decocms 4.150.8 → 4.150.9

package/dist/server/cli.js

@@ -83448,7 +83448,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=yq(d),_=D&&yq(t)?bau(t):t,N=D?bau(d):Cau(d),Z=crt(_,N);return Z===""||!Z.startsWith("..")&&!lrt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(l6i)},reconcile(){let d=Date.now();for(let D of l.all().map(l6i)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!yq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(l6i)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!yq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!K_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=K_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=qau(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}trt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=l6i(D),N=0,Z=null;if(yq(_.sandboxPath)&&K_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=K_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=qau(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var Kbi=()=>{};function vrt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function rau(i,u){if(process.platform==="win32")return;for(let t of vrt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var mau=()=>{};import{existsSync as drt,readdirSync as Drt}from"fs";import{rm as _rt}from"fs/promises";import{join as eau}from"path";async function aau(i,u={}){let t=u.detach??Nrt,f=u.exists??drt,l=u.readdir??((w)=>Drt(w)),E=u.rm??((w)=>_rt(w,{recursive:!0,force:!0})),c=eau(i,"org");if(f(c))for(let w of l(c))t(eau(c,w));await E(i)}var Nrt=(i)=>rau(i,process.platform==="darwin");var oau=O(()=>{mau()});import{join as Ort}from"path";function sau(i){let u=i.purge??aau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await F1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??Ort(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var pau=O(()=>{Z4();oau()});import{randomBytes as Zrt}from"crypto";import{mkdir as Brt}from"fs/promises";import{createServer as Frt}from"net";import{join as grt}from"path";function iou(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function uou(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function tou(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function Urt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function Trt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:Urt(i.repo?.cloneUrl)}}function fou(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??Art,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>grt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=Trt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,U;try{await Brt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),U=Zrt(24).toString("hex");let[k,I]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${I} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:U,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(j){throw iou("the sandbox didn't come online in time",j)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,I,{repo:N.repo,workload:N.workload,operator:N.operator},U)}catch(j){throw iou(uou(j)?"configuration timed out":"the sandbox rejected its configuration",j)}}catch(k){if((uou(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:tou(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:tou(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let T=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${T} previewUrl=${A}`);let G={handle:N.handle,port:F,process:g,sandboxApiUrl:T,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:U,registryMetadata:Z};if(t.set(N.handle,G),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===G)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:T,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function Art(){return new Promise((i,u)=>{let t=Frt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var lou=()=>{};import{randomUUID as yrt}from"crypto";import{hostname as Prt}from"os";async function Eou(i){let u=Prt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=HMu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=c6i({path:E6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=fou({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(j,C)=>c>0?`http://${j}.localhost:${c}`:`http://127.0.0.1:${C}`,spawnDaemon:async(j)=>{let C={DAEMON_BOOT_ID:yrt(),APP_ROOT:j.workdir,PROXY_PORT:String(j.port),DAEMON_TOKEN:j.daemonToken,OFFLOAD_ALLOWED_HOSTS:j.offloadAllowedHosts.join(","),...j.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(j.orgFsConfigJson){let S=await bMu(i.dataDir);if(S)C.ORGFS_CONFIG=j.orgFsConfigJson,C.ORGFS_RCLONE_PATH=S}let K=await t({workdir:j.workdir,env:C,daemonPort:j.port});return{port:j.port,kill:(S)=>K.kill(S),exited:K.exited.then(()=>{return})}},postConfig:async(j,C,K,S)=>{let r={port:C};if(K.workload)r.runtime=K.workload.runtime,r.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:r},ui=gh(K.operator??null);if(ui)Q.operator=ui;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await T_(`http://127.0.0.1:${j}`,S,Q)},waitForHealth:async(j)=>{await lli(`http://127.0.0.1:${j}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await Xau({port:i.port,lookupSandboxPort:(j)=>w.proxyPort(j)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=MMu({provider:w}),v=async()=>{let j=await U_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!j)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return j.accessToken},d=await nau(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await Jbi(),N=Hau(_,{onChange:(j)=>{console.log(`[link-daemon] capabilities detected: +${j.join(",")} (now: ${_.join(",")})`)}}),Z=Uni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let U=await Fau(g);console.log("[link-daemon] active transport=tunnel");let T,A=new Promise((j)=>{T=j}),G=!1,k=async()=>{if(G)return;G=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await U.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),T(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},U.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!G)console.error("Cluster connection closed permanently; exiting."),k()});let I=sau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(c){throw E(),c}}var cou=O(()=>{_ni();rM();zMu();CMu();qMu();Tni();gau();Jau();zau();Rau();VM();Kbi();pau();lou()});function Ybi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as Grt}from"net";async function xrt(i){for(let u of Irt)if(await Wbi(i,u))return u;return null}async function wou(i,{intervalMs:u=1000,sleepFn:t=P0}={}){for(;;){let f=await xrt(i);if(f)return f;await t(u)}}function Wbi(i,u){return new Promise((t)=>{let f=Grt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var Irt;var Lbi=O(()=>{Z4();Irt=["localhost","127.0.0.1","0.0.0.0"]});function $ou(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function krt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function hou(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${krt(i,u)}`].join(`
-`)}var Sbi;var vou=O(()=>{Sbi=class Sbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var GS;var w6i=O(()=>{GS={name:"decocms",version:"4.150.8",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Pq={};yi(Pq,{printBanner:()=>Jrt,bannerLines:()=>dou,BANNER_LINES:()=>$6i,BANNER_GRADIENT:()=>h6i});function Xrt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function dou(i){let u=$6i.map((t,f)=>{let[l,E,c]=Xrt(h6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Jrt(i){console.log("");for(let u of dou(i))console.log(u);console.log("")}var $6i,h6i;var IS=O(()=>{$6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],h6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as Krt,Text as Dou}from"ink";import{jsx as Yrt,jsxs as _ou}from"react/jsx-runtime";function v6i({version:i}){return _ou(Krt,{flexDirection:"column",marginTop:1,children:[$6i.map((u,t)=>Yrt(Dou,{color:h6i[t],children:u},t)),_ou(Dou,{dimColor:!0,children:[" v",i]})]})}var Qbi=O(()=>{IS()});function Nou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function xS(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Oou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Zou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Rbi={};yi(Rbi,{subscribeLinkState:()=>Hbi,setSelectedHandle:()=>zbi,setRemoving:()=>_6i,setPersistedSandboxes:()=>Crt,setPendingConfirm:()=>Iq,setMachine:()=>zrt,setLogPath:()=>Rrt,setLinkActions:()=>brt,setIngress:()=>Hrt,setDaemonError:()=>nrt,setClusterUrl:()=>Qrt,setCluster:()=>Srt,setActionError:()=>D6i,resetLinkStateForTests:()=>qrt,removeSandboxRow:()=>nbi,pushSandboxEvent:()=>Mrt,getLinkState:()=>Gq,applySandboxEvent:()=>Bou});function Lrt(i){return i==="spawning"||i==="ready"||i==="failed"}function Bou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Fou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Wrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of d6i)i()}function Gq(){return Ef}function Hbi(i){return d6i.add(i),()=>d6i.delete(i)}function Srt(i){Ef={...Ef,cluster:i},b3()}function Qrt(i){Ef={...Ef,clusterUrl:i},b3()}function Hrt(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},b3()}function zrt(i){Ef={...Ef,machine:i},b3()}function nrt(i){Ef={...Ef,daemonError:i},b3()}function Rrt(i){Ef={...Ef,logPath:i},b3()}function zbi(i){Ef={...Ef,selectedHandle:i},b3()}function Iq(i){Ef={...Ef,pendingConfirm:i},b3()}function D6i(i){Ef={...Ef,actionError:i},b3()}function _6i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},b3()}function brt(i){Ef={...Ef,actions:i},b3()}function nbi(i){let u=xS(Ef.sandboxes),t=Zou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function Crt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Lrt(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},b3()}function Mrt(i){Ef={...Ef,sandboxes:Bou(Ef.sandboxes,i)},b3()}function qrt(){Ef=Fou(),d6i.clear()}var Wrt=20,Ef,d6i;var xq=O(()=>{Ef=Fou(),d6i=new Set});import{spawn as Vrt}from"child_process";function rrt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function gou(i,u=process.platform){let t=rrt(u);try{Vrt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Uou=()=>{};function Tou(i,u={}){let t=u.openUrl??gou,f=Gq(),l=xS(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":zbi(Oou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);D6i(null),Iq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Iq(null),w===null||!c)return;_6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)nbi(w.handle);else _6i(w.handle,!1),D6i($.error)});return}case"confirmNo":Iq(null);return;case"quit":if(c)c.quit();return}}var Aou=O(()=>{xq();Uou()});function you(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Pou={};yi(Pou,{LinkApp:()=>ort});import{Box as C1,Text as vl,useInput as mrt}from"ink";import{useSyncExternalStore as ert}from"react";import{jsx as Xf,jsxs as Xh}from"react/jsx-runtime";function art(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function ort(){let i=ert(Hbi,Gq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=xS(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return mrt((l,E)=>{let c=you(l,E,i.pendingConfirm!==null);if(c!==null)Tou(c)}),Xh(C1,{flexDirection:"column",children:[Xf(v6i,{version:GS.version}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),Xf(C1,{children:i.cluster==="linked"?Xh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Xh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Xh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Xf(C1,{children:i.ingressUrl?Xh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Xf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Xf(vl,{dimColor:!0,children:"No previews running yet."}):Xh(C1,{flexDirection:"column",children:[Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0}),Xf(C1,{width:kS.project,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Xf(C1,{width:kS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Xf(C1,{width:kS.status,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=art(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0,children:Xf(vl,{color:"cyan",children:c?"\u203A":" "})}),Xf(C1,{width:kS.project,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Xf(C1,{width:kS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Xf(C1,{width:kS.status,flexShrink:0,marginRight:1,children:Xf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Xf(C1,{marginTop:1,children:Xh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Xf(C1,{marginTop:1,children:Xf(vl,{color:"yellow",children:Nou(i.pendingConfirm)})}):null,i.actionError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,Xf(C1,{marginTop:1,children:Xf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var kS;var Gou=O(()=>{w6i();Qbi();Aou();xq();kS={project:18,branch:22,status:14}});var Iou={};yi(Iou,{runLinkCommand:()=>Emt});import{closeSync as srt,mkdirSync as prt,openSync as imt,writeSync as umt}from"fs";import{homedir as tmt}from"os";import{join as bbi}from"path";function fmt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{umt(u,`${Ybi(l)}
