=(i,u)=>{for(let t of i)if(t.type==="endpoint"){let f=G04(t,u);if(f)return f}else if(t.type==="error")I04(t,u);else if(t.type==="tree"){let f=pQ0.evaluateTreeRule(t,u);if(f)return f}else throw new nE(`Unknown endpoint rule: ${t}`);throw new nE("Rules evaluation failed")},x04=(i,u)=>{let{conditions:t,rules:f}=i,{result:l,referenceRecord:E}=y3u(t,u);if(!l)return;let c=E?{...u,referenceRecord:{...u.referenceRecord,...E}}:u;return pQ0.evaluateRules(f,c)},pQ0={evaluateRules:sQ0,evaluateTreeRule:x04},k04=(i,u)=>{let{endpointParams:t,logger:f}=u,{parameters:l,rules:E}=i;u.logger?.debug?.(`${ys} Initial EndpointParams: ${NO(t)}`);for(let w in l){let $=l[w],h=t[w];if(h==null&&$.default!=null){t[w]=$.default;continue}if($.required&&h==null)throw new nE(`Missing required parameter: '${w}'`)}let c=sQ0(E,{endpointParams:t,logger:f,referenceRecord:{}});return u.logger?.debug?.(`${ys} Resolved endpoint: ${NO(c)}`),c},j04=(i)=>{let{endpoint:u}=i;if(u===void 0)i.endpoint=async()=>{throw Error("@smithy/middleware-endpoint: (default endpointRuleSet) endpoint is not set - you must configure an endpoint.")};return i},X04=LQ0(IAi),J04=h04(IAi),K04=HQ0(IAi),Y04=$04(IAi);W04.BinaryDecisionDiagram=T3u;W04.EndpointCache=nQ0;W04.EndpointError=nE;W04.customEndpointFunctions=RQ0;W04.decideEndpoint=P04;W04.endpointMiddleware=K04;W04.endpointMiddlewareOptions=zQ0;W04.getEndpointFromInstructions=X04;W04.getEndpointPlugin=Y04;W04.isIpAddress=CQ0;W04.resolveEndpoint=k04;W04.resolveEndpointConfig=J04;W04.resolveEndpointRequiredConfig=j04;W04.resolveParams=QQ0});var y3=Y((Wf4)=>{var{createHmac:s04,createHash:p04,getRandomValues:it4}=Fi("crypto"),{ReadStream:ut4,lstatSync:tt4,fstatSync:ft4}=Fi("fs"),{HttpResponse:lt4}=Y8(),{toEndpointV1:Et4}=p1(),{Duplex:ct4,Readable:Gs,Writable:wH0,PassThrough:iH0}=Fi("stream"),$H0=(i)=>typeof ArrayBuffer==="function"&&i instanceof ArrayBuffer||Object.prototype.toString.call(i)==="[object ArrayBuffer]",on=(i,u=0,t=i.byteLength-u)=>{if(!$H0(i))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof i} (${i})`);return Buffer.from(i,u,t)},XAi=(i,u)=>{if(typeof i!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof i} (${i})`);return u?Buffer.from(i,u):Buffer.from(i)},wt4=/^[A-Za-z0-9+/]*={0,2}$/,hH0=(i)=>{if(i.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!wt4.exec(i))throw TypeError("Invalid base64 string.");let u=XAi(i,"base64");return new Uint8Array(u.buffer,u.byteOffset,u.byteLength)},JAi=(i)=>{let u=XAi(i,"utf8");return new Uint8Array(u.buffer,u.byteOffset,u.byteLength/Uint8Array.BYTES_PER_ELEMENT)},X3u=(i)=>{let u;if(typeof i==="string")u=JAi(i);else u=i;if(typeof u!=="object"||typeof u.byteOffset!=="number"||typeof u.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return on(u.buffer,u.byteOffset,u.byteLength).toString("base64")};function $t4(i,u,t,f){return class l extends Uint8Array{static fromString(E,c="utf-8"){if(typeof E==="string"){if(c==="base64")return l.mutate(f(E));return l.mutate(u(E))}throw Error(`Unsupported conversion from ${typeof E} to Uint8ArrayBlobAdapter.`)}static mutate(E){return Object.setPrototypeOf(E,l.prototype),E}transformToString(E="utf-8"){if(E==="base64")return t(this);return i(this)}}}var vH0=(i)=>{if(typeof i==="string")return i;if(typeof i!=="object"||typeof i.byteOffset!=="number"||typeof i.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return on(i.buffer,i.byteOffset,i.byteLength).toString("utf8")},Lc=Array.from({length:256},(i,u)=>u.toString(16).padStart(2,"0"));function ht4(i){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let u=new Uint8Array(16);return i(u),u[6]=u[6]&15|64,u[8]=u[8]&63|128,Lc[u[0]]+Lc[u[1]]+Lc[u[2]]+Lc[u[3]]+"-"+Lc[u[4]]+Lc[u[5]]+"-"+Lc[u[6]]+Lc[u[7]]+"-"+Lc[u[8]]+Lc[u[9]]+"-"+Lc[u[10]]+Lc[u[11]]+Lc[u[12]]+Lc[u[13]]+Lc[u[14]]+Lc[u[15]]}}var vt4=(i,u,t=(f)=>f)=>i,dt4=(i)=>{switch(i){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${i}"`)}},Dt4=(i)=>{if(i===null||i===void 0)return;if(typeof i==="number"){if(i===0||i===1)Xs.warn(kAi(`Expected boolean, got ${typeof i}: ${i}`));if(i===0)return!1;if(i===1)return!0}if(typeof i==="string"){let u=i.toLowerCase();if(u==="false"||u==="true")Xs.warn(kAi(`Expected boolean, got ${typeof i}: ${i}`));if(u==="false")return!1;if(u==="true")return!0}if(typeof i==="boolean")return i;throw TypeError(`Expected boolean, got ${typeof i}: ${i}`)},ks=(i)=>{if(i===null||i===void 0)return;if(typeof i==="string"){let u=parseFloat(i);if(!Number.isNaN(u)){if(String(u)!==String(i))Xs.warn(kAi(`Expected number but observed string: ${i}`));return u}}if(typeof i==="number")return i;throw TypeError(`Expected number, got ${typeof i}: ${i}`)},_t4=Math.ceil(340282346638528860000000000000000000000),xAi=(i)=>{let u=ks(i);if(u!==void 0&&!Number.isNaN(u)&&u!==1/0&&u!==-1/0){if(Math.abs(u)>_t4)throw TypeError(`Expected 32-bit float, got ${i}`)}return u},js=(i)=>{if(i===null||i===void 0)return;if(Number.isInteger(i)&&!Number.isNaN(i))return i;throw TypeError(`Expected integer, got ${typeof i}: ${i}`)},Nt4=js,I3u=(i)=>J3u(i,32),x3u=(i)=>J3u(i,16),k3u=(i)=>J3u(i,8),J3u=(i,u)=>{let t=js(i);if(t!==void 0&&Ot4(t,u)!==t)throw TypeError(`Expected ${u}-bit integer, got ${i}`);return t},Ot4=(i,u)=>{switch(u){case 32:return Int32Array.of(i)[0];case 16:return Int16Array.of(i)[0];case 8:return Int8Array.of(i)[0]}},Zt4=(i,u)=>{if(i===null||i===void 0){if(u)throw TypeError(`Expected a non-null value for ${u}`);throw TypeError("Expected a non-null value")}return i},dH0=(i)=>{if(i===null||i===void 0)return;if(typeof i==="object"&&!Array.isArray(i))return i;let u=Array.isArray(i)?"array":typeof i;throw TypeError(`Expected object, got ${u}: ${i}`)},Bt4=(i)=>{if(i===null||i===void 0)return;if(typeof i==="string")return i;if(["boolean","number","bigint"].includes(typeof i))return Xs.warn(kAi(`Expected string, got ${typeof i}: ${i}`)),String(i);throw TypeError(`Expected string, got ${typeof i}: ${i}`)},Ft4=(i)=>{if(i===null||i===void 0)return;let u=dH0(i),t=[];for(let f in u)if(u[f]!=null)t.push(f);if(t.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(t.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${t} were not null.`);return u},K3u=(i)=>{if(typeof i=="string")return ks(iR(i));return ks(i)},gt4=K3u,DH0=(i)=>{if(typeof i=="string")return xAi(iR(i));return xAi(i)},Ut4=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,iR=(i)=>{let u=i.match(Ut4);if(u===null||u[0].length!==i.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat(i)},Y3u=(i)=>{if(typeof i=="string")return _H0(i);return ks(i)},Tt4=Y3u,At4=Y3u,yt4=(i)=>{if(typeof i=="string")return _H0(i);return xAi(i)},_H0=(i)=>{switch(i){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${i}`)}},NH0=(i)=>{if(typeof i==="string")return js(iR(i));return js(i)},Pt4=NH0,Gt4=(i)=>{if(typeof i==="string")return I3u(iR(i));return I3u(i)},sn=(i)=>{if(typeof i==="string")return x3u(iR(i));return x3u(i)},OH0=(i)=>{if(typeof i==="string")return k3u(iR(i));return k3u(i)},kAi=(i)=>{return String(TypeError(i).stack||i).split(`
 `).slice(0,5).filter((u)=>!u.includes("stackTraceWarning")).join(`
