npm - decocms - Versions diffs - 4.188.5 → 4.189.0 - Mend

decocms 4.188.5 → 4.189.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (223) hide show

package/dist/server/server.js CHANGED Viewed

@@ -1446,15 +1446,12 @@ This report is all the parent agent sees.`,lJ$=16000;var iJ$=B(()=>{sD();oU();Kw
 Preview:
 ${q}`}}}if(z.isError)return{type:"error-text",value:z.content.map((M)=>M.type==="text"?M.text:null).filter(Boolean).join(`
 `)||"Unknown error"};if("structuredContent"in z)return{type:"json",value:z.structuredContent};return{type:"text",value:z.content.map((P)=>{if(P.type==="text")return P.text;return JSON.stringify(P)}).join(`
-`)}}})]});return{tools:Object.fromEntries(N),nameMap:K,rawTools:J.tools}}var s34=120000;var Jp=B(()=>{c5();S4();jH()});function ax($,Z){let X;try{X=typeof $==="string"?$:JSON.stringify($,null,2)}catch{X=String($)}let Q=t7(X);if(Q>ew){let G=`vm_${Date.now()}`;Z.set(G,X);let Y=gX(X);return{truncated:!0,message:`Output too large (${Q} tokens). Use read_tool_output with tool_call_id "${G}" to extract specific data.`,preview:Y}}return $}var tJ$=B(()=>{jH()});import{z as A6}from"zod";var oJ$,rJ$,aJ$,sJ$,eJ$,$3$,Z3$,X3$,Q3$,G3$="Load a skill's full instructions (its SKILL.md) by id, for the skills listed in <available-skills>. Read-only. Call this BEFORE applying a skill, then follow its SKILL.md (run its scripts via bash). Do NOT call it for a skill whose SKILL.md is already in the conversation.",Y3$="Perform exact string replacement in a file in the VM. old_string must be unique in the file unless replace_all is true.",J3$="Search file contents in the VM using ripgrep. Supports regex patterns, file type filtering via glob, and context lines.",W3$="Find files by name pattern in the VM's project directory. Uses ripgrep for gitignore-aware matching. Returns relative file paths.",K3$,$O;var N3$=B(()=>{oJ$=A6.object({path:A6.string().describe("File path. Relative paths resolve against the project root (e.g. 'src/index.ts'); absolute paths are accepted for files outside the project (e.g. '/home/sandbox/deck.thumbnail.jpg')."),offset:A6.number().optional().describe("Starting line number for text files (1-based, default 1)"),limit:A6.number().optional().describe("Max lines to return for text files (default 2000)")}),rJ$=A6.object({path:A6.string().describe("File path relative to project root"),content:A6.string().describe("The full file content to write")}),aJ$=A6.object({path:A6.string().describe("File path relative to project root"),old_string:A6.string().describe("The exact text to find and replace"),new_string:A6.string().describe("The replacement text (must differ from old_string)"),replace_all:A6.boolean().optional().describe("Replace all occurrences (default false)")}),sJ$=A6.object({pattern:A6.string().describe("Regex pattern to search for"),path:A6.string().optional().describe("Directory or file to search in (default: project root)"),glob:A6.string().optional().describe("Glob pattern to filter files (e.g. '*.ts', '*.{js,jsx}')"),context:A6.number().optional().describe("Lines of context around matches"),ignore_case:A6.boolean().optional().describe("Case-insensitive search"),output_mode:A6.enum(["content","files","count"]).optional().describe("Output mode (default: 'files')"),limit:A6.number().optional().describe("Max result lines (default 250)")}),eJ$=A6.object({pattern:A6.string().describe("Glob pattern to match files (e.g. '**/*.ts', 'src/**/*.test.tsx')"),path:A6.string().optional().describe("Directory to search in (default: project root)")}),$3$=A6.object({command:A6.string().describe("The bash command to execute"),timeout:A6.number().optional().describe("Timeout in milliseconds (default 30000, max 120000)")}),Z3$=A6.object({id:A6.string().describe("Skill id from the <available-skills> catalog (e.g. 'core/slides' or 'home/<name>').")}),X3$="Read a file. For text files, returns content with line numbers (use offset and limit for large files). For images (jpeg, png, gif, webp), the image "+"is injected into the next turn as a vision input \u2014 do NOT describe what "+"you 'expect' to see, just call read and look at the next message. Other binary formats are not supported; use a format-specific skill (e.g. pptx-extract for .pptx).",Q3$=`Write content to a file in the VM's project directory. Creates parent directories if needed. Overwrites existing files entirely.