+`)}var Sbi;var vou=O(()=>{Sbi=class Sbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var GS;var w6i=O(()=>{GS={name:"decocms",version:"4.150.9",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Pq={};yi(Pq,{printBanner:()=>Jrt,bannerLines:()=>dou,BANNER_LINES:()=>$6i,BANNER_GRADIENT:()=>h6i});function Xrt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function dou(i){let u=$6i.map((t,f)=>{let[l,E,c]=Xrt(h6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Jrt(i){console.log("");for(let u of dou(i))console.log(u);console.log("")}var $6i,h6i;var IS=O(()=>{$6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],h6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as Krt,Text as Dou}from"ink";import{jsx as Yrt,jsxs as _ou}from"react/jsx-runtime";function v6i({version:i}){return _ou(Krt,{flexDirection:"column",marginTop:1,children:[$6i.map((u,t)=>Yrt(Dou,{color:h6i[t],children:u},t)),_ou(Dou,{dimColor:!0,children:[" v",i]})]})}var Qbi=O(()=>{IS()});function Nou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function xS(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Oou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Zou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Rbi={};yi(Rbi,{subscribeLinkState:()=>Hbi,setSelectedHandle:()=>zbi,setRemoving:()=>_6i,setPersistedSandboxes:()=>Crt,setPendingConfirm:()=>Iq,setMachine:()=>zrt,setLogPath:()=>Rrt,setLinkActions:()=>brt,setIngress:()=>Hrt,setDaemonError:()=>nrt,setClusterUrl:()=>Qrt,setCluster:()=>Srt,setActionError:()=>D6i,resetLinkStateForTests:()=>qrt,removeSandboxRow:()=>nbi,pushSandboxEvent:()=>Mrt,getLinkState:()=>Gq,applySandboxEvent:()=>Bou});function Lrt(i){return i==="spawning"||i==="ready"||i==="failed"}function Bou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Fou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Wrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of d6i)i()}function Gq(){return Ef}function Hbi(i){return d6i.add(i),()=>d6i.delete(i)}function Srt(i){Ef={...Ef,cluster:i},b3()}function Qrt(i){Ef={...Ef,clusterUrl:i},b3()}function Hrt(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},b3()}function zrt(i){Ef={...Ef,machine:i},b3()}function nrt(i){Ef={...Ef,daemonError:i},b3()}function Rrt(i){Ef={...Ef,logPath:i},b3()}function zbi(i){Ef={...Ef,selectedHandle:i},b3()}function Iq(i){Ef={...Ef,pendingConfirm:i},b3()}function D6i(i){Ef={...Ef,actionError:i},b3()}function _6i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},b3()}function brt(i){Ef={...Ef,actions:i},b3()}function nbi(i){let u=xS(Ef.sandboxes),t=Zou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function Crt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Lrt(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},b3()}function Mrt(i){Ef={...Ef,sandboxes:Bou(Ef.sandboxes,i)},b3()}function qrt(){Ef=Fou(),d6i.clear()}var Wrt=20,Ef,d6i;var xq=O(()=>{Ef=Fou(),d6i=new Set});import{spawn as Vrt}from"child_process";function rrt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function gou(i,u=process.platform){let t=rrt(u);try{Vrt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Uou=()=>{};function Tou(i,u={}){let t=u.openUrl??gou,f=Gq(),l=xS(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":zbi(Oou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);D6i(null),Iq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Iq(null),w===null||!c)return;_6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)nbi(w.handle);else _6i(w.handle,!1),D6i($.error)});return}case"confirmNo":Iq(null);return;case"quit":if(c)c.quit();return}}var Aou=O(()=>{xq();Uou()});function you(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Pou={};yi(Pou,{LinkApp:()=>ort});import{Box as C1,Text as vl,useInput as mrt}from"ink";import{useSyncExternalStore as ert}from"react";import{jsx as Xf,jsxs as Xh}from"react/jsx-runtime";function art(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function ort(){let i=ert(Hbi,Gq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=xS(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return mrt((l,E)=>{let c=you(l,E,i.pendingConfirm!==null);if(c!==null)Tou(c)}),Xh(C1,{flexDirection:"column",children:[Xf(v6i,{version:GS.version}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),Xf(C1,{children:i.cluster==="linked"?Xh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Xh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Xh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Xf(C1,{children:i.ingressUrl?Xh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Xf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Xf(vl,{dimColor:!0,children:"No previews running yet."}):Xh(C1,{flexDirection:"column",children:[Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0}),Xf(C1,{width:kS.project,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Xf(C1,{width:kS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Xf(C1,{width:kS.status,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=art(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0,children:Xf(vl,{color:"cyan",children:c?"\u203A":" "})}),Xf(C1,{width:kS.project,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Xf(C1,{width:kS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Xf(C1,{width:kS.status,flexShrink:0,marginRight:1,children:Xf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Xf(C1,{marginTop:1,children:Xh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Xf(C1,{marginTop:1,children:Xf(vl,{color:"yellow",children:Nou(i.pendingConfirm)})}):null,i.actionError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,Xf(C1,{marginTop:1,children:Xf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var kS;var Gou=O(()=>{w6i();Qbi();Aou();xq();kS={project:18,branch:22,status:14}});var Iou={};yi(Iou,{runLinkCommand:()=>Emt});import{closeSync as srt,mkdirSync as prt,openSync as imt,writeSync as umt}from"fs";import{homedir as tmt}from"os";import{join as bbi}from"path";function fmt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{umt(u,`${Ybi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(Ybi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function lmt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function Emt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??bbi(tmt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await Wbi(u,"127.0.0.1"))throw new Sbi(u);let $=bbi(t,"sandboxes");c=c6i({path:E6i(t),managedSandboxRoot:$});let h=await ili({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await lmt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (Gou(),Pou)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:U,setDaemonError:T,setIngress:A,setLogPath:G,setMachine:k,setPersistedSandboxes:I}=await Promise.resolve().then(() => (xq(),Rbi));prt(t,{recursive:!0});let j=bbi(t,"link.log");E=imt(j,"w"),G(j),I(v),U(f),g("connecting"),d={onEvent:(C)=>F(C),onIngress:(C)=>A(C,`http://127.0.0.1:${C}`),onCluster:(C)=>g(C),onMachine:(C)=>k(C)},l=fmt(T,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (IS(),Pq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await Eou({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (xq(),Rbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error($ou($)?hou(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{srt(E)}catch{}w()}}var xou=O(()=>{Dni();cou();Lbi();vou();Kbi()});var mbi={};yi(mbi,{resolveDevLinkClusterUrl:()=>hmt,populateDevLinkToxiProxy:()=>You,isDevLinkToxiProxyEnabled:()=>$mt,ensureDevLinkToxiProxy:()=>Nmt,buildDevLinkToxiProxyConfig:()=>Jou,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>jou,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>Xou});function $mt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function Cbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function Jou(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=Cbi(i.apiPort,"apiPort"),f=Cbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=Cbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:jou,proxyName:Xou,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function hmt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function Mbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function rbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function Kou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return Kou(i.cause)}async function qbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${rbi(l)}`,{cause:l})}}async function You(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await qbi(u,"reset",t,{method:"POST"});await Mbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await qbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await Mbi(E,"populate",l)}async function vmt(i,u){let t=`${i.apiUrl}/version`;try{await F1(async()=>{let f=await qbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(wmt)});await Mbi(f,"readiness check",t)},{maxAttempts:cmt,minTimeout:kou,maxTimeout:kou,multiplier:1,jitter:0,isRetriable:(f)=>!Kou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${rbi(l)}`,{cause:l})}}async function dmt(i){if(i===null)return"";return await new Response(i).text()}async function Vbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${rbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,dmt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Dmt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await Vbi(["rm","-f",t],{ignoreFailure:!0}),await Vbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function _mt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await Vbi(["rm","-f",t],{ignoreFailure:!0})}async function Nmt(i){let u=Jou(i),t=i.startDaemon??Dmt,f=i.stopDaemon??(i.startDaemon===void 0?