 `)},Xs={warn:console.warn},It4=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],W3u=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function xt4(i){let u=i.getUTCFullYear(),t=i.getUTCMonth(),f=i.getUTCDay(),l=i.getUTCDate(),E=i.getUTCHours(),c=i.getUTCMinutes(),w=i.getUTCSeconds(),$=l<10?`0${l}`:`${l}`,h=E<10?`0${E}`:`${E}`,v=c<10?`0${c}`:`${c}`,d=w<10?`0${w}`:`${w}`;return`${It4[f]}, ${$} ${W3u[t]} ${u} ${h}:${v}:${d} GMT`}var kt4=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?[zZ]$/),jt4=(i)=>{if(i===null||i===void 0)return;if(typeof i!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let u=kt4.exec(i);if(!u)throw TypeError("Invalid RFC-3339 date-time value");let[t,f,l,E,c,w,$,h]=u,v=sn(pn(f)),d=S8(l,"month",1,12),D=S8(E,"day",1,31);return Is(v,d,D,{hours:c,minutes:w,seconds:$,fractionalMilliseconds:h})},Xt4=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(([-+]\d{2}\:\d{2})|[zZ])$/),Jt4=(i)=>{if(i===null||i===void 0)return;if(typeof i!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let u=Xt4.exec(i);if(!u)throw TypeError("Invalid RFC-3339 date-time value");let[t,f,l,E,c,w,$,h,v]=u,d=sn(pn(f)),D=S8(l,"month",1,12),_=S8(E,"day",1,31),N=Is(d,D,_,{hours:c,minutes:w,seconds:$,fractionalMilliseconds:h});if(v.toUpperCase()!="Z")N.setTime(N.getTime()-Mt4(v));return N},Kt4=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),Yt4=new RegExp(/^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),Wt4=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? (\d{4})$/),St4=(i)=>{if(i===null||i===void 0)return;if(typeof i!=="string")throw TypeError("RFC-7231 date-times must be expressed as strings");let u=Kt4.exec(i);if(u){let[t,f,l,E,c,w,$,h]=u;return Is(sn(pn(E)),P3u(l),S8(f,"day",1,31),{hours:c,minutes:w,seconds:$,fractionalMilliseconds:h})}if(u=Yt4.exec(i),u){let[t,f,l,E,c,w,$,h]=u;return zt4(Is(Qt4(E),P3u(l),S8(f,"day",1,31),{hours:c,minutes:w,seconds:$,fractionalMilliseconds:h}))}if(u=Wt4.exec(i),u){let[t,f,l,E,c,w,$,h]=u;return Is(sn(pn(h)),P3u(f),S8(l.trimLeft(),"day",1,31),{hours:E,minutes:c,seconds:w,fractionalMilliseconds:$})}throw TypeError("Invalid RFC-7231 date-time value")},Lt4=(i)=>{if(i===null||i===void 0)return;let u;if(typeof i==="number")u=i;else if(typeof i==="string")u=K3u(i);else if(typeof i==="object"&&i.tag===1)u=i.value;else throw TypeError("Epoch timestamps must be expressed as floating point numbers or their string representation");if(Number.isNaN(u)||u===1/0||u===-1/0)throw TypeError("Epoch timestamps must be valid, non-Infinite, non-NaN numerics");return new Date(Math.round(u*1000))},Is=(i,u,t,f)=>{let l=u-1;return Rt4(i,l,t),new Date(Date.UTC(i,l,t,S8(f.hours,"hour",0,23),S8(f.minutes,"minute",0,59),S8(f.seconds,"seconds",0,60),Ct4(f.fractionalMilliseconds)))},Qt4=(i)=>{let u=new Date().getUTCFullYear(),t=Math.floor(u/100)*100+sn(pn(i));if(t<u)return t+100;return t},Ht4=1576800000000,zt4=(i)=>{if(i.getTime()-new Date().getTime()>Ht4)return new Date(Date.UTC(i.getUTCFullYear()-100,i.getUTCMonth(),i.getUTCDate(),i.getUTCHours(),i.getUTCMinutes(),i.getUTCSeconds(),i.getUTCMilliseconds()));return i},P3u=(i)=>{let u=W3u.indexOf(i);if(u<0)throw TypeError(`Invalid month: ${i}`);return u+1},nt4=[31,28,31,30,31,30,31,31,30,31,30,31],Rt4=(i,u,t)=>{let f=nt4[u];if(u===1&&bt4(i))f=29;if(t>f)throw TypeError(`Invalid day for ${W3u[u]} in ${i}: ${t}`)},bt4=(i)=>{return i%4===0&&(i%100!==0||i%400===0)},S8=(i,u,t,f)=>{let l=OH0(pn(i));if(l<t||l>f)throw TypeError(`${u} must be between ${t} and ${f}, inclusive`);return l},Ct4=(i)=>{if(i===null||i===void 0)return 0;return DH0("0."+i)*1000},Mt4=(i)=>{let u=i[0],t=1;if(u=="+")t=1;else if(u=="-")t=-1;else throw TypeError(`Offset direction, ${u}, must be "+" or "-"`);let f=Number(i.substring(1,3)),l=Number(i.substring(4,6));return t*(f*60+l)*60*1000},pn=(i)=>{let u=0;while(u<i.length-1&&i.charAt(u)==="0")u++;if(u===0)return i;return i.slice(u)},gY=function(u){return Object.assign(new String(u),{deserializeJSON(){return JSON.parse(String(u))},toString(){return String(u)},toJSON(){return String(u)}})};gY.from=(i)=>{if(i&&typeof i==="object"&&(i instanceof gY||("deserializeJSON"in i)))return i;else if(typeof i==="string"||Object.getPrototypeOf(i)===String.prototype)return gY(String(i));return gY(JSON.stringify(i))};gY.fromObject=gY.from;function qt4(i){if(i.includes(",")||i.includes('"'))i=`"${i.replace(/"/g,"\\\"")}"`;return i}var S3u="(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)(?:[ne|u?r]?s?day)?",L3u="(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)",Q3u="(\\d?\\d):(\\d{2}):(\\d{2})(?:\\.(\\d+))?",ZH0="(\\d?\\d)",BH0="(\\d{4})",Vt4=new RegExp(/^(\d{4})-(\d\d)-(\d\d)[tT](\d\d):(\d\d):(\d\d)(\.(\d+))?(([-+]\d\d:\d\d)|[zZ])$/),rt4=new RegExp(`^${S3u}, ${ZH0} ${L3u} ${BH0} ${Q3u} GMT$`),mt4=new RegExp(`^${S3u}, ${ZH0}-${L3u}-(\\d\\d) ${Q3u} GMT$`),et4=new RegExp(`^${S3u} ${L3u} ( [1-9]|\\d\\d) ${Q3u} ${BH0}$`),at4=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],ot4=(i)=>{if(i==null)return;let u=NaN;if(typeof i==="number")u=i;else if(typeof i==="string"){if(!/^-?\d*\.?\d+$/.test(i))throw TypeError("parseEpochTimestamp - numeric string invalid.");u=Number.parseFloat(i)}else if(typeof i==="object"&&i.tag===1)u=i.value;if(isNaN(u)||Math.abs(u)===1/0)throw TypeError("Epoch timestamps must be valid finite numbers.");return new Date(Math.round(u*1000))},st4=(i)=>{if(i==null)return;if(typeof i!=="string")throw TypeError("RFC3339 timestamps must be strings");let u=Vt4.exec(i);if(!u)throw TypeError(`Invalid RFC3339 timestamp format ${i}`);let[,t,f,l,E,c,w,,$,h]=u;$7(f,1,12),$7(l,1,31),$7(E,0,23),$7(c,0,59),$7(w,0,60);let v=new Date(Date.UTC(Number(t),Number(f)-1,Number(l),Number(E),Number(c),Number(w),Number($)?Math.round(parseFloat(`0.${$}`)*1000):0));if(v.setUTCFullYear(Number(t)),h.toUpperCase()!="Z"){let[,d,D,_]=/([+-])(\d\d):(\d\d)/.exec(h)||[void 0,"+",0,0],N=d==="-"?1:-1;v.setTime(v.getTime()+N*(Number(D)*60*60*1000+Number(_)*60*1000))}return v},pt4=(i)=>{if(i==null)return;if(typeof i!=="string")throw TypeError("RFC7231 timestamps must be strings.");let u,t,f,l,E,c,w,$;if($=rt4.exec(i))[,u,t,f,l,E,c,w]=$;else if($=mt4.exec(i))[,u,t,f,l,E,c,w]=$,f=(Number(f)+1900).toString();else if($=et4.exec(i))[,t,u,l,E,c,w,f]=$;if(f&&c){let h=Date.UTC(Number(f),at4.indexOf(t),Number(u),Number(l),Number(E),Number(c),w?Math.round(parseFloat(`0.${w}`)*1000):0);$7(u,1,31),$7(l,0,23),$7(E,0,59),$7(c,0,60);let v=new Date(h);return v.setUTCFullYear(Number(f)),v}throw TypeError(`Invalid RFC7231 date-time value ${i}.`)};function $7(i,u,t){let f=Number(i);if(f<u||f>t)throw Error(`Value ${f} out of range [${u}, ${t}]`)}function if4(i,u,t){if(t<=0||!Number.isInteger(t))throw Error("Invalid number of delimiters ("+t+") for splitEvery.");let f=i.split(u);if(t===1)return f;let l=[],E="";for(let c=0;c<f.length;c++){if(E==="")E=f[c];else E+=u+f[c];if((c+1)%t===0)l.push(E),E=""}if(E!=="")l.push(E);return l}var uf4=(i)=>{let u=i.length,t=[],f=!1,l=void 0,E=0;for(let c=0;c<u;++c){let w=i[c];switch(w){case'"':if(l!=="\\")f=!f;break;case",":if(!f)t.push(i.slice(E,c)),E=c+1;break}l=w}return t.push(i.slice(E)),t.map((c)=>{c=c.trim();let w=c.length;if(w<2)return c;if(c[0]==='"'&&c[w-1]==='"')c=c.slice(1,w-1);return c.replace(/\\"/g,'"')})},uH0=/^-?\d*(\.\d+)?