+`)}}})]});return{tools:Object.fromEntries(N),nameMap:K,rawTools:J.tools}}var s34=120000;var Jp=B(()=>{c5();S4();jH()});function ax($,Z){let X;try{X=typeof $==="string"?$:JSON.stringify($,null,2)}catch{X=String($)}let Q=t7(X);if(Q>ew){let G=`vm_${Date.now()}`;Z.set(G,X);let Y=gX(X);return{truncated:!0,message:`Output too large (${Q} tokens). Use read_tool_output with tool_call_id "${G}" to extract specific data.`,preview:Y}}return $}var tJ$=B(()=>{jH()});import{z as A6}from"zod";var oJ$,rJ$,aJ$,sJ$,eJ$,$3$,Z3$,X3$,Q3$,G3$="Load a skill's full instructions (its SKILL.md) by id, for the skills listed in <available-skills>. Read-only. Call this BEFORE applying a skill, then follow its SKILL.md (run its scripts via bash). Do NOT call it for a skill whose SKILL.md is already in the conversation.",Y3$="Perform exact string replacement in a file in the VM. old_string must be unique in the file unless replace_all is true.",J3$="Search file contents in the VM using ripgrep. Supports regex patterns, file type filtering via glob, and context lines.",W3$="Find files by name pattern in the VM's project directory. Uses ripgrep for gitignore-aware matching. Returns relative file paths.",K3$,$O;var N3$=B(()=>{oJ$=A6.object({path:A6.string().describe("File path. Prefer relative paths \u2014 they resolve against the project "+"root (e.g. 'src/index.ts'). Absolute paths are accepted but only for files you already know exist outside the project; do not guess one."),offset:A6.number().optional().describe("Starting line number for text files (1-based, default 1)"),limit:A6.number().optional().describe("Max lines to return for text files (default 2000)")}),rJ$=A6.object({path:A6.string().describe("File path relative to project root"),content:A6.string().describe("The full file content to write")}),aJ$=A6.object({path:A6.string().describe("File path relative to project root"),old_string:A6.string().describe("The exact text to find and replace"),new_string:A6.string().describe("The replacement text (must differ from old_string)"),replace_all:A6.boolean().optional().describe("Replace all occurrences (default false)")}),sJ$=A6.object({pattern:A6.string().describe("Regex pattern to search for"),path:A6.string().optional().describe("Directory or file to search in (default: project root)"),glob:A6.string().optional().describe("Glob pattern to filter files (e.g. '*.ts', '*.{js,jsx}')"),context:A6.number().optional().describe("Lines of context around matches"),ignore_case:A6.boolean().optional().describe("Case-insensitive search"),output_mode:A6.enum(["content","files","count"]).optional().describe("Output mode (default: 'files')"),limit:A6.number().optional().describe("Max result lines (default 250)")}),eJ$=A6.object({pattern:A6.string().describe("Glob pattern to match files (e.g. '**/*.ts', 'src/**/*.test.tsx')"),path:A6.string().optional().describe("Directory to search in (default: project root)")}),$3$=A6.object({command:A6.string().describe("The bash command to execute"),timeout:A6.number().optional().describe("Timeout in milliseconds (default 30000, max 120000)")}),Z3$=A6.object({id:A6.string().describe("Skill id from the <available-skills> catalog (e.g. 'core/slides' or 'home/<name>').")}),X3$="Read a file. For text files, returns content with line numbers (use offset and limit for large files). For images (jpeg, png, gif, webp), the image "+"is injected into the next turn as a vision input \u2014 do NOT describe what "+"you 'expect' to see, just call read and look at the next message. Other binary formats are not supported; use a format-specific skill (e.g. pptx-extract for .pptx).",Q3$=`Write content to a file in the VM's project directory. Creates parent directories if needed. Overwrites existing files entirely.
 Viewable HTML artifacts get a LIVE PREVIEW in the chat side panel and persist in the org's shared folder when written under \`org/home/\` (lowercase-kebab names):
 `+"- Presentation decks / slides \u2192 `org/home/decks/<name>.html` "+"\u2014 load the slides skill (`skill({ id: 'core/slides' })`) FIRST "+`and create the deck with its CLI.
 `+"- Standalone pages (landing pages, brand kits, one-pagers) \u2192 "+"`org/home/pages/<name>.html` \u2014 single self-contained "+`HTML file.
-HTML written anywhere else will not render a preview.`,K3$=`Execute a shell command in the VM's project directory. Working directory is the project root. Timeout default 30s, max 2min.
-The organization filesystem is mounted at \`org/\`:
-`+"- `org/home/` \u2014 the org's shared home folder (editable, "+`shared across runs). Organize it freely; check it before non-trivial work and record durable facts, decisions, and learnings as small markdown files.
+HTML written anywhere else will not render a preview.`,K3$="Execute a shell command in the VM's project directory. "+"Working directory is already the project root \u2014 the git checkout, when "+"the agent has a repo. Never `cd` to an absolute path you guessed (there is no `/home/sandbox` project dir); run git and build commands as-is from the default cwd. Timeout default 30s, max 2min.\n\nThe organization filesystem is mounted at `org/`:\n"+"- `org/home/` \u2014 the org's shared home folder (editable, "+`shared across runs). Organize it freely; check it before non-trivial work and record durable facts, decisions, and learnings as small markdown files.
 `+"- `org/public/<set>/` \u2014 curated read-only skill sets, mounted here. Your "+"skills are listed in the <available-skills> catalog; load one with the `skill` tool before applying it (don't `ls org/public/` to discover them).\n"+"- `org/upload/` \u2014 files the user attached to this conversation are "+`already here; read them directly.