_mt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await vmt(u,l),await You(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var jou="ToxiProxy",Xou="dev_link_studio",cmt=20,kou=100,wmt=100;var ebi=O(()=>{Z4()});var Wou={};yi(Wou,{migrateBetterAuth:()=>abi});import{getMigrations as Omt}from"better-auth/db";import{sso as Zmt}from"@better-auth/sso";import{organization as Bmt}from"@decocms/better-auth/plugins";import{admin as Fmt,apiKey as gmt,jwt as Umt,magicLink as Tmt,mcp as Amt,openAPI as ymt}from"better-auth/plugins";import{emailOTP as Pmt}from"better-auth/plugins/email-otp";async function abi(i){let t={database:nM(i||Z_()),plugins:[Bmt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),Fmt(),gmt(),Umt(),ymt(),Amt({loginPage:"/login"}),Zmt(),Tmt({sendMagicLink:async()=>{}}),Pmt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await Omt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var obi=O(()=>{b6()});var sbi={};yi(sbi,{up:()=>Gmt,down:()=>Imt});import{sql as Fd}from"kysely";async function Gmt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function Imt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Lou=()=>{};var pbi={};yi(pbi,{up:()=>xmt,down:()=>kmt});import{sql as Sou}from"kysely";async function xmt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Sou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Sou`CURRENT_TIMESTAMP`)).execute()}async function kmt(i){await i.schema.dropTable("organization_settings").execute()}var Qou=()=>{};var iCi={};yi(iCi,{up:()=>jmt,down:()=>Xmt});async function jmt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Xmt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var uCi={};yi(uCi,{up:()=>Jmt,down:()=>Kmt});async function Jmt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function Kmt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var tCi={};yi(tCi,{up:()=>Ymt,down:()=>Wmt});async function Ymt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function Wmt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var fCi={};yi(fCi,{up:()=>Smt,down:()=>Qmt});import{sql as Lmt}from"kysely";async function Smt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Lmt`text`).execute()}async function Qmt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Hou=()=>{};var lCi={};yi(lCi,{up:()=>Hmt,down:()=>zmt});async function Hmt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function zmt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var ECi={};yi(ECi,{up:()=>nmt,down:()=>Rmt});import{sql as kq}from"kysely";async function nmt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function Rmt(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var zou=()=>{};var cCi={};yi(cCi,{up:()=>Cmt,down:()=>Mmt});import{sql as bmt}from"kysely";async function Cmt(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function Mmt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(bmt`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var nou=()=>{};var wCi={};yi(wCi,{up:()=>qmt,down:()=>Vmt});import{sql as N6i}from"kysely";async function qmt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await N6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function Vmt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var Rou=()=>{};var $Ci={};yi($Ci,{up:()=>rmt,down:()=>mmt});async function rmt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function mmt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var hCi={};yi(hCi,{up:()=>emt,down:()=>amt});import{sql as O6i}from"kysely";async function emt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await O6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -87026,7 +87026,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
         and status = 'pending'
         and "expiresAt" > now()
     ) as exists
-  `.execute(i)).rows[0]?.exists??!1}async function Op0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!IN(f))throw f}}async function Zp0(i,u){for(let t=0;t<dp0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return KU4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!YU4(l)||t===dp0-1)throw l}}throw Error("Failed to create organization")}var dp0=5,GU4,IU4;var cvu=O(()=>{dGi();GU4=["labs","agent","studio","workspace","systems","core","cloud","works"],IU4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var yp0={};yi(yp0,{resetPasswordEnabled:()=>NGi,grantDeploymentAdmin:()=>vvu,getTrustedOrigins:()=>OGi,authConfig:()=>tf,auth:()=>dt,GENERIC_EMAIL_DOMAINS:()=>Pv});import{randomBytes as WU4}from"crypto";import{sso as LU4}from"@better-auth/sso";import{organization as SU4}from"@decocms/better-auth/plugins";import{betterAuth as QU4}from"better-auth";import{admin as HU4,apiKey as zU4,jwt as nU4,magicLink as RU4,mcp as bU4,openAPI as CU4}from"better-auth/plugins";import{emailOTP as MU4}from"better-auth/plugins/email-otp";import{APIError as gp0}from"better-auth/api";import{adminAc as qU4,defaultRoles as VU4}from"better-auth/plugins/admin/access";import{defaultStatements as rU4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as mU4}from"@decocms/better-auth/plugins/access";function Bp0(i){if(!yhi(i))return;throw new gp0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function vvu(i){if(!wvu.includes(i))wvu.push(i)}function OGi(){let i=[Ip];try{let u=new URL(Ip);if(u.hostname==="localhost")i.push(Ip.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Ip.replace("127.0.0.1","localhost"))}catch{}return i}var Up0,eU4,_Gi,hvu,aU4,oU4,sU4,Fp0,wvu,tf,Tp0=void 0,$vu=void 0,NGi=!1,pU4,iT4,uT4,Ip,Ap0,tT4=262144,fT4,dt;var F$=O(()=>{R0();fQ();Rri();z4();Ml();b6();h40();kV();d40();fp0();Ep0();cp0();A5();hiu();$p0();dGi();cvu();Zfu();Up0=Object.values(KB()).map((i)=>i.map((u)=>u.name)).flat(),eU4={...rU4,self:["*",...Up0]},_Gi=mU4(eU4),hvu=$iu(Up0),aU4=_Gi.newRole(hvu.user),oU4=_Gi.newRole(hvu.admin),sU4=_Gi.newRole(hvu.owner),Fp0=Object.values(KB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),wvu=[];tf=YB().auth;if(tf.inviteEmailProviderId&&tf.emailProviders&&tf.emailProviders.length>0){let i=E2(tf.emailProviders,tf.inviteEmailProviderId);if(i){let u=l2(i);Tp0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${wl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:c2({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:HB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(tf.resetPasswordEmailProviderId&&tf.emailProviders&&tf.emailProviders.length>0){let i=E2(tf.emailProviders,tf.resetPasswordEmailProviderId);if(i){let u=l2(i);NGi=!0,$vu=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:c2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:HB("Reset password",f)+ici("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}pU4=[SU4({organizationCreation:{afterCreate:async(i)=>{await tp0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Bp0(i.slug)},afterAddMember:async({member:i})=>{try{await ivu(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await ivu(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Bp0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await lp0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:_Gi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:rm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:aU4,admin:oU4,owner:sU4},sendInvitationEmail:Tp0}),bU4({loginPage:"/login",oidcConfig:{scopes:Fp0,metadata:{scopes_supported:Fp0},loginPage:"/login"}}),zU4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),HU4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...VU4,owner:qU4},adminUserIds:wvu}),CU4(),nU4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),LU4(tf.ssoConfig?wp0(tf.ssoConfig):void 0),...tf.magicLinkConfig?.enabled&&tf.emailProviders&&tf.emailProviders.length>0?[RU4(v40(tf.magicLinkConfig,tf.emailProviders))]:[],...tf.emailOtpConfig?.enabled&&tf.emailProviders&&tf.emailProviders.length>0?[MU4($40(tf.emailOtpConfig,tf.emailProviders))]:[]],iT4=Z_(),uT4=nM(iT4),Ip=wl();Ap0=vu(),fT4=Ap0.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),WU4(32).toString("base64")})(),dt=QU4({secret:fT4,logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Ip,trustedOrigins:OGi(),database:uT4,socialProviders:tf.socialProviders,...tf.ssoConfig&&{account:{accountLinking:{trustedProviders:[tf.ssoConfig.providerId]}}},emailAndPassword:{enabled:tf.emailAndPassword.enabled,...$vu&&{sendResetPassword:$vu}},rateLimit:{enabled:!Ap0.disableRateLimit,window:60,max:1e4},plugins:pU4,databaseHooks:{user:{create:{after:async(i,u)=>{uvu({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified});let t=u?.getCookie("studio_signup_ref")??null,f=u?.getCookie("studio_signup_src")??null;mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name,...t?{signup_ref:t}:{},...f?{signup_src:f}:{}}});let l=YB().autoCreateOrganizationOnSignup!==!1;try{let E=await DGi({db:e0().db,authApi:dt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:l,createdVia:"signup"});if(E.status==="created")mu.groupIdentify({groupType:"organization",groupKey:E.organization.id,properties:{name:E.organization.name,slug:E.organization.slug,created_at:new Date().toISOString(),created_via:E.createdVia,email_domain:E.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:E.organization.id},properties:{organization_id:E.organization.id,organization_slug:E.organization.slug,name:E.organization.name,created_via:E.createdVia,email_domain:E.domain}});if(E.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:E.organization.id},properties:{organization_id:E.organization.id,organization_slug:E.organization.slug,email_domain:E.domain,joined_via:E.createdVia}})}catch(E){mu.captureException(E,i.id),console.error("Failed to ensure organization on signup:",E)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>tT4)throw new gp0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await e0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;uvu({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function dvu(i,u){return`${i}:${u}`}function Pp0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=dvu(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=dvu(E,c);f.set($,{role:w,expiresAt:Date.now()+u,organizationId:c}),l()},invalidate(E,c){f.delete(dvu(E,c))},invalidateOrg(E){for(let[c,w]of f)if(w.organizationId===E)f.delete(c)}}}class Dvu{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=Gp0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of Gp0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var Gp0;var Ip0=O(()=>{Gp0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function lT4(i,u,t=5){try{await F1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function xp0(i){let u=new Dvu({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{lT4("[NatsSSEBroadcast]",()=>u.start())})}var _vu=O(()=>{Z4();Ip0();vvi();vvi()});var kp0=()=>{};var Nvu=()=>{};var jp0=()=>{};var ET4,tL6;var Xp0=O(()=>{kp0();Nvu();m_();jp0();ET4={br:".br",zstd:".zst",gzip:".gz"},tL6=Object.keys(ET4)});var Jp0=O(()=>{Xp0()});var Kp0=()=>{};var Yp0=O(()=>{Kp0()});var Wp0=()=>{};var Lp0=O(()=>{xri()});var Ovu=O(()=>{e_();Lp0()});var Zvu="x-hono-disable-ssg",TL6;var Bvu=O(()=>{Ovu();TL6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Zvu]:"true"}})}catch{return null}})()});var Sp0=O(()=>{PEi()});var Fvu=O(()=>{Sp0()});var Qp0=O(()=>{Yp0();Wp0();Nvu();Bvu();Fvu();Ovu()});var Hp0=O(()=>{Bvu();Fvu();Qp0()});var fS6;var zp0=O(()=>{Hp0();({write:fS6}=Bun)});var $T4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},np0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var Rp0=()=>{};var xp=(i)=>("server"in i.env)?i.env.server:i.env;var ZGi=()=>{};var hT4;var bp0=O(()=>{Rp0();ZGi();hT4=np0((i,u)=>{let t=xp(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var gvu=(i)=>{let u=xp(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var Cp0=O(()=>{ZGi()});var Mp0=O(()=>{Jp0();zp0();bp0();Cp0();ZGi()});var qp0;var Vp0=O(()=>{qp0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function rp0(){let i=Object.keys(tf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:qp0[l].icon})),f=vu().localMode;return{emailAndPassword:{enabled:tf.emailAndPassword?.enabled??!1},magicLink:{enabled:tf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:tf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:NGi},socialProviders:{enabled:u,providers:t},sso:tf.ssoConfig?