$/;class KAi{string;type;constructor(i,u){if(this.string=i,this.type=u,!uH0.test(i))throw Error('@smithy/core/serde - NumericValue must only contain [0-9], at most one decimal point ".", and an optional negation prefix "-".')}toString(){return this.string}static[Symbol.hasInstance](i){if(!i||typeof i!=="object")return!1;let u=i;return KAi.prototype.isPrototypeOf(i)||u.type==="bigDecimal"&&uH0.test(u.string)}}function tf4(i){return new KAi(String(i),"bigDecimal")}var FH0={},j3u={};for(let i=0;i<256;i++){let u=i.toString(16).toLowerCase();if(u.length===1)u=`0${u}`;FH0[i]=u,j3u[u]=i}function ff4(i){if(i.length%2!==0)throw Error("Hex encoded strings must have an even number length");let u=new Uint8Array(i.length/2);for(let t=0;t<i.length;t+=2){let f=i.slice(t,t+2).toLowerCase();if(f in j3u)u[t/2]=j3u[f];else throw Error(`Cannot decode unrecognized sequence ${f} as hexadecimal`)}return u}function gH0(i){let u="";for(let t=0;t<i.byteLength;t++)u+=FH0[i[t]];return u}var lf4=(i)=>{if(!i)return 0;if(typeof i==="string")return Buffer.byteLength(i);else if(typeof i.byteLength==="number")return i.byteLength;else if(typeof i.size==="number")return i.size;else if(typeof i.start==="number"&&typeof i.end==="number")return i.end+1-i.start;else if(i instanceof ut4){if(i.path!=null)return tt4(i.path).size;else if(typeof i.fd==="number")return ft4(i.fd).size}throw Error(`Body Length computation failed for ${i}`)},UH0=(i)=>{if(typeof i==="string")return JAi(i);if(ArrayBuffer.isView(i))return new Uint8Array(i.buffer,i.byteOffset,i.byteLength/Uint8Array.BYTES_PER_ELEMENT);return new Uint8Array(i)},TH0=(i,u)=>(t,f)=>async(l)=>{let{response:E}=await t(l);try{let c=await u(E,i);return{response:E,output:c}}catch(c){if(Object.defineProperty(c,"$response",{value:E,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in c)){try{c.message+=`
@@ -86739,7 +86739,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
         and status = 'pending'
         and "expiresAt" > now()
     ) as exists
-  `.execute(i)).rows[0]?.exists??!1}async function Ms0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!GN(f))throw f}}async function qs0(i,u){for(let t=0;t<ns0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return Vg4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!rg4(l)||t===ns0-1)throw l}}throw Error("Failed to create organization")}var ns0=5,zg4,ng4;var mhu=O(()=>{cGi();zg4=["labs","agent","studio","workspace","systems","core","cloud","works"],ng4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var ss0={};Gi(ss0,{resetPasswordEnabled:()=>hGi,grantDeploymentAdmin:()=>shu,getTrustedOrigins:()=>vGi,authConfig:()=>uf,auth:()=>vt,GENERIC_EMAIL_DOMAINS:()=>Gv});import{randomBytes as mg4}from"crypto";import{sso as eg4}from"@better-auth/sso";import{organization as ag4}from"@decocms/better-auth/plugins";import{betterAuth as og4}from"better-auth";import{admin as sg4,apiKey as pg4,jwt as iU4,magicLink as uU4,mcp as tU4,openAPI as fU4}from"better-auth/plugins";import{emailOTP as lU4}from"better-auth/plugins/email-otp";import{APIError as ms0}from"better-auth/api";import{adminAc as EU4,defaultRoles as cU4}from"better-auth/plugins/admin/access";import{defaultStatements as wU4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as $U4}from"@decocms/better-auth/plugins/access";function Vs0(i){if(!Uhi(i))return;throw new ms0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function shu(i){if(!ehu.includes(i))ehu.push(i)}function vGi(){let i=[Pp];try{let u=new URL(Pp);if(u.hostname==="localhost")i.push(Pp.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Pp.replace("127.0.0.1","localhost"))}catch{}return i}var es0,hU4,$Gi,ohu,vU4,dU4,DU4,rs0,ehu,uf,as0=void 0,ahu=void 0,hGi=!1,_U4,NU4,OU4,Pp,os0,ZU4=262144,BU4,vt;var F$=O(()=>{n0();pL();Jri();z4();Ml();b6();Mf0();PV();Vf0();Ks0();Ws0();Ss0();y5();ppi();Qs0();cGi();mhu();cfu();es0=Object.values(xB()).map((i)=>i.map((u)=>u.name)).flat(),hU4={...wU4,self:["*",...es0]},$Gi=$U4(hU4),ohu=spi(es0),vU4=$Gi.newRole(ohu.user),dU4=$Gi.newRole(ohu.admin),DU4=$Gi.newRole(ohu.owner),rs0=Object.values(xB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),ehu=[];uf=kB().auth;if(uf.inviteEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=f2(uf.emailProviders,uf.inviteEmailProviderId);if(i){let u=t2(i);as0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${wl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:l2({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:YB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(uf.resetPasswordEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=f2(uf.emailProviders,uf.resetPasswordEmailProviderId);if(i){let u=t2(i);hGi=!0,ahu=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:l2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:YB("Reset password",f)+oEi("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}_U4=[ag4({organizationCreation:{afterCreate:async(i)=>{await Js0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Vs0(i.slug)},afterAddMember:async({member:i})=>{try{await bhu(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await bhu(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Vs0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await Ys0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:$Gi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:Cm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:vU4,admin:dU4,owner:DU4},sendInvitationEmail:as0}),tU4({loginPage:"/login",oidcConfig:{scopes:rs0,metadata:{scopes_supported:rs0},loginPage:"/login"}}),pg4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),sg4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...cU4,owner:EU4},adminUserIds:ehu}),fU4(),iU4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),eg4(uf.ssoConfig?Ls0(uf.ssoConfig):void 0),...uf.magicLinkConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[uU4(qf0(uf.magicLinkConfig,uf.emailProviders))]:[],...uf.emailOtpConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[lU4(Cf0(uf.emailOtpConfig,uf.emailProviders))]:[]],NU4=O_(),OU4=LM(NU4),Pp=wl();os0=vu(),BU4=os0.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),mg4(32).toString("base64")})(),vt=og4({secret:BU4,logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Pp,trustedOrigins:vGi(),database:OU4,socialProviders:uf.socialProviders,...uf.ssoConfig&&{account:{accountLinking:{trustedProviders:[uf.ssoConfig.providerId]}}},emailAndPassword:{enabled:uf.emailAndPassword.enabled,...ahu&&{sendResetPassword:ahu}},rateLimit:{enabled:!os0.disableRateLimit,window:60,max:1e4},plugins:_U4,databaseHooks:{user:{create:{after:async(i)=>{Chu({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified}),mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name}});let u=kB().autoCreateOrganizationOnSignup!==!1;try{let t=await wGi({db:m0().db,authApi:vt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:u,createdVia:"signup"});if(t.status==="created")mu.groupIdentify({groupType:"organization",groupKey:t.organization.id,properties:{name:t.organization.name,slug:t.organization.slug,created_at:new Date().toISOString(),created_via:t.createdVia,email_domain:t.