 `+"- `org/output/` \u2014 write deliverables here; they are shared back to the "+"organization under this run's folder.\n\nTo make a presentation/slides/deck, ALWAYS use the `slides` skill "+"(HTML decks with a live editable preview) \u2014 load it with "+"`skill({ id: 'core/slides' })` first. `pptx` is NOT for this: it only reads/inspects existing `.pptx` files, and is the right tool only when the user explicitly needs a PowerPoint `.pptx` file as input or output.",$O={read:!1,write:!0,edit:!0,grep:!1,glob:!1,bash:!0,skill:!1}});function H3$($){let Z=$.split("/");if(Z.length<2)return null;if(!Z.every((Y)=>XW4.test(Y)))return null;let[X,...Q]=Z,G=Q.join("/");if(X==="home")return`org/home/${G}/SKILL.md`;return`org/public/${X}/${G}/SKILL.md`}var XW4;var F3$=B(()=>{XW4=/^[A-Za-z0-9][A-Za-z0-9._-]*$/});function U3$($){let{fs:Z,htmlArtifactBuffer:X,toolOutputMap:Q,needsApproval:G,pendingImages:Y}=$,J=(D)=>D?G:!1,W=(D,L,E,z="POST")=>Z.onProxy(D,L,z,E),K=_$({needsApproval:J($O.read),description:X3$,inputSchema:s(oJ$),execute:async(D,L)=>{let E=await W("/_sandbox/read",D,L.abortSignal);if(E.kind==="image")return Y.push({url:`data:${E.mediaType};base64,${E.base64}`,mediaType:E.mediaType,label:`[Image at ${D.path}]`}),{kind:"image",path:D.path,mediaType:E.mediaType,size:E.size,message:"Image attached below."};return ax(E,Q)}}),N=_$({needsApproval:J($O.write),description:Q3$,inputSchema:s(rJ$),execute:async(D,L)=>{let E=await W("/_sandbox/write",D,L.abortSignal);return X?.enqueue(D.path,D.content),E}}),H=_$({needsApproval:J($O.edit),description:Y3$,inputSchema:s(aJ$),execute:async(D,L)=>{let E=await W("/_sandbox/edit",D,L.abortSignal),z=E.content,{content:j,...A}=E;if(typeof z!=="string")return A;return X?.enqueue(D.path,z),A}}),F=_$({needsApproval:J($O.grep),description:J3$,inputSchema:s(sJ$),execute:async(D,L)=>{let E=await W("/_sandbox/grep",D,L.abortSignal);return ax(E,Q)}}),U=_$({needsApproval:J($O.glob),description:W3$,inputSchema:s(eJ$),execute:async(D,L)=>{let E=await W("/_sandbox/glob",D,L.abortSignal);return ax(E,Q)}}),w=_$({needsApproval:J($O.bash),description:K3$,inputSchema:s($3$),execute:async(D,L)=>{let E=await W("/_sandbox/bash",D,L.abortSignal);return ax(E,Q)}}),O=_$({needsApproval:J($O.skill),description:G3$,inputSchema:s(Z3$),execute:async({id:D},L)=>{let E=H3$(D);if(!E)return{error:`Invalid skill id "${D}". Use an id from <available-skills>.`};try{let z=await W("/_sandbox/read",{path:E},L.abortSignal);return ax(z,Q)}catch{return{error:`Skill "${D}" not found. Use an id from <available-skills>.`}}}});return{read:K,write:N,edit:H,grep:F,glob:U,bash:w,skill:O}}var w3$=B(()=>{S4();tJ$();N3$();F3$()});function O3$($){let Z=$;return{fs:{onRead:(Q)=>Z.onRead(Q),onWrite:(Q,G)=>Z.onWrite(Q,G),onEdit:(Q,G)=>Z.onEdit(Q,G),onBash:(Q,G)=>Z.onBash(Q,G),onGlob:(Q)=>Z.onGlob(Q),onGrep:(Q,G)=>Z.onGrep(Q,G),onProxy:(Q,G,Y,J)=>Z.onProxy(Q,G,Y,J)},swap(Q){Z=Q}}}import{z as ZO}from"zod";var QW4,GW4,YW4,Rw0;var Qp0=B(()=>{S4();QW4=ZO.object({prompt:ZO.string().min(1).describe("One short question (1 sentence max, \u226415 words). The conversation already provides context, do not repeat it here."),type:ZO.enum(["text","choice","confirm"]).describe("'text': free-form, 'choice': pick from options (UI adds 'Other' automatically), 'confirm': yes/no"),options:ZO.array(ZO.string()).optional().describe("Required for 'choice'. Each option must be a short label (3\u20136 words, no leading numbers like '1)' \u2014 the UI adds them)."),default:ZO.string().optional()}).refine(($)=>{if($.type==="choice")return $.options&&$.options.length>=2;return!0},{message:"Options array with at least 2 items required for 'choice' type",path:["options"]}),GW4=ZO.object({response:ZO.string().describe("User's response")}),YW4=`Ask the user instead of guessing when requirements are ambiguous, multiple valid approaches exist, or before actions with significant consequences. Prefer this tool over asking in plain text.
@@ -2729,7 +2726,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
-Respond with the structured verdict and a short reason.`,NC$;var FC$=B(()=>{S4();sw();Y81();W16=J81.object({requiresReview:J81.boolean().describe("true if the changes should go through pull-request review"),reason:J81.string().describe("One short sentence explaining the decision (max ~120 chars)")});NC$={requiresReview:!1,reason:""}});function F16($){if(!$||$.includes(".."))return!1;return H16.test($)}function UC$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!F16(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function wC$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var H16;var OC$=B(()=>{H16=/^[\w./@-]+$/});function W81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function BC$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function DC$($,Z,X,Q){if(!Q.connectionId)throw new bg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let G=$.organization?.id;if(!G)throw new bg(u7);await qx({ctx:$,connectionId:Q.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(H)=>{let F=H instanceof Error?H.message:u7;throw new bg(F)}});let{cloneUrl:Y,gitUserName:J,gitUserEmail:W}=await bw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=nE0($),N=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Y},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!N.ok){let H=await aw(N,U16).catch(()=>N.statusText);throw Error(`Failed to refresh sandbox git credentials (${N.status}): ${H}`)}}var U16=10485760,bg;var LC$=B(()=>{Lw();s$1();en();Rn();bg=class bg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function O16($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!w16.test(Z))throw Error(`Invalid branch name: ${$}`)}function _C($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(D16)])}function vC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function K81($,Z){let Q=(pE0.get($)??Promise.resolve()).catch(()=>{}).then(Z),G=Q.catch(()=>{});return pE0.set($,G),G.finally(()=>{if(pE0.get($)===G)pE0.delete($)}),Q}async function SZ($,Z,X){let Q=vC($);if(Q instanceof Response)return Q;let{claimName:G,userId:Y,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,N=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,N.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),N.set("content-type","application/json");let H=X?.signal,F={method:W,headers:N,body:K,...H?{signal:H}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(G,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:Y,projectRef:J},G))w=await Q.proxyDaemonRequest(G,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...fG}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?E16(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...fG}})};try{if(H){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(H.aborted)return L(H.reason);H.addEventListener("abort",()=>L(H.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function E16($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function tE0($,Z,X,Q="GET",G){let Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(Y.status===404&&G){try{await Y.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(G,Z))Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(Y.status===404){try{await Y.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Y.text();if(!Y.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${Y.