{enabled:!0,providerId:tf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:r5()}}async function vT4(i,u,t){try{if(!tf.inviteEmailProviderId||!tf.emailProviders||tf.emailProviders.length===0)return;let f=E2(tf.emailProviders,tf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=rm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=l2(f),$=`${wl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:c2({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:HB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var Z7,mp0;var Uvu=O(()=>{cf();Mp0();z4();R0();F$();b6();cvu();jfu();dGi();kV();A5();Ml();zpi();Vp0();dO();fQ();Z7=new Wu;Z7.post("/local-session",async(i)=>{if(!r5())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=gvu(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (dO(),KTi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),yp0)),E=await ls();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await JTi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});Z7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await dt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=e0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(T5(c))return i.json({role:c,capabilities:e00()});if(c==="user")return i.json({role:c,capabilities:Hri({self:[...WEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:Hri($)})});Z7.get("/domain-lookup",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(e0().db).getAllByDomain(t)).filter(vGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await e0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});Z7.post("/domain-join",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=e0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await dt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!IN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});Z7.post("/domain-setup",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=e0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let U=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((T)=>T.organizationId)).executeTakeFirst();if(U)return i.json({success:!0,slug:U.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=T===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await dt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let U=vu().firecrawlApiKey;if(U){let T=await Phi(t,U,d);if(T){let A=new qm(e0().db),G=await A.create(N,T);if(await A.setDefault(G.id,N),Z=!0,T.name&&T.name!==d)B=T.name;F=T.favicon??T.logo??null}}}catch(U){console.error("[Auth] Brand extraction failed (non-fatal):",U)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await dt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(U){console.error("[Auth] Org update failed (non-fatal):",U)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});Z7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await dt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=e0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await dt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!Pv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new qH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});Z7.post("/domain-request-join",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=e0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new qH(E).create(c.id,u.user.id),await vT4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});Z7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await dt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await DGi({db:e0().db,authApi:dt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});mp0=Z7});async function BGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as dT4}from"crypto";function DT4(i,u){let t=dT4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var ep0,ap0;var op0=O(()=>{cf();F$();ep0=new Wu;ep0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await BGi(f,dt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await dt.$context,c=await E.internalAdapter.createSession(l,!1),w=DT4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});ap0=ep0});function iit(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function _T4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!OGi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function sp0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function pp0(i){let u=await dt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function NT4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!vu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return vvu(t.id),u()}function uit(){let i=new Wu;return i.use("*",_T4),i.use("*",NT4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await dt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([dt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),dt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await pp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await dt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;sp0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=e0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!eH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await e0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await dt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(IN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await pp0(u),h=$??w;return sp0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var Tvu="/api/_admin";var tit=O(()=>{cf();F$();A5();b6();z4();R0()});import*as gGi from"jose";function OT4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await yvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await yvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await Avu(E.issuer,E.discoveryEndpoint),w=ZT4(),$=await BT4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});BV(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=tQ(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");BV(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await Avu($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=gGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await gGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await yvu(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!FT4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await Avu(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function FGi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=vu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function Avu(i,u){let t=u||i,f=fit.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;FGi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return FGi(c.authorization_endpoint),FGi(c.token_endpoint),FGi(c.jwks_uri),fit.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function ZT4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function BT4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function yvu(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function FT4(i){return T5(i.organization?.role)}function Pvu(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var UGi=()=>{let i=new Wu;return OT4(i),i},fit;var Gvu=O(()=>{cf();KEi();R0();A5();fit=new Map});function TT4(i){if(i==="claude-code")return gT4;if(i==="codex")return UT4;return null}function lit(i,u){return TT4(i)?.[u]??null}var gT4,UT4;var Eit=O(()=>{gT4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 5 1M"}},UT4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});function cit(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function AT4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function wit(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(cit(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(cit(c))return c.toolCallId===t;if(AT4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function yT4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function PT4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function $it(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Uo({messages:t}),l=yT4(f),E=await Gg(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=PT4(E),$=wit(w),v=s4u({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,U=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...U?{providerOptions:{google:U}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var hit=O(()=>{Of()});function vit(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var dit=()=>{};function TGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}function Ivu(i){return/[.*>\s]/.test(i)}async function AGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=TGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(Ivu(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function kp(i){let u=await AGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var Dit=O(()=>{bh()});import{z as ul}from"zod";var GT4,IT4,_it;var Nit=O(()=>{U$();a9();GT4=ul.looseObject({id:ul.string().optional(),role:ul.enum(["user","assistant","system"]),parts:ul.array(ul.record(ul.string(),ul.unknown())),metadata:ul.unknown().optional()}),IT4=ul.object({windowSize:ul.number().int().min(1).max(500).default(y5),thread_id:ul.string()}),_it=ul.object({messages:ul.array(GT4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:IT4.optional(),tier:Lg0.optional(),agent:ul.object({id:ul.string()}).loose(),stream:ul.boolean().optional(),temperature:ul.number().default(0.5),thread_id:ul.string().optional(),branch:ul.string().nullish(),toolApprovalLevel:ul.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:ul.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:ul.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:ul.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function yGi(i){Oit.set(i.id,i)}function Zit(i){return Oit.get(i)}var Oit;var xvu=O(()=>{Oit=new Map});function kvu(i,u,t){let f=Zit(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var jvu=O(()=>{xvu()});class Xvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return kvu(this.harnessId,i,this.ctx)}}var Bit=O(()=>{jvu()});function PGi(i,u){return RN(i,u)}var Jvu=O(()=>{M5()});import{z as Ri}from"zod";import{existsSync as HT4}from"fs";import{query as yit}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bQ6,tool as CQ6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as MQ6,InMemorySessionStore as qQ6,HOOK_EVENTS as VQ6,AbortError as rQ6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as eQ6,forkSession as aQ6,getSessionInfo as oQ6,getSessionMessages as sQ6,deleteSession as pQ6,renameSession as iH6,tagSession as uH6,listSubagents as tH6,getSubagentMessages as fH6,foldSessionSummary as lH6,importSessionToStore as EH6}from"@anthropic-ai/claude-agent-sdk";import{startup as wH6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as hH6,tool as vH6}from"@anthropic-ai/claude-agent-sdk";import"zod";function kT4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>Fit)return`${u.slice(0,Fit)}...[truncated]`;return u}function jT4(i){return i.replace(/\s+/g,"")}function XT4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function RR(i,u){let t=i.trim(),f=jT4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function Svu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function JT4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=Svu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return RR(f,t)}function KT4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:xT4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=RR(E,c);return w?{content:w}:{warning:e8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=RR(E,c);return w?{content:w}:{warning:e8}}if(u){let E=RR(u,t);if(E)return{content:E}}return{warning:e8}}function YT4(i){if(!i||typeof i!=="object")return{warning:e8};let u=i.image,t=Svu(i.mimeType);if(typeof u==="string")return KT4(u,t);if(u&&typeof u==="object"){let f=JT4(u,t);return f?{content:f}:{warning:e8}}return{warning:e8}}function WT4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function LT4(i){let u=Svu(i.mediaType??i.mimeType);if(!u||!XT4(u))return{};let t=i.data;if(typeof t==="string"){let f=RR(u,t);return f?{content:f}:{warning:e8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=WT4(t);if(!f)return{warning:e8};let l=RR(u,f);return l?{content:l}:{warning:e8}}return{warning:e8}}function git(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