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,name:t.organization.name,created_via:t.createdVia,email_domain:t.domain}});if(t.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,email_domain:t.domain,joined_via:t.createdVia}})}catch(t){mu.captureException(t,i.id),console.error("Failed to ensure organization on signup:",t)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>ZU4)throw new ms0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await m0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;Chu({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function phu(i,u){return`${i}:${u}`}function ps0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=phu(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=phu(E,c);f.set($,{role:w,expiresAt:Date.now()+u,organizationId:c}),l()},invalidate(E,c){f.delete(phu(E,c))},invalidateOrg(E){for(let[c,w]of f)if(w.organizationId===E)f.delete(c)}}}class ivu{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=ip0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of ip0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var ip0;var up0=O(()=>{ip0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function FU4(i,u,t=5){try{await F1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function tp0(i){let u=new ivu({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{FU4("[NatsSSEBroadcast]",()=>u.start())})}var uvu=O(()=>{Z4();up0();wvi();wvi()});var fp0=()=>{};var tvu=()=>{};var lp0=()=>{};var gU4,iW6;var Ep0=O(()=>{fp0();tvu();r_();lp0();gU4={br:".br",zstd:".zst",gzip:".gz"},iW6=Object.keys(gU4)});var cp0=O(()=>{Ep0()});var wp0=()=>{};var $p0=O(()=>{wp0()});var hp0=()=>{};var vp0=O(()=>{Bri()});var fvu=O(()=>{m_();vp0()});var lvu="x-hono-disable-ssg",gW6;var Evu=O(()=>{fvu();gW6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[lvu]:"true"}})}catch{return null}})()});var dp0=O(()=>{TEi()});var cvu=O(()=>{dp0()});var Dp0=O(()=>{$p0();hp0();tvu();Evu();cvu();fvu()});var _p0=O(()=>{Evu();cvu();Dp0()});var uS6;var Np0=O(()=>{_p0();({write:uS6}=Bun)});var AU4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},Op0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var Zp0=()=>{};var Gp=(i)=>("server"in i.env)?i.env.server:i.env;var dGi=()=>{};var yU4;var Bp0=O(()=>{Zp0();dGi();yU4=Op0((i,u)=>{let t=Gp(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var wvu=(i)=>{let u=Gp(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var Fp0=O(()=>{dGi()});var gp0=O(()=>{cp0();Np0();Bp0();Fp0();dGi()});var Up0;var Tp0=O(()=>{Up0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function Ap0(){let i=Object.keys(uf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:Up0[l].icon})),f=vu().localMode;return{emailAndPassword:{enabled:uf.emailAndPassword?.enabled??!1},magicLink:{enabled:uf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:uf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:hGi},socialProviders:{enabled:u,providers:t},sso:uf.ssoConfig?{enabled:!0,providerId:uf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:r5()}}async function PU4(i,u,t){try{if(!uf.inviteEmailProviderId||!uf.emailProviders||uf.emailProviders.length===0)return;let f=f2(uf.emailProviders,uf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=Cm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=t2(f),$=`${wl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:l2({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:YB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var O7,yp0;var $vu=O(()=>{Ef();gp0();z4();n0();F$();b6();mhu();gfu();cGi();PV();y5();Ml();jpi();Tp0();wO();pL();O7=new Yu;O7.post("/local-session",async(i)=>{if(!r5())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=wvu(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (wO(),xTi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),ss0)),E=await ts();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await ITi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});O7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(A5(c))return i.json({role:c,capabilities:X00()});if(c==="user")return i.json({role:c,capabilities:kri({self:[...JEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:kri($)})});O7.get("/domain-lookup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(m0().db).getAllByDomain(t)).filter(EGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await m0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});O7.post("/domain-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=m0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await vt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!GN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});O7.post("/domain-setup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=m0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let U=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((T)=>T.organizationId)).executeTakeFirst();if(U)return i.json({success:!0,slug:U.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=T===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await vt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let U=vu().firecrawlApiKey;if(U){let T=await Thi(t,U,d);if(T){let A=new Rm(m0().db),G=await A.create(N,T);if(await A.setDefault(G.id,N),Z=!0,T.name&&T.name!==d)B=T.name;F=T.favicon??T.logo??null}}}catch(U){console.error("[Auth] Brand extraction failed (non-fatal):",U)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await vt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(U){console.error("[Auth] Org update failed (non-fatal):",U)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});O7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await vt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!Gv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new RH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});O7.post("/domain-request-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=m0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new RH(E).create(c.id,u.user.id),await PU4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});O7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await vt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await wGi({db:m0().db,authApi:vt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});yp0=O7});async function DGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as GU4}from"crypto";function IU4(i,u){let t=GU4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var Pp0,Gp0;var Ip0=O(()=>{Ef();F$();Pp0=new Yu;Pp0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await DGi(f,vt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await vt.