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${Y.status})`)}return JSON.parse(J)}function z16($){return jC$.includes($)}var w16,EC$=524288,B16=65536,D16=1e4,zC$=2000,L16,pE0,fG,jC$,PC$=()=>{let $=new D1;return $.use("/:virtualMcpId/:branch/*",L16),$.post("/:virtualMcpId/:branch/write",(Z)=>SZ(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>SZ(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>SZ(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>SZ(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>SZ(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>SZ(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>SZ(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return SZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return SZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>SZ(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>SZ(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!z16(X))return Z.json({error:`step must be one of: ${jC$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let G=a(Z.var.studioContext),Y=Qw0(Q.virtualMcpMetadata);try{await Gw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:G.id,userId:Q.callerUserId,entries:Y})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return SZ(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return tH(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return QC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>SZ(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(zC$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>SZ(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(zC$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>SZ(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:G,connectionIds:Y}=Z.get("vmClaim"),J=Z.var.studioContext;return K81(Q,async()=>{try{await e$1(J,X,Q);let W=BC$(G,Y);if(W)await DC$(J,X,Q,W)}catch(W){if(W instanceof bg)return Z.json({error:W.message},403,fG);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,fG)}return SZ(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return K81(X,()=>SZ(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.var.studioContext;return K81(Q,async()=>{try{await e$1(G,X,Q)}catch(Y){let J=Y instanceof Error?Y.message:String(Y);return Z.json({error:J},502,fG)}return SZ(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",F7({maxSize:EC$,onError:(Z)=>Z.json({error:"Payload too large"},413,fG)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,N=W.diff,H=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[F,U]=X81(K)&&H?[K,N]:await Promise.all([tE0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),tE0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await KC$(J,F,U);return Z.json(w,200,fG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fG);return Z.json({error:K},502,fG)}}),$.post("/:virtualMcpId/:branch/git/judge-review",F7({maxSize:EC$,onError:(Z)=>Z.json({error:"Payload too large"},413,fG)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,N=W.diff,H=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[F,U]=X81(K)&&H?[K,N]:await Promise.all([tE0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),tE0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await HC$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,fG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fG);return Z.json({error:K},502,fG)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Z.json({error:"Path not allowed"},403);let Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let J=Y.replace(/\/+$/,""),W=W81(`${J}${G}`),K;try{K=await fetch(W?.url??`${J}${G}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",F7({maxSize:B16,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let Y;try{Y=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Y||typeof Y!=="object"||Array.isArray(Y))return Z.json({error:"Invalid JSON body"},400);let J=UC$(Y);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=wC$(G,J.resolveType),K=W81(W),N;try{N=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await N.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:N.status,headers:{"content-type":N.headers.get("content-type")??"application/json"}})}),$};var AC$=B(()=>{u8();TC();vg();eV$();NH();ZC$();B3();tw();XC$();GC$();Rn0();sn();Y81();FC$();OC$();LC$();w16=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;L16=sV$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let G;try{G=a(X)}catch{return $.json({error:"Organization scope required"},403)}let Y=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Y||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{O16(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==G.id)return $.json({error:"Virtual MCP not found"},404);let K=zn({orgId:G.id,virtualMcpId:Y,branch:J}),N=await LH(X,J,Q),H=$C$({userId:N,projectRef:K}),F=W.metadata??null,U;try{U=(await yX(X,{userId:N,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:H,callerUserId:Q,runner:U,virtualMcpId:Y,branch:J,userId:N,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});pE0=new Map;fG={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};jC$=["clone","install","start"]});var TC$=($)=>{let Z=new D1;if(Z.use("*",AC),Z.route("/",NE0()),Z.route("/",yM$()),Z.route("/",hV$()),Z.route("/",yV$()),Z.route("/",dE0()),Z.route("/tools",nV$()),Z.route("/",dV$()),Z.route("/",zV$({kvStorage:$.kvStorage})),Z.route("/",LV$()),Z.route("/fs",VV$({getConnection:$.getNatsConnection})),Z.route("/sandbox",PC$()),Z.route("/",bV$()),Z.route("/deco-sites",FE0()),Z.route("/sso",XE0()),Z.route("/",mE0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",SM$()),$.mountDevAssets)Z.route("/dev-assets",UE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",js1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",_V$()),Z.route("/mcp",yO0()),Z.route("/mcp/self",lE0()),Z.route("/mcp",uO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var RC$=B(()=>{u8();z11();VM$();R11();wE0();tt();L11();EV$();jV$();CV$();ki();K11();cO0();i$1();vV$();fV$();gV$();uV$();mV$();p$1();pV$();t$1();gO0();AC$()});function P16($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function A16($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(j16)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var j16=1e4,T16=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},IC$=()=>{let $=new D1;return $.use("*",T16),$.get("/",async(Z)=>{let X=d0(),Q=X.decoSupabaseUrl,G=X.decoSupabaseServiceKey;if(!Q||!G)return Z.json({apps:[]});try{let Y=await A16(Q,G);return Z.json({apps:P16(Y)})}catch(Y){return console.error("[deco-apps] GET error:",Y),Z.json({error:"Failed to fetch apps"},502)}}),$};var qC$=B(()=>{u8();V$()});import{z as M1}from"zod";function VK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function v16($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function b16($,Z,X){try{return JSON.parse($)}catch{throw new SC$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function f16($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((G)=>{if(G.type==="text")return{type:"text",text:G.text};return{type:"image",image:G.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((G)=>({type:"tool-call",toolCallId:G.id,toolName:G.function.name,input:b16(G.function.arguments,G.id,G.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function x16($){let Z=$.map((X)=>{let Q=X.function.parameters?BG(X.function.parameters):BG({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function y16($){if(!$)return;return{openai:{response_format:$}}}function g16(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function MC$($,Z,X,Q,G,Y){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:Y};return G?