+  `.execute(i)).rows[0]?.exists??!1}async function Op0(i,u,t){try{await i.addMember({body:{userId:u,role:"user",organizationId:t}})}catch(f){if(!IN(f))throw f}}async function Zp0(i,u){for(let t=0;t<dp0;t++){let f=t===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return KU4(await i.createOrganization({body:{name:u.name,slug:`${u.baseSlug}${f}`,userId:u.userId}}))}catch(l){if(!YU4(l)||t===dp0-1)throw l}}throw Error("Failed to create organization")}var dp0=5,GU4,IU4;var cvu=O(()=>{dGi();GU4=["labs","agent","studio","workspace","systems","core","cloud","works"],IU4=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});var yp0={};yi(yp0,{resetPasswordEnabled:()=>NGi,grantDeploymentAdmin:()=>vvu,getTrustedOrigins:()=>OGi,authConfig:()=>tf,auth:()=>dt,GENERIC_EMAIL_DOMAINS:()=>Pv});import{randomBytes as WU4}from"crypto";import{sso as LU4}from"@better-auth/sso";import{organization as SU4}from"@decocms/better-auth/plugins";import{betterAuth as QU4}from"better-auth";import{admin as HU4,apiKey as zU4,jwt as nU4,magicLink as RU4,mcp as bU4,openAPI as CU4}from"better-auth/plugins";import{emailOTP as MU4}from"better-auth/plugins/email-otp";import{APIError as gp0}from"better-auth/api";import{adminAc as qU4,defaultRoles as VU4}from"better-auth/plugins/admin/access";import{defaultStatements as rU4}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as mU4}from"@decocms/better-auth/plugins/access";function Bp0(i){if(!yhi(i))return;throw new gp0("BAD_REQUEST",{message:`Organization slug "${String(i).trim()}" is reserved by Studio`})}function vvu(i){if(!wvu.includes(i))wvu.push(i)}function OGi(){let i=[Ip];try{let u=new URL(Ip);if(u.hostname==="localhost")i.push(Ip.replace("localhost","127.0.0.1"));else if(u.hostname==="127.0.0.1")i.push(Ip.replace("127.0.0.1","localhost"))}catch{}return i}var Up0,eU4,_Gi,hvu,aU4,oU4,sU4,Fp0,wvu,tf,Tp0=void 0,$vu=void 0,NGi=!1,pU4,iT4,uT4,Ip,Ap0,tT4=262144,fT4,dt;var F$=O(()=>{R0();fQ();Rri();z4();Ml();b6();h40();kV();d40();fp0();Ep0();cp0();A5();hiu();$p0();dGi();cvu();Zfu();Up0=Object.values(KB()).map((i)=>i.map((u)=>u.name)).flat(),eU4={...rU4,self:["*",...Up0]},_Gi=mU4(eU4),hvu=$iu(Up0),aU4=_Gi.newRole(hvu.user),oU4=_Gi.newRole(hvu.admin),sU4=_Gi.newRole(hvu.owner),Fp0=Object.values(KB()).map((i)=>i.map((u)=>`self:${u.name}`)).flat(),wvu=[];tf=YB().auth;if(tf.inviteEmailProviderId&&tf.emailProviders&&tf.emailProviders.length>0){let i=E2(tf.emailProviders,tf.inviteEmailProviderId);if(i){let u=l2(i);Tp0=async(t)=>{let f=t.inviter.user?.name||t.inviter.user?.email,l=`${wl()}/auth/accept-invitation?invitationId=${t.invitation.id}&redirectTo=/${t.organization.slug}`;await u({to:t.email,subject:`You've been invited to join ${t.organization.name}`,html:c2({preheader:`${f} has invited you to join ${t.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${f}</strong> has invited you to join <strong>${t.organization.name}</strong> on deco Studio.`,body:HB("Accept invitation",l),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(tf.resetPasswordEmailProviderId&&tf.emailProviders&&tf.emailProviders.length>0){let i=E2(tf.emailProviders,tf.resetPasswordEmailProviderId);if(i){let u=l2(i);NGi=!0,$vu=async({user:t,url:f})=>{await u({to:t.email,subject:"Reset your password",html:c2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:HB("Reset password",f)+ici("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}pU4=[SU4({organizationCreation:{afterCreate:async(i)=>{await tp0(i.organization.id,i.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:i})=>{Bp0(i.slug)},afterAddMember:async({member:i})=>{try{await ivu(i.organizationId,i.userId,"system:join")}catch(u){console.error("Failed to reset seat on member join:",u)}},afterRemoveMember:async({member:i})=>{try{await ivu(i.organizationId,i.userId,"system:member-removed")}catch(u){console.error("Failed to release seat on member removal:",u)}},beforeUpdateOrganization:async({organization:i,member:u})=>{Bp0(i.slug);let t=i.logo;if(typeof t!=="string"||!t.startsWith("data:"))return;let f=await lp0(u.organizationId,t);if(f===t)return;return{data:{...i,logo:f}}}},ac:_Gi,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:rm,resourceNameValidation:(i)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test(i)}}},roles:{user:aU4,admin:oU4,owner:sU4},sendInvitationEmail:Tp0}),bU4({loginPage:"/login",oidcConfig:{scopes:Fp0,metadata:{scopes_supported:Fp0},loginPage:"/login"}}),zU4({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:(i)=>{if(i.headers?.get("X-MCP-Session-Auth")==="true")return null;let t=i.headers?.get("Authorization");if(t?.startsWith("Bearer "))return t.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),HU4({defaultRole:"user",adminRoles:["admin","owner"],roles:{...VU4,owner:qU4},adminUserIds:wvu}),CU4(),nU4({jwt:{expirationTime:"5m",definePayload:({user:i})=>({id:i.id,email:i.email,name:i.name,role:i.role})}}),LU4(tf.ssoConfig?wp0(tf.ssoConfig):void 0),...tf.magicLinkConfig?.enabled&&tf.emailProviders&&tf.emailProviders.length>0?[RU4(v40(tf.magicLinkConfig,tf.emailProviders))]:[],...tf.emailOtpConfig?.enabled&&tf.emailProviders&&tf.emailProviders.length>0?[MU4($40(tf.emailOtpConfig,tf.emailProviders))]:[]],iT4=Z_(),uT4=nM(iT4),Ip=wl();Ap0=vu(),fT4=Ap0.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),WU4(32).toString("base64")})(),dt=QU4({secret:fT4,logger:{log:(i,u,...t)=>{if(i==="error"&&u.includes("validate API key"))return;if(i==="error"&&t.some((l)=>{let E=l?.statusCode;return typeof E==="number"&&E>=300&&E<400}))return;let f=`${new Date().toISOString()} ${i.toUpperCase()} [Better Auth]: ${u}`;if(i==="error")console.error(f,...t);else if(i==="warn")console.warn(f,...t);else console.log(f,...t)}},baseURL:Ip,trustedOrigins:OGi(),database:uT4,socialProviders:tf.socialProviders,...tf.ssoConfig&&{account:{accountLinking:{trustedProviders:[tf.ssoConfig.providerId]}}},emailAndPassword:{enabled:tf.emailAndPassword.enabled,...$vu&&{sendResetPassword:$vu}},rateLimit:{enabled:!Ap0.disableRateLimit,window:60,max:1e4},plugins:pU4,databaseHooks:{user:{create:{after:async(i,u)=>{uvu({id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified});let t=u?.getCookie("studio_signup_ref")??null,f=u?.getCookie("studio_signup_src")??null;mu.capture({distinctId:i.id,event:"user_signed_up",properties:{email:i.email,email_domain:i.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!i.emailVerified,has_name:!!i.name,...t?{signup_ref:t}:{},...f?{signup_src:f}:{}}});let l=YB().autoCreateOrganizationOnSignup!==!1;try{let E=await DGi({db:e0().db,authApi:dt.api,user:{id:i.id,email:i.email,name:i.name??null,emailVerified:!!i.emailVerified},allowCreate:l,createdVia:"signup"});if(E.status==="created")mu.groupIdentify({groupType:"organization",groupKey:E.organization.id,properties:{name:E.organization.name,slug:E.organization.slug,created_at:new Date().toISOString(),created_via:E.createdVia,email_domain:E.domain}}),mu.capture({distinctId:i.id,event:"organization_created",groups:{organization:E.organization.id},properties:{organization_id:E.organization.id,organization_slug:E.organization.slug,name:E.organization.name,created_via:E.createdVia,email_domain:E.domain}});if(E.status==="joined")mu.capture({distinctId:i.id,event:"organization_domain_joined",groups:{organization:E.organization.id},properties:{organization_id:E.organization.id,organization_slug:E.organization.slug,email_domain:E.domain,joined_via:E.createdVia}})}catch(E){mu.captureException(E,i.id),console.error("Failed to ensure organization on signup:",E)}}},update:{before:async(i)=>{let u=i.image;if(typeof u==="string"&&u.startsWith("data:")&&u.length>tT4)throw new gp0("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async(i)=>{let u=await e0().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",i.userId).executeTakeFirst();if(!u)return;uvu({id:u.id,email:u.email,name:u.name??null,emailVerified:!!u.emailVerified})}}}}})});function dvu(i,u){return`${i}:${u}`}function Pp0(i){let u=i?.ttlMs??120000,t=i?.maxSize??1e4,f=new Map;function l(){if(f.size<=t)return;let E=Date.now();for(let[c,w]of f)if(w.expiresAt<=E)f.delete(c);if(f.size>t){let c=f.size-t,w=0;for(let $ of f.keys()){if(w>=c)break;f.delete($),w++}}}return{get(E,c){let w=dvu(E,c),$=f.get(w);if(!$)return;if($.expiresAt<=Date.now()){f.delete(w);return}return $.role},set(E,c,w){let $=dvu(E,c);f.set($,{role:w,expiresAt:Date.now()+u}),l()},invalidate(E,c){f.delete(dvu(E,c))}}}class Dvu{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor(i){this.options=i}async start(i){if(i)this.localEmit=i;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let u=this.options.getConnection();if(!u)return;let t=new TextDecoder;this.subscriptions=Gp0.map((f)=>u.subscribe(f));for(let f of this.subscriptions)(async()=>{for await(let l of f)try{let E=JSON.parse(t.decode(l.data));if(typeof E?.originId!=="string"||typeof E?.organizationId!=="string"||typeof E?.event?.id!=="string"||typeof E?.event?.type!=="string")continue;if(E.originId===this.originId)continue;if(typeof E.messageId==="string"&&this.hasSeen(E.messageId))continue;this.localEmit?.(E.organizationId,E.event)}catch{}})().catch((l)=>{console.error("[NatsSSEBroadcast] Subscription error:",l)})}broadcast(i,u){this.localEmit?.(i,u);let t={originId:this.originId,messageId:crypto.randomUUID(),organizationId:i,event:u};try{let f=this.options.getConnection();if(!f)return;let l=this.encoder.encode(JSON.stringify(t));for(let E of Gp0)f.publish(E,l)}catch(f){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",f)}}async stop(){for(let i of this.subscriptions)i.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen(i){if(this.seenMessageIds.has(i))return!0;if(this.seenMessageIds.add(i),this.seenMessageIds.size>1000){let u=this.seenMessageIds.values().next().value;if(u)this.seenMessageIds.delete(u)}return!1}}var Gp0;var Ip0=O(()=>{Gp0=["studio.sse.broadcast","mesh.sse.broadcast"]});async function lT4(i,u,t=5){try{await F1(u,{maxAttempts:t,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(f){console.error(`${i} Deferred start failed:`,f instanceof H6?f.cause:f)}}function xp0(i){let u=new Dvu({getConnection:()=>i.getConnection()});gl.start(u).catch((t)=>{console.error("[SSEHub] Failed to start broadcast strategy:",t)}),i.onReady(()=>{lT4("[NatsSSEBroadcast]",()=>u.start())})}var _vu=O(()=>{Z4();Ip0();vvi();vvi()});var kp0=()=>{};var Nvu=()=>{};var jp0=()=>{};var ET4,tL6;var Xp0=O(()=>{kp0();Nvu();m_();jp0();ET4={br:".br",zstd:".zst",gzip:".gz"},tL6=Object.keys(ET4)});var Jp0=O(()=>{Xp0()});var Kp0=()=>{};var Yp0=O(()=>{Kp0()});var Wp0=()=>{};var Lp0=O(()=>{xri()});var Ovu=O(()=>{e_();Lp0()});var Zvu="x-hono-disable-ssg",TL6;var Bvu=O(()=>{Ovu();TL6=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Zvu]:"true"}})}catch{return null}})()});var Sp0=O(()=>{PEi()});var Fvu=O(()=>{Sp0()});var Qp0=O(()=>{Yp0();Wp0();Nvu();Bvu();Fvu();Ovu()});var Hp0=O(()=>{Bvu();Fvu();Qp0()});var fS6;var zp0=O(()=>{Hp0();({write:fS6}=Bun)});var $T4=class{#i;constructor(i){this.