$context,c=await E.internalAdapter.createSession(l,!1),w=IU4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});Gp0=Pp0});function jp0(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function xU4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!vGi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function xp0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function kp0(i){let u=await vt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function kU4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!vu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return shu(t.id),u()}function Xp0(){let i=new Yu;return i.use("*",xU4),i.use("*",kU4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await vt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await kp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await vt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;xp0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=m0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!qH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await m0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await vt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(GN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await kp0(u),h=$??w;return xp0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var hvu="/api/_admin";var Jp0=O(()=>{Ef();F$();y5();b6();z4();n0()});import*as NGi from"jose";function jU4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await dvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await dvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await vvu(E.issuer,E.discoveryEndpoint),w=XU4(),$=await JU4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});_V(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=sL(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");_V(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await vvu($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=NGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await NGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await dvu(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!KU4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await vvu(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function _Gi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=vu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function vvu(i,u){let t=u||i,f=Kp0.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;_Gi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return _Gi(c.authorization_endpoint),_Gi(c.token_endpoint),_Gi(c.jwks_uri),Kp0.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function XU4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function JU4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function dvu(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function KU4(i){return A5(i.organization?.role)}function Dvu(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var OGi=()=>{let i=new Yu;return jU4(i),i},Kp0;var _vu=O(()=>{Ef();jEi();n0();y5();Kp0=new Map});function SU4(i){if(i==="claude-code")return YU4;if(i==="codex")return WU4;return null}function Yp0(i,u){return SU4(i)?.[u]??null}var YU4,WU4;var Wp0=O(()=>{YU4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 4.8 1M"}},WU4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});var Sp0=O(()=>{Wp0()});function Lp0(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function LU4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function Qp0(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(Lp0(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(Lp0(c))return c.toolCallId===t;if(LU4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function QU4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function HU4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function Hp0(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Bo({messages:t}),l=QU4(f),E=await Tg(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=HU4(E),$=Qp0(w),v=b4u({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,U=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...U?{providerOptions:{google:U}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var zp0=O(()=>{Nf()});function np0(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var Rp0=()=>{};function ZGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}function Nvu(i){return/[.*>\s]/.test(i)}async function BGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=ZGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(Nvu(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function Ip(i){let u=await BGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var bp0=O(()=>{Ch()});import{z as ul}from"zod";var zU4,nU4,Cp0;var Mp0=O(()=>{U$();e9();zU4=ul.looseObject({id:ul.string().optional(),role:ul.enum(["user","assistant","system"]),parts:ul.array(ul.record(ul.string(),ul.unknown())),metadata:ul.unknown().optional()}),nU4=ul.object({windowSize:ul.number().int().min(1).max(500).default(P5),thread_id:ul.string()}),Cp0=ul.object({messages:ul.array(zU4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:nU4.optional(),tier:Og0.optional(),agent:ul.object({id:ul.string()}).loose(),stream:ul.boolean().optional(),temperature:ul.number().default(0.5),thread_id:ul.string().optional(),branch:ul.string().nullish(),toolApprovalLevel:ul.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:ul.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:ul.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:ul.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function FGi(i){qp0.set(i.id,i)}function Vp0(i){return qp0.get(i)}var qp0;var Ovu=O(()=>{qp0=new Map});function Zvu(i,u,t){let f=Vp0(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var Bvu=O(()=>{Ovu()});class Fvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return Zvu(this.harnessId,i,this.ctx)}}var rp0=O(()=>{Bvu()});function gGi(i,u){return nN(i,u)}var gvu=O(()=>{M5()});import{z as Ri}from"zod";import{existsSync as sU4}from"fs";import{query as pp0}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bL6,tool as CL6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as ML6,InMemorySessionStore as qL6,HOOK_EVENTS as VL6,AbortError as rL6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as eL6,forkSession as aL6,getSessionInfo as oL6,getSessionMessages as sL6,deleteSession as pL6,renameSession as iQ6,tagSession as uQ6,listSubagents as tQ6,getSubagentMessages as fQ6,foldSessionSummary as lQ6,importSessionToStore as EQ6}from"@anthropic-ai/claude-agent-sdk";import{startup as wQ6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as hQ6,tool as vQ6}from"@anthropic-ai/claude-agent-sdk";import"zod";function bU4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>mp0)return`${u.slice(0,mp0)}...[truncated]`;return u}function CU4(i){return i.replace(/\s+/g,"")}function MU4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function QR(i,u){let t=i.trim(),f=CU4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function Pvu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function qU4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=Pvu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return QR(f,t)}function VU4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:RU4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=QR(E,c);return w?{content:w}:{warning:r8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=QR(E,c);return w?{content:w}:{warning:r8}}if(u){let E=QR(u,t);if(E)return{content:E}}return{warning:r8}}function rU4(i){if(!i||typeof i!=="object")return{warning:r8};let u=i.image,t=Pvu(i.mimeType);if(typeof u==="string")return VU4(u,t);if(u&&typeof u==="object"){let f=qU4(u,t);return f?{content:f}:{warning:r8}}return{warning:r8}}function mU4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function eU4(i){let u=Pvu(i.mediaType??i.mimeType);if(!u||!MU4(u))return{};let t=i.data;if(typeof t==="string"){let f=QR(u,t);return f?{content:f}:{warning:r8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=mU4(t);if(!f)return{warning:r8};let l=QR(u,f);return l?{content:l}:{warning:r8}}return{warning:r8}}function ep0(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