{...J,providerOptions:G}:J}function kC$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var R16=256,I16,q16,M16,k16,S16,V16,C16,_16,SC$,VC$,CC$;var _C$=B(()=>{S4();u8();vg();MH();I16=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),q16=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),M16=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(q16).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),k16=M1.object({type:M1.literal("text")}),S16=M1.object({type:M1.literal("json_object")}),V16=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),C16=M1.union([k16,S16,V16]),_16=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(M16),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(I16).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:C16.optional(),user:M1.string().optional()});SC$=class SC$ extends Error{constructor($){super($);this.name="MessageConversionError"}};VC$=new D1;VC$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(VK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(VK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(VK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),G=_16.safeParse(Q);if(!G.success){let L=G.error.issues[0]??{message:"Invalid request",path:[]};return $.json(VK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let Y=G.data,J=v16(Y.model);if(!J)return $.json(VK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((z)=>nB(z.providerId));if(!E)return $.json(VK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let N;try{N=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(VK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=N.aiSdk.languageModel(K),F=f16(Y.messages),U=Y.tools?x16(Y.tools):void 0,w=y16(Y.response_format),O=g16(),D=Math.floor(Date.now()/1000);if(Y.stream)return tH($,async(L)=>{let E=MC$(H,F,U,Y,w,$.req.raw.signal);try{let z=_w(E),j=!1,A=0,P="",M=async()=>{if(P.length===0)return;let S=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(P+=S.text,P.length>=R16)await M()}else if(S.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{},finish_reason:kC$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await L.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let L=MC$(H,F,U,Y,w,$.req.raw.signal),E=await Vw(L),z={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)z.tool_calls=E.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:O,object:"chat.completion",created:D,model:Y.model,choices:[{index:0,message:z,finish_reason:kC$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let G=Q;if(G.name==="AbortError")return $.json(VK("Request aborted","invalid_request_error"),400);if(G.name==="MessageConversionError")return $.json(VK(G.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",G.message,G.stack),$.json(VK(G.message,"server_error"),500)}});CC$=VC$});var bC$;var vC$=B(()=>{bC$={name:"decocms",version:"4.188.5",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function c16(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??u16}}var fC$,u16="https://ph.studio.decocms.com",xC$;var yC$=B(()=>{u8();_C0();vV();OZ();V$();Q11();vC$();fC$=new D1;fC$.get("/",($)=>{let Z={version:bC$.version,theme:IM1(),...aB().logo&&{logo:aB().logo},...JK()&&{internalUrl:M21()},...d0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!d0().firecrawlApiKey,auth:mq$(),posthog:c16(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!JK()&&d0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});xC$=fC$});function fg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function N81($){return(fg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function hC$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(fg($))}&sz=${Z}`}function gC$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),G=Q.lastIndexOf(" ");return`${(G>Z*0.6?Q.slice(0,G):Q).trimEnd()}\u2026`}function uC$($){let{brand:Z,domain:X,score:Q,verdict:G}=$,Y=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=G?.trim()?gC$(`${G.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):gC$(`How does ${X} really perform? ${J}`,200);return{title:Y,description:W}}import{z as c0}from"zod";var bC,l16,d16,m16,i16,cC$;var lC$=B(()=>{bC=c0.enum(["good","bad","neutral"]),l16=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:bC.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),d16=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(l16)),m16={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},i16=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:bC.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:bC.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:bC.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:bC.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(d16).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:bC.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:bC.optional()})).min(1)})]),cC$=c0.object({...m16,template:i16})});function oE0($){let Z=[],X=[...$.sections].sort((Q,G)=>Q.position-G.position).map((Q)=>{let G=cC$.safeParse(Q.props);if(G.success)return G.data;let Y=G.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:Y?`${Y.path.join(".")||"(root)"}: ${Y.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var H81=B(()=>{lC$()});import{join as dC$}from"path";async function p16($){try{let Z=await fetch(`${UW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(n16)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=oE0(X);if(!Q.slides.length)return null;let G=Q.slides.find((W)=>W.template.template==="cover"),Y=G?.template,J=Y&&Y.template==="cover"?Y:void 0;return{brand:Q.meta.brand?.trim()||N81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:G?.annotation?.trim()||G?.headline?.trim()||void 0}}catch{return null}}function xG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function t16($,Z){let X=fg($),Q=Z?.brand?.trim()||N81(X),G=hC$(X,128),J=`${(d0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=uC$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),N=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${xG(W)}</title>`,`<meta name="description" content="${xG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${xG(W)}" />`,`<meta property="og:description" content="${xG(K)}" />`,`<meta property="og:url" content="${xG(J)}" />`,`<meta property="og:image" content="${xG(N)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${xG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${xG(W)}" />`,`<meta name="twitter:description" content="${xG(K)}" />`,`<meta name="twitter:image" content="${xG(N)}" />`,`<meta name="twitter:image:alt" content="${xG(H)}" />`,`<link rel="canonical" href="${xG(J)}" />`,`<link rel="icon" href="${xG(G)}" sizes="any" />`].join(`