#i=i,this.raw=i.raw,this.url=i.url?new URL(i.url):null,this.protocol=i.protocol??null}send(i,u){this.#i.send(i,u??{})}raw;binaryType="arraybuffer";get readyState(){return this.#i.readyState}url;protocol;close(i,u){this.#i.close(i,u)}},np0=(i)=>{return(...u)=>{if(typeof u[0]==="function"){let[t,f]=u;return async function(E,c){let w=await t(E),$=await i(E,w,f);if($)return $;await c()}}else{let[t,f,l]=u;return(async()=>{let E=await i(t,f,l);if(!E)throw Error("Failed to upgrade WebSocket");return E})()}}};var Rp0=()=>{};var xp=(i)=>("server"in i.env)?i.env.server:i.env;var ZGi=()=>{};var hT4;var bp0=O(()=>{Rp0();ZGi();hT4=np0((i,u)=>{let t=xp(i);if(!t)throw TypeError("env has to include the 2nd argument of fetch.");if(t.upgrade(i.req.raw,{data:{events:u,url:new URL(i.req.url),protocol:i.req.url}}))return new Response(null);return})});var gvu=(i)=>{let u=xp(i);if(!u)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof u.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let t=u.requestIP(i.req.raw);if(!t)return{remote:{}};return{remote:{address:t.address,addressType:t.family==="IPv6"||t.family==="IPv4"?t.family:void 0,port:t.port}}};var Cp0=O(()=>{ZGi()});var Mp0=O(()=>{Jp0();zp0();bp0();Cp0();ZGi()});var qp0;var Vp0=O(()=>{qp0={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function rp0(){let i=Object.keys(tf.socialProviders??{}),u=i.length>0,t=i.map((l)=>({name:l,icon:qp0[l].icon})),f=vu().localMode;return{emailAndPassword:{enabled:tf.emailAndPassword?.enabled??!1},magicLink:{enabled:tf.magicLinkConfig?.enabled??!1},emailOtp:{enabled:tf.emailOtpConfig?.enabled??!1},resetPassword:{enabled:NGi},socialProviders:{enabled:u,providers:t},sso:tf.ssoConfig?{enabled:!0,providerId:tf.ssoConfig.providerId}:{enabled:!1},stdioEnabled:f,localMode:r5()}}async function vT4(i,u,t){try{if(!tf.inviteEmailProviderId||!tf.emailProviders||tf.emailProviders.length===0)return;let f=E2(tf.emailProviders,tf.inviteEmailProviderId);if(!f)return;let l=await i.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",u.id).execute(),E=rm,c=l.filter((h)=>(h.role??"").split(",").map((v)=>v.trim()).some((v)=>E.includes(v)));if(c.length===0)return;let w=l2(f),$=`${wl()}/${u.slug}/settings/members`;await Promise.allSettled(c.map((h)=>w({to:h.email,subject:`New request to join ${u.name}`,html:c2({preheader:`${t} requested to join ${u.name}.`,heading:"New join request",subheading:`<strong>${t}</strong> requested to join <strong>${u.name}</strong> on deco Studio.`,body:HB("Review request",$),footnote:"You can approve or deny this request from your members settings."})})))}catch(f){console.error("[Auth] Failed to notify admins of join request:",f)}}var Z7,mp0;var Uvu=O(()=>{cf();Mp0();z4();R0();F$();b6();cvu();jfu();dGi();kV();A5();Ml();zpi();Vp0();dO();fQ();Z7=new Wu;Z7.post("/local-session",async(i)=>{if(!r5())return i.json({success:!1,error:"Local mode is not active"},403);let u;try{u=gvu(i).remote.address}catch{}if(!(u==="127.0.0.1"||u==="::1"||u==="::ffff:127.0.0.1"))return i.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:f}=await Promise.resolve().then(() => (dO(),KTi));await f();let{auth:l}=await Promise.resolve().then(() => (F$(),yp0)),E=await ls();if(!E)return i.json({success:!1,error:"Local admin user not found"},500);let c=await JTi();return await l.api.signInEmail({body:{email:E.email,password:c},asResponse:!0})}catch(f){return console.error("Failed to create local session:",f),i.json({success:!1,error:f instanceof Error?f.message:"Failed to create local session"},500)}});Z7.get("/my-capabilities/:slug",async(i)=>{let u=i.req.param("slug"),t=await dt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({error:"Authentication required"},401);let f=e0().db,l=await f.selectFrom("organization").select(["id"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({role:null,capabilities:{}});let c=(await f.selectFrom("member").select(["role"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())?.role??null;if(!c)return i.json({role:null,capabilities:{}});if(T5(c))return i.json({role:c,capabilities:e00()});if(c==="user")return i.json({role:c,capabilities:Hri({self:[...WEi]})});let w=await f.selectFrom("organizationRole").select(["permission"]).where("role","=",c).where("organizationId","=",l.id).executeTakeFirst(),$={},h=w?.permission;if(typeof h==="string")try{let v=JSON.parse(h);if(v&&typeof v==="object"&&!Array.isArray(v))$=v}catch{$={}}return i.json({role:c,capabilities:Hri($)})});Z7.get("/domain-lookup",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({found:!1,organizations:[]});let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({found:!1,organizations:[]});try{let l=(await new w$(e0().db).getAllByDomain(t)).filter(vGi);if(l.length===0)return i.json({found:!1,organizations:[]});let E=await e0().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",l.map(($)=>$.organizationId)).execute(),c=new Map(E.map(($)=>[$.id,$])),w=l.map(($)=>{let h=c.get($.organizationId);if(!h)return null;if(d3(h))return null;return{id:h.id,name:h.name,slug:h.slug,logo:h.logo,joinMode:$.joinMode}}).filter(($)=>$!==null);return i.json({found:w.length>0,organizations:w})}catch(f){return console.error("[Auth] Domain lookup failed:",f),i.json({success:!1,error:"Domain lookup failed"},500)}});Z7.post("/domain-join",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to join"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Generic email domains cannot auto-join"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;try{let E=e0().db,$=(await new w$(E).getAllByDomain(t)).filter((_)=>_.verificationStatus==="verified"&&_.joinMode==="auto");if($.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let h=await E.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",$.map((_)=>_.organizationId)).execute(),v=new Map(h.filter((_)=>!d3(_)).map((_)=>[_.id,{id:_.id,slug:_.slug}])),d=$.flatMap((_)=>{let N=v.get(_.organizationId);return N?[N]:[]});if(d.length===0)return i.json({success:!1,error:"Auto-join is not available for this domain"},403);let D;if(l){let _=d.find((N)=>N.slug===l);if(!_)return i.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);D=_}else if(d.length===1)D=d[0];else return i.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await dt.api.addMember({body:{userId:u.user.id,role:"user",organizationId:D.id}})}catch(_){if(!IN(_))return console.error("[Auth] Domain join addMember failed:",_),i.json({success:!1,error:"Failed to join organization"},500)}return mu.capture({distinctId:u.user.id,event:"organization_domain_joined",groups:{organization:D.id},properties:{organization_id:D.id,organization_slug:D.slug,email_domain:t}}),i.json({success:!0,slug:D.slug})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain join failed:",E),i.json({success:!1,error:"Failed to join organization"},500)}});Z7.post("/domain-setup",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Corporate email required"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.name==="string"&&f.name.trim().length>0?f.name.trim():null,E=typeof f.logo==="string"&&f.logo.length>0?f.logo:null,c=f.claimDomain!==!1;try{let w=e0().db,$=new w$(w),h=await $.getAllByDomain(t);if(h.length>0){let U=await w.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",u.user.id).where("member.organizationId","in",h.map((T)=>T.organizationId)).executeTakeFirst();if(U)return i.json({success:!0,slug:U.slug,alreadyExists:!0})}let v=t.split(".")[0]??t,d=l??v.charAt(0).toUpperCase()+v.slice(1),D=(l??v).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||v.toLowerCase().replace(/[^a-z0-9-]/g,""),_=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,G=T===0?d:`${d}${A}`,k=`${D}${A}`;try{_=await dt.api.createOrganization({body:{name:G,slug:k,userId:u.user.id}});break}catch(I){if(!(I instanceof Error&&("body"in I)&&I.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw I}}if(!_?.id)throw Error("Failed to create organization");let N=_.id;if(c)await $.add(N,t,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let Z=!1,B=null,F=null;try{let U=vu().firecrawlApiKey;if(U){let T=await Phi(t,U,d);if(T){let A=new qm(e0().db),G=await A.create(N,T);if(await A.setDefault(G.id,N),Z=!0,T.name&&T.name!==d)B=T.name;F=T.favicon??T.logo??null}}}catch(U){console.error("[Auth] Brand extraction failed (non-fatal):",U)}let g={};if(!l&&B)g.name=B;if(E)g.logo=E;else if(F)g.logo=F;if(Object.keys(g).length>0)try{await dt.api.updateOrganization({headers:i.req.raw.headers,body:{organizationId:N,data:g}})}catch(U){console.error("[Auth] Org update failed (non-fatal):",U)}return mu.identify({distinctId:u.user.id,properties:{email:u.user.email,$set:{email:u.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),mu.groupIdentify({groupType:"organization",groupKey:N,properties:{name:_.slug??D,slug:_.slug??D,email_domain:t,brand_extracted:Z,created_at:new Date().toISOString()}}),mu.capture({distinctId:u.user.id,event:"organization_created",groups:{organization:N},properties:{organization_id:N,organization_slug:_.slug??D,email_domain:t,brand_extracted:Z}}),i.json({success:!0,slug:_.slug??D,brandExtracted:Z})}catch(w){return mu.captureException(w,u.user?.id),console.error("[Auth] Domain setup failed:",w),i.json({success:!1,error:"Failed to set up organization"},500)}});Z7.get("/org-access-status/:slug",async(i)=>{let u=i.req.param("slug"),t=await dt.api.getSession({headers:i.req.raw.headers});if(!t?.user)return i.json({success:!1,error:"Authentication required"},401);let f=e0().db,l=await f.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",u).executeTakeFirst();if(!l)return i.json({status:"not-found"});let E={id:l.id,name:l.name,slug:l.slug,logo:l.logo};if(await f.selectFrom("member").select(["id"]).where("userId","=",t.user.id).where("organizationId","=",l.id).executeTakeFirst())return i.json({status:"member",organization:E});try{let w=await dt.api.listUserInvitations({headers:i.req.raw.headers}),$=Date.now(),h=w.find((v)=>v.organizationId===l.id&&v.status==="pending"&&new Date(v.expiresAt).getTime()>$);if(h)return i.json({status:"pending-invite",invitation:{id:h.id},organization:E})}catch(w){console.error("[Auth] listUserInvitations failed:",w)}if(t.user.emailVerified){let w=t.user.email?.split("@")[1]?.toLowerCase();if(w&&!Pv.has(w)){let $=await new w$(f).getByOrgAndDomain(l.id,w);if($?.verificationStatus==="verified"){if($.joinMode==="auto")return i.json({status:"auto-domain-join",organization:{...E,domain:w}});if($.joinMode==="request"){let h=await new qH(f).getPending(l.id,t.user.id);return i.json({status:h?"request-pending":"can-request",organization:{...E,domain:w}})}}}}return i.json({status:"no-access",organization:E})});Z7.post("/domain-request-join",async(i)=>{let u=await dt.api.getSession({headers:i.req.raw.headers});if(!u?.user)return i.json({success:!1,error:"Authentication required"},401);if(!u.user.emailVerified)return i.json({success:!1,error:"Email must be verified to request access"},403);let t=u.user.email?.split("@")[1]?.toLowerCase();if(!t||Pv.has(t))return i.json({success:!1,error:"Generic email domains cannot request access"},403);let f=await i.req.json().catch(()=>({})),l=typeof f.organizationSlug==="string"&&f.organizationSlug.trim()?f.organizationSlug.trim():null;if(!l)return i.json({success:!1,error:"organizationSlug is required"},400);try{let E=e0().db,c=await E.