+  `.execute(i)).rows[0]?.exists??!1}async function Ms0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!GN(f))throw f}}async function qs0(i,u){for(let t=0;t<ns0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return Vg4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!rg4(l)||t===ns0-1)throw l}}throw Error("Failed to create organization")}var ns0=5,zg4,ng4;var mhu=O(()=>{cGi();zg4=["labs","agent","studio","workspace","systems","core","cloud","works"],ng4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var ss0={};Gi(ss0,{resetPasswordEnabled:()=>hGi,grantDeploymentAdmin:()=>shu,getTrustedOrigins:()=>vGi,authConfig:()=>uf,auth:()=>vt,GENERIC_EMAIL_DOMAINS:()=>Gv});import{randomBytes as mg4}from"crypto";import{sso as eg4}from"@better-auth/sso";import{organization as ag4}from"@decocms/better-auth/plugins";import{betterAuth as og4}from"better-auth";import{admin as sg4,apiKey as pg4,jwt as iU4,magicLink as uU4,mcp as tU4,openAPI as fU4}from"better-auth/plugins";import{emailOTP as lU4}from"better-auth/plugins/email-otp";import{APIError as ms0}from"better-auth/api";import{adminAc as EU4,defaultRoles as cU4}from"better-auth/plugins/admin/access";import{defaultStatements as wU4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as $U4}from"@decocms/better-auth/plugins/access";function Vs0(i){if(!Uhi(i))return;throw new ms0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function shu(i){if(!ehu.includes(i))ehu.push(i)}function vGi(){let i=[Pp];try{let u=new URL(Pp);if(u.hostname==="localhost")i.push(Pp.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Pp.replace("127.0.0.1","localhost"))}catch{}return i}var es0,hU4,$Gi,ohu,vU4,dU4,DU4,rs0,ehu,uf,as0=void 0,ahu=void 0,hGi=!1,_U4,NU4,OU4,Pp,os0,ZU4=262144,BU4,vt;var F$=O(()=>{n0();pL();Jri();z4();Ml();b6();Mf0();PV();Vf0();Ks0();Ws0();Ss0();y5();ppi();Qs0();cGi();mhu();cfu();es0=Object.values(xB()).map((i)=>i.map((u)=>u.name)).flat(),hU4={...wU4,self:["*",...es0]},$Gi=$U4(hU4),ohu=spi(es0),vU4=$Gi.newRole(ohu.user),dU4=$Gi.newRole(ohu.admin),DU4=$Gi.newRole(ohu.owner),rs0=Object.values(xB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),ehu=[];uf=kB().auth;if(uf.inviteEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=f2(uf.emailProviders,uf.inviteEmailProviderId);if(i){let u=t2(i);as0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${wl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:l2({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:YB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(uf.resetPasswordEmailProviderId&&uf.emailProviders&&uf.emailProviders.length>0){let i=f2(uf.emailProviders,uf.resetPasswordEmailProviderId);if(i){let u=t2(i);hGi=!0,ahu=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:l2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:YB("Reset password",f)+oEi("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}_U4=[ag4({organizationCreation:{afterCreate:async(i)=>{await Js0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Vs0(i.slug)},afterAddMember:async({member:i})=>{try{await bhu(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await bhu(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Vs0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await Ys0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:$Gi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:Cm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:vU4,admin:dU4,owner:DU4},sendInvitationEmail:as0}),tU4({loginPage:"/login",oidcConfig:{scopes:rs0,metadata:{scopes_supported:rs0},loginPage:"/login"}}),pg4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),sg4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...cU4,owner:EU4},adminUserIds:ehu}),fU4(),iU4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),eg4(uf.ssoConfig?Ls0(uf.ssoConfig):void 0),...uf.magicLinkConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[uU4(qf0(uf.magicLinkConfig,uf.emailProviders))]:[],...uf.emailOtpConfig?.enabled&&uf.emailProviders&&uf.emailProviders.length>0?[lU4(Cf0(uf.emailOtpConfig,uf.emailProviders))]:[]],NU4=O_(),OU4=LM(NU4),Pp=wl();os0=vu(),BU4=os0.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),mg4(32).toString("base64")})(),vt=og4({secret:BU4,logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Pp,trustedOrigins:vGi(),database:OU4,socialProviders:uf.socialProviders,...uf.ssoConfig&&{account:{accountLinking:{trustedProviders:[uf.ssoConfig.providerId]}}},emailAndPassword:{enabled:uf.emailAndPassword.enabled,...ahu&&{sendResetPassword:ahu}},rateLimit:{enabled:!os0.disableRateLimit,window:60,max:1e4},plugins:_U4,databaseHooks:{user:{create:{after:async(i)=>{Chu({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified}),mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name}});let u=kB().autoCreateOrganizationOnSignup!==!1;try{let t=await wGi({db:m0().db,authApi:vt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:u,createdVia:"signup"});if(t.status==="created")mu.groupIdentify({groupType:"organization",groupKey:t.organization.id,properties:{name:t.organization.name,slug:t.organization.slug,created_at:new Date().toISOString(),created_via:t.createdVia,email_domain:t.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,name:t.organization.name,created_via:t.createdVia,email_domain:t.domain}});if(t.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:t.organization.id},properties:{organization_id:t.organization.id,organization_slug:t.organization.slug,email_domain:t.domain,joined_via:t.createdVia}})}catch(t){mu.captureException(t,i.id),console.error("Failed to ensure organization on signup:",t)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>ZU4)throw new ms0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await m0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;Chu({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function phu(i,u){return`${i}:${u}`}function ps0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=phu(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=phu(E,c);f.set($,{role:w,expiresAt:Date.now()+u,organizationId:c}),l()},invalidate(E,c){f.delete(phu(E,c))},invalidateOrg(E){for(let[c,w]of f)if(w.organizationId===E)f.delete(c)}}}class ivu{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=ip0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of ip0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var ip0;var up0=O(()=>{ip0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function FU4(i,u,t=5){try{await F1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function tp0(i){let u=new ivu({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{FU4("[NatsSSEBroadcast]",()=>u.start())})}var