+Respond with the structured verdict and a short reason.`,NC$;var FC$=B(()=>{S4();sw();Y81();W16=J81.object({requiresReview:J81.boolean().describe("true if the changes should go through pull-request review"),reason:J81.string().describe("One short sentence explaining the decision (max ~120 chars)")});NC$={requiresReview:!1,reason:""}});function F16($){if(!$||$.includes(".."))return!1;return H16.test($)}function UC$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!F16(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function wC$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var H16;var OC$=B(()=>{H16=/^[\w./@-]+$/});function W81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function BC$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function DC$($,Z,X,Q){if(!Q.connectionId)throw new bg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let G=$.organization?.id;if(!G)throw new bg(u7);await qx({ctx:$,connectionId:Q.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(H)=>{let F=H instanceof Error?H.message:u7;throw new bg(F)}});let{cloneUrl:Y,gitUserName:J,gitUserEmail:W}=await bw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=nE0($),N=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Y},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!N.ok){let H=await aw(N,U16).catch(()=>N.statusText);throw Error(`Failed to refresh sandbox git credentials (${N.status}): ${H}`)}}var U16=10485760,bg;var LC$=B(()=>{Lw();s$1();en();Rn();bg=class bg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function O16($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!w16.test(Z))throw Error(`Invalid branch name: ${$}`)}function _C($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(D16)])}function vC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function K81($,Z){let Q=(pE0.get($)??Promise.resolve()).catch(()=>{}).then(Z),G=Q.catch(()=>{});return pE0.set($,G),G.finally(()=>{if(pE0.get($)===G)pE0.delete($)}),Q}async function SZ($,Z,X){let Q=vC($);if(Q instanceof Response)return Q;let{claimName:G,userId:Y,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,N=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,N.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),N.set("content-type","application/json");let H=X?.signal,F={method:W,headers:N,body:K,...H?{signal:H}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(G,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:Y,projectRef:J},G))w=await Q.proxyDaemonRequest(G,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...fG}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?E16(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...fG}})};try{if(H){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(H.aborted)return L(H.reason);H.addEventListener("abort",()=>L(H.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function E16($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function tE0($,Z,X,Q="GET",G){let Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(Y.status===404&&G){try{await Y.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(G,Z))Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(Y.status===404){try{await Y.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Y.text();if(!Y.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${Y.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${Y.status})`)}return JSON.parse(J)}function z16($){return jC$.includes($)}var w16,EC$=524288,B16=65536,D16=1e4,zC$=2000,L16,pE0,fG,jC$,PC$=()=>{let $=new D1;return $.use("/:virtualMcpId/:branch/*",L16),$.post("/:virtualMcpId/:branch/write",(Z)=>SZ(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>SZ(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>SZ(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>SZ(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>SZ(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>SZ(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>SZ(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:_C(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return SZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return SZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>SZ(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>SZ(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!z16(X))return Z.json({error:`step must be one of: ${jC$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let G=a(Z.var.studioContext),Y=Qw0(Q.virtualMcpMetadata);try{await Gw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:G.id,userId:Q.callerUserId,entries:Y})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return SZ(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return tH(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return QC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>SZ(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(zC$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>SZ(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(zC$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>SZ(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:G,connectionIds:Y}=Z.get("vmClaim"),J=Z.var.studioContext;return K81(Q,async()=>{try{await e$1(J,X,Q);let W=BC$(G,Y);if(W)await DC$(J,X,Q,W)}catch(W){if(W instanceof bg)return Z.json({error:W.message},403,fG);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,fG)}return SZ(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return K81(X,()=>SZ(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.var.studioContext;return K81(Q,async()=>{try{await e$1(G,X,Q)}catch(Y){let J=Y instanceof Error?Y.message:String(Y);return Z.json({error:J},502,fG)}return SZ(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",F7({maxSize:EC$,onError:(Z)=>Z.json({error:"Payload too large"},413,fG)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,N=W.diff,H=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[F,U]=X81(K)&&H?[K,N]:await Promise.all([tE0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),tE0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await KC$(J,F,U);return Z.json(w,200,fG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fG);return Z.json({error:K},502,fG)}}),$.post("/:virtualMcpId/:branch/git/judge-review",F7({maxSize:EC$,onError:(Z)=>Z.json({error:"Payload too large"},413,fG)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,N=W.diff,H=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[F,U]=X81(K)&&H?[K,N]:await Promise.all([tE0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),tE0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await HC$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,fG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fG);return Z.json({error:K},502,fG)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Z.json({error:"Path not allowed"},403);let Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let J=Y.replace(/\/+$/,""),W=W81(`${J}${G}`),K;try{K=await fetch(W?.url??`${J}${G}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",F7({maxSize:B16,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=vC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let Y;try{Y=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Y||typeof Y!=="object"||Array.isArray(Y))return Z.json({error:"Invalid JSON body"},400);let J=UC$(Y);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=wC$(G,J.resolveType),K=W81(W),N;try{N=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await N.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:N.status,headers:{"content-type":N.headers.get("content-type")??"application/json"}})}),$};var AC$=B(()=>{u8();TC();vg();eV$();NH();ZC$();B3();tw();XC$();GC$();Rn0();sn();Y81();FC$();OC$();LC$();w16=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;L16=sV$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let G;try{G=a(X)}catch{return $.json({error:"Organization scope required"},403)}let Y=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Y||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{O16(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==G.id)return $.json({error:"Virtual MCP not found"},404);let K=zn({orgId:G.id,virtualMcpId:Y,branch:J}),N=await LH(X,J,Q),H=$C$({userId:N,projectRef:K}),F=W.metadata??null,U;try{U=(await yX(X,{userId:N,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:H,callerUserId:Q,runner:U,virtualMcpId:Y,branch:J,userId:N,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});pE0=new Map;fG={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};jC$=["clone","install","start"]});var TC$=($)=>{let Z=new