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return i.json({success:!1,error:"Organization not found"},404);let w=await new w$(E).getByOrgAndDomain(c.id,t);if(!w||w.verificationStatus!=="verified"||w.joinMode!=="request")return i.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await E.selectFrom("member").select(["id"]).where("userId","=",u.user.id).where("organizationId","=",c.id).executeTakeFirst())return i.json({success:!0,slug:c.slug,alreadyMember:!0});return await new qH(E).create(c.id,u.user.id),await vT4(E,c,u.user.email),mu.capture({distinctId:u.user.id,event:"organization_join_requested",groups:{organization:c.id},properties:{organization_id:c.id,organization_slug:c.slug,email_domain:t}}),i.json({success:!0,status:"pending"})}catch(E){return mu.captureException(E,u.user.id),console.error("[Auth] Domain request-join failed:",E),i.json({success:!1,error:"Failed to request access"},500)}});Z7.post("/ensure-organization",async(i)=>{let u=null;try{if(u=await dt.api.getSession({headers:i.req.raw.headers}),!u?.user)return i.json({success:!1,error:"Authentication required"},401);let t=await DGi({db:e0().db,authApi:dt.api,user:{id:u.user.id,email:u.user.email,name:u.user.name??null,emailVerified:!!u.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(t.status==="ambiguous")return i.json({success:!1,status:t.status,domain:t.domain,organizations:t.organizations});if(t.status==="skipped")return i.json({success:!1,status:t.status,reason:t.reason,domain:t.domain,error:"Organization creation is not available."},409);if(t.status==="already_has_organization")return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain});return i.json({success:!0,status:t.status,organization:t.organization,domain:t.domain})}catch(t){let f=u?.user?.id;if(f)mu.captureException(t,f);return console.error("[Auth] ensure organization failed:",t),i.json({success:!1,error:"Failed to ensure organization"},500)}});mp0=Z7});async function BGi(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}import{createHmac as dT4}from"crypto";function DT4(i,u){let t=dT4("sha256",u).update(i).digest("base64");return encodeURIComponent(`${i}.${t}`)}var ep0,ap0;var op0=O(()=>{cf();F$();ep0=new Wu;ep0.post("/session-from-oauth",async(i)=>{let u=i.req.header("authorization")??"",f=/^Bearer\s+(.+)$/i.exec(u)?.[1]?.trim();if(!f)return i.json({error:"unauthorized"},401);let l=await BGi(f,dt.api);if(!l)return i.json({error:"unauthorized"},401);try{let E=await dt.$context,c=await E.internalAdapter.createSession(l,!1),w=DT4(c.token,E.secret);return i.json({sessionToken:w})}catch(E){return console.error("[desktop-session-bridge] failed to mint a session from an OAuth bearer:",E instanceof Error?E.message:String(E)),i.json({error:"failed to mint a session"},500)}});ap0=ep0});function iit(i,u){if(i.req.path==="/api/auth/admin/stop-impersonating")return u();return i.json({error:"Not Found",path:i.req.path},404)}async function _T4(i,u){let t=i.req.method;if(t!=="GET"&&t!=="HEAD"){let f=i.req.header("origin");if(f&&!OGi().includes(f))return i.json({error:"Forbidden"},403)}return u()}function sp0(i,u){console.log("deployment_admin_action",{action:i,...u})}async function pp0(i){let u=await dt.api.getSession({headers:i.req.raw.headers});return{actorId:i.get("studioContext").auth.user?.id,impersonatedBy:u?.session?.impersonatedBy}}async function NT4(i,u){let t=i.get("studioContext").auth.user;if(!t)return i.json({error:"Unauthorized"},401);let f=t.email?.toLowerCase();if(!f||!vu().deploymentAdminEmails.includes(f))return i.json({error:"Forbidden"},403);if(!t.emailVerified)return i.json({error:"email_not_verified"},401);return vvu(t.id),u()}function uit(){let i=new Wu;return i.use("*",_T4),i.use("*",NT4),i.get("/me",(u)=>{let t=u.get("studioContext").auth.user?.email;if(!t)return u.json({error:"Unauthorized"},401);return u.json({email:t})}),i.get("/users",async(u)=>{let t=u.req.query("searchValue")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),E=u.req.raw.headers,c=(d)=>({id:d.id,email:d.email,name:d.name??null,image:d.image??null,emailVerified:d.emailVerified,createdAt:d.createdAt});if(!t){let{users:d}=await dt.api.listUsers({query:{limit:String(l)},headers:E});return u.json({users:d.map(c)})}let[w,$]=await Promise.all([dt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"email"},headers:E}),dt.api.listUsers({query:{limit:String(l),searchValue:t,searchField:"name"},headers:E})]),v=[...new Map([...w.users,...$.users].map((d)=>[d.id,d])).values()].slice(0,l).map(c);return u.json({users:v})}),i.post("/impersonate",async(u)=>{let t=await u.req.json().catch(()=>({})),f=typeof t.userId==="string"?t.userId:"";if(!f)return u.json({error:"userId is required"},400);if(f===u.get("studioContext").auth.user?.id)return u.json({error:"Cannot impersonate yourself"},400);let{impersonatedBy:l}=await pp0(u);if(l)return u.json({error:"Already impersonating \u2014 stop impersonating first"},409);let E=await dt.api.impersonateUser({body:{userId:f},headers:u.req.raw.headers,asResponse:!0});if(E.ok){let c=u.get("studioContext").auth.user?.id;sp0("impersonate",{actor_user_id:c,target_user_id:f}),mu.capture({distinctId:c??f,event:"deployment_admin_impersonated",properties:{actor_user_id:c,target_user_id:f}})}return E}),i.get("/orgs",async(u)=>{let t=u.req.query("search")?.trim(),f=Number(u.req.query("limit")),l=Math.min(f>0?f:100,100),c=e0().db.selectFrom("organization").leftJoin("member","member.organizationId","organization.id").select(["organization.id as id","organization.name as name","organization.slug as slug","organization.createdAt as createdAt"]).select(($)=>$.fn.count("member.id").as("memberCount"));if(t)c=c.where(($)=>$.or([$("organization.name","ilike",`%${t}%`),$("organization.slug","ilike",`%${t}%`)]));let w=await c.groupBy(["organization.id","organization.name","organization.slug","organization.createdAt"]).orderBy("organization.createdAt","desc").limit(l).execute();return u.json({organizations:w.map(($)=>({...$,memberCount:Number($.memberCount||0)}))})}),i.post("/orgs/:orgId/members",async(u)=>{let t=u.req.param("orgId"),f=await u.req.json().catch(()=>({})),l=typeof f.email==="string"?f.email.trim().toLowerCase():"",E=typeof f.role==="string"?f.role:"";if(!l||!eH.includes(E))return u.json({error:"Valid email and role are required"},400);let c=await e0().db.selectFrom("user").select(["id"]).where("email","=",l).executeTakeFirst();if(!c)return u.json({error:"No user with that email \u2014 they must sign up first"},404);try{await dt.api.addMember({body:{userId:c.id,organizationId:t,role:E}})}catch(v){if(IN(v))return u.json({error:"User is already a member of this org"},409);throw v}let{actorId:w,impersonatedBy:$}=await pp0(u),h=$??w;return sp0("member_add",{actor_user_id:h,...$?{impersonated_user_id:w}:{},organization_id:t,added_user_id:c.id,role:E}),mu.capture({distinctId:h??c.id,event:"deployment_admin_member_added",groups:{organization:t},properties:{actor_user_id:h,organization_id:t,added_user_id:c.id,role:E}}),u.json({ok:!0})}),i}var Tvu="/api/_admin";var tit=O(()=>{cf();F$();A5();b6();z4();R0()});import*as gGi from"jose";function OT4(i){i.get("/status",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await yvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E||!E.enforced)return u.json({ssoRequired:!1});let c=await t.storage.orgSsoSessions.isValid(t.auth.user.id,f);return u.json({ssoRequired:!0,authenticated:c,issuer:E.issuer,domain:E.domain})}),i.get("/authorize",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!await yvu(t,t.auth.user.id,f))return u.json({error:"Not a member of this organization"},403);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E)return u.json({error:"SSO not configured for this organization"},404);let c=await Avu(E.issuer,E.discoveryEndpoint),w=ZT4(),$=await BT4(w),h=crypto.randomUUID(),v=JSON.stringify({state:h,codeVerifier:w,orgId:f,userId:t.auth.user.id});BV(u,"org_sso_state",v,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let d=new URLSearchParams({response_type:"code",client_id:E.clientId,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,scope:E.scopes.join(" "),state:h,code_challenge:$,code_challenge_method:"S256"}),D=`${c.authorization_endpoint}?${d.toString()}`;return u.redirect(D)}),i.get("/callback",async(u)=>{let t=u.get("studioContext"),f=u.req.query("code"),l=u.req.query("state"),E=u.req.query("error");if(E)return u.redirect(`/?sso_error=${encodeURIComponent(E)}`);if(!f||!l)return u.redirect("/?sso_error=missing_code_or_state");let c=tQ(u,"org_sso_state");if(!c)return u.redirect("/?sso_error=state_expired");BV(u,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let w;try{w=JSON.parse(c)}catch{return u.redirect("/?sso_error=invalid_state")}if(w.state!==l)return u.redirect("/?sso_error=state_mismatch");if(!t.auth.user||t.auth.user.id!==w.userId)return u.redirect("/?sso_error=session_expired");let $=await t.storage.orgSsoConfig.getByOrgId(w.orgId);if(!$)return u.redirect("/?sso_error=sso_not_configured");let h=await Avu($.issuer,$.discoveryEndpoint),v=await fetch(h.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:`${t.baseUrl}/api/org-sso/callback`,client_id:$.clientId,client_secret:$.clientSecret,code_verifier:w.codeVerifier})});if(!v.ok)return console.error("[org-sso] Token exchange failed:",await v.text()),u.redirect("/?sso_error=token_exchange_failed");let d=await v.json();if(!d.id_token)return u.redirect("/?sso_error=no_id_token");try{let N=gGi.createRemoteJWKSet(new URL(h.jwks_uri)),{payload:Z}=await gGi.jwtVerify(d.id_token,N,{issuer:$.issuer,audience:$.clientId}),B=Z.email?.toLowerCase(),F=t.auth.user.email?.toLowerCase();if(!B||B!==F)return console.error(`[org-sso] Email mismatch: token=${B}, user=${F}`),u.redirect("/?sso_error=email_mismatch")}catch(N){return console.error("[org-sso] ID token verification failed:",N),u.redirect("/?sso_error=token_verification_failed")}let D=await yvu(t,t.auth.user.id,w.orgId);if(!D)return u.redirect("/?sso_error=not_a_member");await t.storage.orgSsoSessions.upsert(t.auth.user.id,w.orgId);let _=D.orgSlug?`/${D.orgSlug}`:"/";return u.redirect(_)}),i.get("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!FT4(t))return u.json({error:"Admin role required"},403);let l=await t.storage.orgSsoConfig.getByOrgId(f);if(!l)return u.json({configured:!1});return u.json({configured:!0,config:t.storage.orgSsoConfig.toPublic(l)})}),i.post("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!l.issuer||!l.clientId||!l.domain)return u.json({error:"issuer, clientId, and domain are required"},400);let E=await t.storage.orgSsoConfig.getByOrgId(f);if(!E&&!l.clientSecret)return u.json({error:"clientSecret is required for initial SSO setup"},400);let c=l.clientSecret||E?.clientSecret||"";try{await Avu(l.issuer,l.discoveryEndpoint)}catch($){return u.json({error:"Failed to reach OIDC discovery endpoint",details:$ instanceof Error?