uvu=O(()=>{Z4();up0();wvi();wvi()});var fp0=()=>{};var tvu=()=>{};var lp0=()=>{};var gU4,iW6;var Ep0=O(()=>{fp0();tvu();r_();lp0();gU4={br:".br",zstd:".zst",gzip:".gz"},iW6=Object.keys(gU4)});var cp0=O(()=>{Ep0()});var wp0=()=>{};var $p0=O(()=>{wp0()});var hp0=()=>{};var vp0=O(()=>{Bri()});var fvu=O(()=>{m_();vp0()});var lvu="x-hono-disable-ssg",gW6;var Evu=O(()=>{fvu();gW6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[lvu]:"true"}})}catch{return null}})()});var dp0=O(()=>{TEi()});var cvu=O(()=>{dp0()});var Dp0=O(()=>{$p0();hp0();tvu();Evu();cvu();fvu()});var _p0=O(()=>{Evu();cvu();Dp0()});var uS6;var Np0=O(()=>{_p0();({write:uS6}=Bun)});var AU4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},Op0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var Zp0=()=>{};var Gp=(i)=>("server"in i.env)?i.env.server:i.env;var dGi=()=>{};var yU4;var Bp0=O(()=>{Zp0();dGi();yU4=Op0((i,u)=>{let t=Gp(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var wvu=(i)=>{let u=Gp(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var Fp0=O(()=>{dGi()});var gp0=O(()=>{cp0();Np0();Bp0();Fp0();dGi()});var Up0;var Tp0=O(()=>{Up0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function Ap0(){let i=Object.keys(uf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:Up0[l].icon})),f=vu().localMode;return{emailAndPassword:{enabled:uf.emailAndPassword?.enabled??!1},magicLink:{enabled:uf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:uf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:hGi},socialProviders:{enabled:u,providers:t},sso:uf.ssoConfig?{enabled:!0,providerId:uf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:r5()}}async function PU4(i,u,t){try{if(!uf.inviteEmailProviderId||!uf.emailProviders||uf.emailProviders.length===0)return;let f=f2(uf.emailProviders,uf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=Cm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=t2(f),$=`${wl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:l2({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:YB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var O7,yp0;var $vu=O(()=>{Ef();gp0();z4();n0();F$();b6();mhu();gfu();cGi();PV();y5();Ml();jpi();Tp0();wO();pL();O7=new Yu;O7.post("/local-session",async(i)=>{if(!r5())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=wvu(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (wO(),xTi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),ss0)),E=await ts();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await ITi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});O7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(A5(c))return i.json({role:c,capabilities:X00()});if(c==="user")return i.json({role:c,capabilities:kri({self:[...JEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:kri($)})});O7.get("/domain-lookup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(m0().db).getAllByDomain(t)).filter(EGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await m0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});O7.post("/domain-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=m0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await vt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!GN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});O7.post("/domain-setup",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=m0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let U=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((T)=>T.organizationId)).executeTakeFirst();if(U)return i.json({success:!0,slug:U.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=T===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await vt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let U=vu().firecrawlApiKey;if(U){let T=await Thi(t,U,d);if(T){let A=new Rm(m0().db),G=await A.create(N,T);if(await A.setDefault(G.id,N),Z=!0,T.name&&T.name!==d)B=T.name;F=T.favicon??T.logo??null}}}catch(U){console.error("[Auth] Brand extraction failed (non-fatal):",U)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await vt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(U){console.error("[Auth] Org update failed (non-fatal):",U)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});O7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await vt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=m0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await vt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!Gv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new RH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});O7.post("/domain-request-join",async(i)=>{let u=await vt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Gv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=m0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new RH(E).create(c.id,u.user.id),await PU4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});O7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await vt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await wGi({db:m0().db,authApi:vt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});yp0=O7});async function DGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as GU4}from"crypto";function IU4(i,u){let t=GU4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var Pp0,Gp0;var Ip0=O(()=>{Ef();F$();Pp0=new Yu;Pp0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await DGi(f,vt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await vt.$context,c=await E.internalAdapter.createSession(l,!1),w=IU4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});Gp0=Pp0});function jp0(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function xU4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!vGi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function xp0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function kp0(i){let u=await vt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function kU4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!vu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return shu(t.id),u()}function Xp0(){let i=new Yu;return i.use("*",xU4),i.use("*",kU4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await vt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),vt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await kp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await vt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;xp0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=m0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!qH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await m0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await vt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(GN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await kp0(u),h=$??w;return xp0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var hvu="/api/_admin";var Jp0=O(()=>{Ef();F$();y5();b6();z4();n0()});import*as NGi from"jose";function jU4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await dvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await dvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await vvu(E.issuer,E.discoveryEndpoint),w=XU4(),$=await JU4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});_V(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=sL(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");_V(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await vvu($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=NGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await NGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await dvu(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!KU4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await vvu(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Dvu(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function _Gi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=vu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function vvu(i,u){let t=u||i,f=Kp0.