D1;if(Z.use("*",AC),Z.route("/",NE0()),Z.route("/",yM$()),Z.route("/",hV$()),Z.route("/",yV$()),Z.route("/",dE0()),Z.route("/tools",nV$()),Z.route("/",dV$()),Z.route("/",zV$({kvStorage:$.kvStorage})),Z.route("/",LV$()),Z.route("/fs",VV$({getConnection:$.getNatsConnection})),Z.route("/sandbox",PC$()),Z.route("/",bV$()),Z.route("/deco-sites",FE0()),Z.route("/sso",XE0()),Z.route("/",mE0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",SM$()),$.mountDevAssets)Z.route("/dev-assets",UE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",js1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",_V$()),Z.route("/mcp",yO0()),Z.route("/mcp/self",lE0()),Z.route("/mcp",uO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var RC$=B(()=>{u8();z11();VM$();R11();wE0();tt();L11();EV$();jV$();CV$();ki();K11();cO0();i$1();vV$();fV$();gV$();uV$();mV$();p$1();pV$();t$1();gO0();AC$()});function P16($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function A16($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(j16)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var j16=1e4,T16=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},IC$=()=>{let $=new D1;return $.use("*",T16),$.get("/",async(Z)=>{let X=d0(),Q=X.decoSupabaseUrl,G=X.decoSupabaseServiceKey;if(!Q||!G)return Z.json({apps:[]});try{let Y=await A16(Q,G);return Z.json({apps:P16(Y)})}catch(Y){return console.error("[deco-apps] GET error:",Y),Z.json({error:"Failed to fetch apps"},502)}}),$};var qC$=B(()=>{u8();V$()});import{z as M1}from"zod";function VK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function v16($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function b16($,Z,X){try{return JSON.parse($)}catch{throw new SC$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function f16($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((G)=>{if(G.type==="text")return{type:"text",text:G.text};return{type:"image",image:G.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((G)=>({type:"tool-call",toolCallId:G.id,toolName:G.function.name,input:b16(G.function.arguments,G.id,G.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function x16($){let Z=$.map((X)=>{let Q=X.function.parameters?BG(X.function.parameters):BG({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function y16($){if(!$)return;return{openai:{response_format:$}}}function g16(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function MC$($,Z,X,Q,G,Y){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:Y};return G?{...J,providerOptions:G}:J}function kC$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var R16=256,I16,q16,M16,k16,S16,V16,C16,_16,SC$,VC$,CC$;var _C$=B(()=>{S4();u8();vg();MH();I16=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),q16=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),M16=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(q16).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),k16=M1.object({type:M1.literal("text")}),S16=M1.object({type:M1.literal("json_object")}),V16=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),C16=M1.union([k16,S16,V16]),_16=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(M16),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(I16).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:C16.optional(),user:M1.string().optional()});SC$=class SC$ extends Error{constructor($){super($);this.name="MessageConversionError"}};VC$=new D1;VC$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(VK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(VK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(VK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),G=_16.safeParse(Q);if(!G.success){let L=G.error.issues[0]??{message:"Invalid request",path:[]};return $.json(VK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let Y=G.data,J=v16(Y.model);if(!J)return $.json(VK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((z)=>nB(z.providerId));if(!E)return $.json(VK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let N;try{N=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(VK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=N.aiSdk.languageModel(K),F=f16(Y.messages),U=Y.tools?x16(Y.tools):void 0,w=y16(Y.response_format),O=g16(),D=Math.floor(Date.now()/1000);if(Y.stream)return tH($,async(L)=>{let E=MC$(H,F,U,Y,w,$.req.raw.signal);try{let z=_w(E),j=!1,A=0,P="",M=async()=>{if(P.length===0)return;let S=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(P+=S.text,P.length>=R16)await M()}else if(S.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{},finish_reason:kC$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await L.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let L=MC$(H,F,U,Y,w,$.req.raw.signal),E=await Vw(L),z={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)z.tool_calls=E.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:O,object:"chat.completion",created:D,model:Y.model,choices:[{index:0,message:z,finish_reason:kC$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let G=Q;if(G.name==="AbortError")return $.json(VK("Request aborted","invalid_request_error"),400);if(G.name==="MessageConversionError")return $.json(VK(G.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",G.message,G.stack),$.json(VK(G.message,"server_error"),500)}});CC$=VC$});var bC$;var vC$=B(()=>{bC$={name:"decocms",version:"4.189.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function c16(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??u16}}var fC$,u16="https://ph.studio.decocms.com",xC$;var yC$=B(()=>{u8();_C0();vV();OZ();V$();Q11();vC$();fC$=new D1;fC$.get("/",($)=>{let Z={version:bC$.version,theme:IM1(),...aB().logo&&{logo:aB().logo},...JK()&&{internalUrl:M21()},...d0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!d0().firecrawlApiKey,auth:mq$(),posthog:c16(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!JK()&&d0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});xC$=fC$});function fg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function N81($){return(fg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function hC$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(fg($))}&sz=${Z}`}function gC$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),G=Q.lastIndexOf(" ");return`${(G>Z*0.6?Q.slice(0,G):Q).trimEnd()}\u2026`}function uC$($){let{brand:Z,domain:X,score:Q,verdict:G}=$,Y=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=G?.trim()?gC$(`${G.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):gC$(`How does ${X} really perform? ${J}`,200);return{title:Y,description:W}}import{z as c0}from"zod";var bC,l16,d16,m16,i16,cC$;var lC$=B(()=>{bC=c0.enum(["good","bad","neutral"]),l16=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:bC.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),d16=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(l16)),m16={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},i16=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:bC.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:bC.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:bC.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:bC.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(d16).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:bC.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:bC.optional()})).min(1)})]),cC$=c0.object({...m16,template:i16})});function oE0($){let Z=[],X=[...$.sections].sort((Q,G)=>Q.position-G.position).map((Q)=>{let G=cC$.safeParse(Q.props);if(G.success)return G.data;let Y=G.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:Y?