$.message:String($)},400)}let w=await t.storage.orgSsoConfig.upsert(f,{issuer:l.issuer,clientId:l.clientId,clientSecret:c,discoveryEndpoint:l.discoveryEndpoint,scopes:l.scopes,domain:l.domain,enforced:l.enforced});return u.json({success:!0,config:t.storage.orgSsoConfig.toPublic(w)})}),i.post("/config/enforce",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);let l=await u.req.json();if(!await t.storage.orgSsoConfig.getByOrgId(f))return u.json({error:"SSO must be configured before enforcing"},400);return await t.storage.orgSsoConfig.setEnforced(f,l.enforced),u.json({success:!0,enforced:l.enforced})}),i.delete("/config",async(u)=>{let t=u.get("studioContext");if(!t.auth.user)return u.json({error:"Authentication required"},401);let f=t.organization?.id;if(!f)return u.json({error:"Organization context required"},400);if(!Pvu(t))return u.json({error:"Owner role required"},403);return await t.storage.orgSsoConfig.delete(f),u.json({success:!0})})}function FGi(i){let u;try{u=new URL(i)}catch{throw Error(`Invalid URL: ${i}`)}let t=vu().localMode;if(u.protocol!=="https:"&&!(t&&u.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${i}`);let f=u.hostname,l=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],E=/^127\.|^\[::1\]$|^localhost$/i.test(f);if(t&&E)return;for(let c of l)if(c.test(f))throw Error(`OIDC URL must not point to a private network address: ${f}`)}async function Avu(i,u){let t=u||i,f=fit.get(t);if(f&&f.expiresAt>Date.now())return f.doc;let l=u||`${i.replace(/\/$/,"")}/.well-known/openid-configuration`;FGi(l);let E=await fetch(l);if(!E.ok)throw Error(`OIDC discovery failed: ${E.status} ${E.statusText}`);let c=await E.json();if(!c.authorization_endpoint||!c.token_endpoint||!c.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return FGi(c.authorization_endpoint),FGi(c.token_endpoint),FGi(c.jwks_uri),fit.set(t,{doc:c,expiresAt:Date.now()+3600000}),c}function ZT4(){let i=new Uint8Array(32);return crypto.getRandomValues(i),btoa(String.fromCharCode(...i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function BT4(i){let t=new TextEncoder().encode(i),f=await crypto.subtle.digest("SHA-256",t);return btoa(String.fromCharCode(...new Uint8Array(f))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function yvu(i,u,t){return await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",u).where("member.organizationId","=",t).executeTakeFirst()??null}function FT4(i){return T5(i.organization?.role)}function Pvu(i){let u=i.organization?.role;return!!u&&u.split(",").includes("owner")}var UGi=()=>{let i=new Wu;return OT4(i),i},fit;var Gvu=O(()=>{cf();KEi();R0();A5();fit=new Map});function TT4(i){if(i==="claude-code")return gT4;if(i==="codex")return UT4;return null}function lit(i,u){return TT4(i)?.[u]??null}var gT4,UT4;var Eit=O(()=>{gT4={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 5"},thinking:{modelId:"claude-code:opus-1m",label:"Opus 5 1M"}},UT4={fast:{modelId:"codex:gpt-5.6-luna",label:"GPT-5.6 Luna"},smart:{modelId:"codex:gpt-5.6-terra",label:"GPT-5.6 Terra"},thinking:{modelId:"codex:gpt-5.6-sol",label:"GPT-5.6 Sol"}}});function cit(i){return i.type==="tool-call"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function AT4(i){return i.type==="tool-result"&&i.toolName==="todo_write"&&typeof i.toolCallId==="string"}function wit(i){let u=null;for(let f=i.length-1;f>=0&&u===null;f--){let E=i[f].content;if(!Array.isArray(E))continue;for(let c=E.length-1;c>=0;c--){let w=E[c];if(cit(w)){u=w.toolCallId;break}}}if(u===null)return i;let t=u;return i.map((f)=>{let l=f.content;if(!Array.isArray(l))return f;let E=l.filter((c)=>{if(cit(c))return c.toolCallId===t;if(AT4(c))return c.toolCallId===t;return!0});if(E.length===l.length)return f;return{...f,content:E}})}function yT4(i){let u=!1,t=i.map((f)=>{if(f.role!=="assistant")return f;if(!f.parts.some((E)=>("state"in E)&&E.state==="approval-requested"))return f;return u=!0,{...f,parts:f.parts.map((E)=>{if(!("state"in E)||E.state!=="approval-requested"||!("approval"in E)||!E.approval)return E;return{...E,state:"output-denied",approval:{...E.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return u?t:i}function PT4(i){let[u,t]=i.reduce((f,l)=>{if(l.role==="system")f[0].push(l);else f[1].push(l);return f},[[],[]]);return{systemMessages:u,messages:t}}async function $it(i,u){let t=i.filter((d)=>d.role!=="assistant"||d.parts&&d.parts.length>0),f=await Uo({messages:t}),l=yT4(f),E=await Gg(l,{tools:u.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:c,messages:w}=PT4(E),$=wit(w),v=s4u({messages:$,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((d)=>{if(d.role!=="assistant")return d;let D=Array.isArray(d.content)?d.content.filter((_)=>_.type!=="reasoning"&&_.type!=="thinking"&&_.type!=="redacted-reasoning").map((_)=>{let N=_;if("providerOptions"in N||"providerMetadata"in N){let{providerOptions:Z,providerMetadata:B,...F}=N;if(N.type==="tool-call"){let g=B?.google,U=Z?.google;return{...F,...g?{providerMetadata:{google:g}}:{},...U?{providerOptions:{google:U}}:{}}}return F}return _}):d.content;return{...d,content:Array.isArray(D)&&D.length===0?[{type:"text",text:""}]:D,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:c,messages:v,originalMessages:f}}var hit=O(()=>{Of()});function vit(i){let u=i.filter((f)=>f.role==="system"),t=i.find((f)=>f.role!=="system");return{systemMessages:u,requestMessage:t}}var dit=()=>{};function TGi(i){let u=i.get("studioContext").organization;if(!u)throw Error("Organization context is required");if((u.slug??u.id)!==i.req.param("org"))throw Error("Organization mismatch");return u}function Ivu(i){return/[.*>\s]/.test(i)}async function AGi(i){let u=i.get("studioContext"),t=u.auth?.user?.id;if(!t)throw new G0(401,{message:"Unauthorized"});let f=TGi(i),l=i.req.param("threadId");if(!l)throw new G0(400,{message:"Missing thread ID"});if(Ivu(l))throw new G0(400,{message:"Invalid thread ID"});let E=await u.storage.threads.get(l);if(!E)throw new G0(404,{message:"Thread not found"});return{ctx:u,organization:f,thread:E,taskId:l,userId:t}}async function kp(i){let u=await AGi(i);if(u.thread.created_by!==u.userId)throw new G0(403,{message:"Not authorized"});return u}var Dit=O(()=>{bh()});import{z as ul}from"zod";var GT4,IT4,_it;var Nit=O(()=>{U$();a9();GT4=ul.looseObject({id:ul.string().optional(),role:ul.enum(["user","assistant","system"]),parts:ul.array(ul.record(ul.string(),ul.unknown())),metadata:ul.unknown().optional()}),IT4=ul.object({windowSize:ul.number().int().min(1).max(500).default(y5),thread_id:ul.string()}),_it=ul.object({messages:ul.array(GT4).min(1).refine((i)=>i.filter((u)=>u.role!=="system").length===1,{message:"Expected exactly one non-system message"}),memory:IT4.optional(),tier:Lg0.optional(),agent:ul.object({id:ul.string()}).loose(),stream:ul.boolean().optional(),temperature:ul.number().default(0.5),thread_id:ul.string().optional(),branch:ul.string().nullish(),toolApprovalLevel:ul.enum(["auto","readonly"]).default("auto"),sandboxProviderKind:ul.enum(["agent-sandbox","user-desktop","cluster"]).transform((i)=>i==="cluster"?"agent-sandbox":i).nullish().describe("Pinned on first message. Subsequent messages ignore this field (the thread row carries the pinned value)."),harnessId:ul.enum(["claude-code","codex","decopilot"]).nullish().describe("Pinned on first message. Subsequent messages ignore this field."),mode:ul.enum(["default","plan","web-search","deep-research","gen-image"]).default("default")}).strict()});function yGi(i){Oit.set(i.id,i)}function Zit(i){return Oit.get(i)}var Oit;var xvu=O(()=>{Oit=new Map});function kvu(i,u,t){let f=Zit(i);if(!f)throw Error(`No harness factory registered for id "${i}". Available ids must be registered in apps/api/src/harnesses/index.ts.`);return f.create(t).stream(u)}var jvu=O(()=>{xvu()});class Xvu{ctx;harnessId;constructor(i){this.ctx=i.ctx,this.harnessId=i.harnessId}dispatch(i){return kvu(this.harnessId,i,this.ctx)}}var Bit=O(()=>{jvu()});function PGi(i,u){return RN(i,u)}var Jvu=O(()=>{M5()});import{z as Ri}from"zod";import{existsSync as HT4}from"fs";import{query as yit}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as bQ6,tool as CQ6,SYSTEM_PROMPT_DYNAMIC_BOUNDARY as MQ6,InMemorySessionStore as qQ6,HOOK_EVENTS as VQ6,AbortError as rQ6}from"@anthropic-ai/claude-agent-sdk";import{listSessions as eQ6,forkSession as aQ6,getSessionInfo as oQ6,getSessionMessages as sQ6,deleteSession as pQ6,renameSession as iH6,tagSession as uH6,listSubagents as tH6,getSubagentMessages as fH6,foldSessionSummary as lH6,importSessionToStore as EH6}from"@anthropic-ai/claude-agent-sdk";import{startup as wH6}from"@anthropic-ai/claude-agent-sdk";import{createSdkMcpServer as hH6,tool as vH6}from"@anthropic-ai/claude-agent-sdk";import"zod";function kT4(i){let u;if(i===void 0)u="";else try{u=JSON.stringify(i)??String(i)}catch{u=String(i)}if(u.length>Fit)return`${u.slice(0,Fit)}...[truncated]`;return u}function jT4(i){return i.replace(/\s+/g,"")}function XT4(i){return typeof i==="string"&&i.trim().toLowerCase().startsWith("image/")}function RR(i,u){let t=i.trim(),f=jT4(u.trim());if(!t||!f)return;return{type:"image",source:{type:"base64",media_type:t,data:f}}}function Svu(i){if(typeof i==="string"&&i.trim())return i.trim();return}function JT4(i,u){let t=typeof i.data==="string"?i.data:void 0,f=Svu(i.mimeType??i.mediaType??i.media_type??u);if(!t||!f)return;return RR(f,t)}function KT4(i,u){let t=i.trim();if(/^https?:\/\//i.test(t))return{warning:xT4};let f=t.match(/^data:([^;]+);base64,(.+)$/i);if(f){let[,E,c]=f,w=RR(E,c);return w?{content:w}:{warning:e8}}let l=t.match(/^base64:([^,]+),(.+)$/i);if(l){let[,E,c]=l,w=RR(E,c);return w?{content:w}:{warning:e8}}if(u){let E=RR(u,t);if(E)return{content:E}}return{warning:e8}}function YT4(i){if(!i||typeof i!=="object")return{warning:e8};let u=i.image,t=Svu(i.mimeType);if(typeof u==="string")return KT4(u,t);if(u&&typeof u==="object"){let f=JT4(u,t);return f?{content:f}:{warning:e8}}return{warning:e8}}function WT4(i){if(typeof Buffer<"u")return(i instanceof Uint8Array?Buffer.from(i):Buffer.from(new Uint8Array(i))).toString("base64");if(typeof btoa==="function"){let u=i instanceof Uint8Array?i:new Uint8Array(i),t="",f=32768;for(let l=0;l<u.length;l+=f){let E=u.subarray(l,l+f);t+=String.fromCharCode(...E)}return btoa(t)}return}function LT4(i){let u=Svu(i.mediaType??i.mimeType);if(!u||!XT4(u))return{};let t=i.data;if(typeof t==="string"){let f=RR(u,t);return f?{content:f}:{warning:e8}}if(t instanceof Uint8Array||typeof ArrayBuffer<"u"&&t instanceof ArrayBuffer){let f=WT4(t);if(!f)return{warning:e8};let l=RR(u,f);return l?{content:l}:{warning:e8}}return{warning:e8}}function git(i){let u=[],t=[],f,l=[],E=new Map,c=!1,w=(_)=>{return l.push({formatted:_}),l.length-1},$=(_,N)=>{if(c=!0,!E.has(_))E.set(_,[]);E.get(_)?.push(N)};for(let _ of i)switch(_.role){case"system":if(f=_.content,typeof _.content==="string"&&_.content.trim().length>0)w(_.content);else w("");break;case"user":if(typeof _.content==="string")u.push(_.content),w(`Human: ${_.content}`);else{let N=_.content.filter((B)=>B.type==="text").map((B)=>B.text).join(`
 `),Z=w(N?`Human: ${N}`:"");if(N)u.push(N);for(let B of _.content)if(B.type==="image"){let{content:F,warning:g}=YT4(B);if(F)$(Z,F);else if(g)t.push(g)}else if(B.type==="file"){let{content:F,warning:g}=LT4(B);if(F)$(Z,F);else if(g)t.push(g)}}break;case"assistant":{let N="";if(typeof _.content==="string")N=_.content;else{let B=_.content.filter((g)=>g.type==="text").map((g)=>g.text).join(`
 `);if(B)N=B;let F=_.content.filter((g)=>g.type==="tool-call");if(F.length>0){let g=F.map((U)=>`[Tool call: ${U.toolName}(${kT4(U.input)})]`).join(`
 `);N+=N?`