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;_Gi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return _Gi(c.authorization_endpoint),_Gi(c.token_endpoint),_Gi(c.jwks_uri),Kp0.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function XU4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function JU4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function dvu(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function KU4(i){return A5(i.organization?.role)}function Dvu(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var OGi=()=>{let i=new Yu;return jU4(i),i},Kp0;var _vu=O(()=>{Ef();jEi();n0();y5();Kp0=new Map});function SU4(i){if(i==="claude-code")return YU4;if(i==="codex")return WU4;return null}function Yp0(i,u){return SU4(i)?.[u]??null}var YU4,WU4;var Wp0=O(()=>{YU4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 5 1M"}},WU4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});var Sp0=O(()=>{Wp0()});function Lp0(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function LU4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function Qp0(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(Lp0(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(Lp0(c))return c.toolCallId===t;if(LU4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function QU4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function HU4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function Hp0(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Bo({messages:t}),l=QU4(f),E=await Tg(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=HU4(E),$=Qp0(w),v=b4u({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,U=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...U?{providerOptions:{google:U}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var zp0=O(()=>{Nf()});function np0(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var Rp0=()=>{};function ZGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}function Nvu(i){return/[.*>\s]/.test(i)}async function BGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=ZGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(Nvu(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function Ip(i){let u=await BGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var bp0=O(()=>{Ch()});import{z as ul}from"zod";var zU4,nU4,Cp0;var Mp0=O(()=>{U$();e9();zU4=ul.looseObject({id:ul.string().optional(),role:ul.enum(["user","assistant","system"]),parts:ul.array(ul.record(ul.string(),ul.unknown())),metadata:ul.unknown().optional()}),nU4=ul.object({windowSize:ul.number().int().min(1).max(500).default(P5),thread_id:ul.string()}),Cp0=ul.object({messages:ul.array(zU4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:nU4.optional(),tier:Og0.optional(),agent:ul.object({id:ul.string()}).loose(),stream:ul.boolean().optional(),temperature:ul.number().default(0.5),thread_id:ul.string().optional(),branch:ul.string().nullish(),toolApprovalLevel:ul.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:ul.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:ul.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:ul.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function FGi(i){qp0.set(i.id,i)}function Vp0(i){return qp0.get(i)}var qp0;var Ovu=O(()=>{qp0=new Map});function Zvu(i,u,t){let f=Vp0(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var Bvu=O(()=>{Ovu()});class Fvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return Zvu(this.harnessId,i,this.ctx)}}var rp0=O(()=>{Bvu()});function gGi(i,u){return nN(i,u)}var gvu=O(()=>{M5()});import{z as Ri}from"zod";import{existsSync as sU4}from"fs";import{query as pp0}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bL6,tool as CL6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as ML6,InMemorySessionStore as qL6,HOOK_EVENTS as VL6,AbortError as rL6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as eL6,forkSession as aL6,getSessionInfo as oL6,getSessionMessages as sL6,deleteSession as pL6,renameSession as iQ6,tagSession as uQ6,listSubagents as tQ6,getSubagentMessages as fQ6,foldSessionSummary as lQ6,importSessionToStore as EQ6}from"@anthropic-ai/claude-agent-sdk";import{startup as wQ6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as hQ6,tool as vQ6}from"@anthropic-ai/claude-agent-sdk";import"zod";function bU4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>mp0)return`${u.slice(0,mp0)}...[truncated]`;return u}function CU4(i){return i.replace(/\s+/g,"")}function MU4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function QR(i,u){let t=i.trim(),f=CU4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function Pvu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function qU4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=Pvu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return QR(f,t)}function VU4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:RU4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=QR(E,c);return w?{content:w}:{warning:r8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=QR(E,c);return w?{content:w}:{warning:r8}}if(u){let E=QR(u,t);if(E)return{content:E}}return{warning:r8}}function rU4(i){if(!i||typeof i!=="object")return{warning:r8};let u=i.image,t=Pvu(i.mimeType);if(typeof u==="string")return VU4(u,t);if(u&&typeof u==="object"){let f=qU4(u,t);return f?{content:f}:{warning:r8}}return{warning:r8}}function mU4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function eU4(i){let u=Pvu(i.mediaType??i.mimeType);if(!u||!MU4(u))return{};let t=i.data;if(typeof t==="string"){let f=QR(u,t);return f?{content:f}:{warning:r8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=mU4(t);if(!f)return{warning:r8};let l=QR(u,f);return l?{content:l}:{warning:r8}}return{warning:r8}}function ep0(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
 `),Z=w(N?`Human: ${N}`:"");if(N)u.push(N);for(let B of _.content)if(B.type==="image"){let{content:F,warning:g}=rU4(B);if(F)$(Z,F);else if(g)t.push(g)}else if(B.type==="file"){let{content:F,warning:g}=eU4(B);if(F)$(Z,F);else if(g)t.push(g)}}break;case"assistant":{let N="";if(typeof _.content==="string")N=_.content;else{let B=_.content.filter((g)=>g.type==="text").map((g)=>g.text).join(`
 `);if(B)N=B;let F=_.content.filter((g)=>g.type==="tool-call");if(F.length>0){let g=F.map((U)=>`[Tool call: ${U.toolName}(${bU4(U.input)})]`).join(`
 `);N+=N?`