`${Y.path.join(".")||"(root)"}: ${Y.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var H81=B(()=>{lC$()});import{join as dC$}from"path";async function p16($){try{let Z=await fetch(`${UW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(n16)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=oE0(X);if(!Q.slides.length)return null;let G=Q.slides.find((W)=>W.template.template==="cover"),Y=G?.template,J=Y&&Y.template==="cover"?Y:void 0;return{brand:Q.meta.brand?.trim()||N81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:G?.annotation?.trim()||G?.headline?.trim()||void 0}}catch{return null}}function xG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function t16($,Z){let X=fg($),Q=Z?.brand?.trim()||N81(X),G=hC$(X,128),J=`${(d0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=uC$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),N=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${xG(W)}</title>`,`<meta name="description" content="${xG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${xG(W)}" />`,`<meta property="og:description" content="${xG(K)}" />`,`<meta property="og:url" content="${xG(J)}" />`,`<meta property="og:image" content="${xG(N)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${xG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${xG(W)}" />`,`<meta name="twitter:description" content="${xG(K)}" />`,`<meta name="twitter:image" content="${xG(N)}" />`,`<meta name="twitter:image:alt" content="${xG(H)}" />`,`<link rel="canonical" href="${xG(J)}" />`,`<link rel="icon" href="${xG(G)}" sizes="any" />`].join(`
     `)}function o16($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function mC$($){let Z=new D1;return Z.get("/:domain/og.png",async(X)=>{let Q=fg(X.req.param("domain")),G=async()=>{let Y=$?Bun.file(dC$($,"report-og-fallback.png")):null;if(!Y||!await Y.exists())return X.notFound();return X.body(new Uint8Array(await Y.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let Y=await fetch(`${UW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(r16)}),J=Y.headers.get("content-type")??"";if(!Y.ok||!J.startsWith("image/")||!Y.body)return G();return X.body(Y.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return G()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),G=$?dC$($,"index.html"):null,Y=G?Bun.file(G):null;if(!Y||!await Y.exists())return X.notFound();let J=await Y.text();try{let W=await p16(fg(Q)),K=t16(Q,W);return X.html(o16(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var n16=2500,r16=1e4;var iC$=B(()=>{u8();H81();RD();V$()});function Po($,Z){return fetch(`${UW({})}${$}`,Z)}async function a16($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let G=Q.toString()?`?${Q.toString()}`:"",Y=await Po(`/api/v2/public/diagnostics/${encodeURIComponent($)}${G}`,{headers:{Accept:"application/json"}});if(Y.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!Y.ok)throw Error(`report read HTTP ${Y.status}`);let J=await Y.json(),{deck:W,drops:K}=oE0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var s16,_3,rE0=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},nC$;var pC$=B(()=>{u8();IY();RD();H81();s16=new Set(["complete","errored","terminated","unknown"]),_3=new D1;_3.use("*",async($,Z)=>{let X=await E8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});_3.use("/run",rE0);_3.use("/status",rE0);_3.use("/link-token/*",rE0);_3.use("/suggest",rE0);_3.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,G=$.req.query("lang")?.trim()||void 0;try{let Y=await a16(Z,Q,G);if($.header("Cache-Control","private, no-store"),X||!Y.deck)return $.json(Y);return $.json({...Y,deck:{...Y.deck,slides:Y.deck.slides.slice(0,1)},truncated:Y.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});_3.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let G=Z.email,Y=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Po("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${TD({})}`},body:JSON.stringify({url:Q,email:G,distinct_id:Y})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});_3.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Po(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${TD({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let G=(await X.json()).status??"unknown",Y={done:s16.has(G),status:G};return $.json(Y)}catch{return $.json({error:"status failed"},502)}});_3.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Po(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});_3.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Po(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});nC$=_3});import{createHmac as e16,timingSafeEqual as $$6}from"crypto";function tC$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let G,Y=[];for(let N of Z.split(",")){let H=N.indexOf("=");if(H<=0)continue;let F=N.slice(0,H).trim(),U=N.slice(H+1).trim();if(F==="t")G=U;else if(F==="v1")Y.push(U)}if(!G||Y.length===0)return!1;let J=Number(G);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>Z$6)return!1;let W=e16("sha256",X).update(`${G}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return Y.some((N)=>{let H=Buffer.from(N,"hex");return K.length===H.length&&$$6(K,H)})}function oC$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=tY(Z),Q=tY(tY(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:CK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function X$6($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function CK($){return typeof $==="string"?$:void 0}function tY($){return typeof $==="object"&&$!==null?$:void 0}function aE0($){return typeof $==="number"?new Date($*1000):null}function w81($){return CK($)??CK(tY($)?.id)}function Q$6($){return w81($.subscription)??CK(tY(tY($.parent)?.subscription_details)?.subscription)}function G$6($){let Z=aE0($.current_period_end);if(Z)return Z;let X=tY($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let G of X){let Y=tY(G)?.current_period_end;if(typeof Y==="number"&&Y>Q)Q=Y}return Q>0?new Date(Q*1000):null}function F81($,Z){let X=aE0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function U81($,Z){let X=aE0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function Y$6($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=CK(tY(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(CK(tY(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(CK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=CK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(tY(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:tY(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(CK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let G=await $.getBilling(Q);if(!G)return{handled:!1,reason:"unknown org"};let Y=w81(X.subscription);if(G.stripeSubscriptionId&&Y&&G.stripeSubscriptionId!==Y)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:Y};if(F81(Z,G))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:w81(X.customer),stripeSubscriptionId:Y,status:"active",lastStripeEventAt:U81(Z,G)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=CK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let G=await $.getBillingByStripeSubscriptionId(Q);if(!G)return{handled:!1,reason:"unknown subscription"};let Y=Z.type==="customer.subscription.deleted";if(!Y&&F81(Z,G))return{handled:!1,reason:"stale event"};let J=Y?"canceled":X$6(X.status);return await $.updateStripeState(G.organizationId,{status:J,currentPeriodEnd:G$6(X),...Y&&{stripeSubscriptionId:null},lastStripeEventAt:U81(Z,G)}),{handled:!0,organizationId:G.organizationId}}case"invoice.paid":{let Q=Q$6(X);if(!Q)return{handled:!1,reason:"no sub id"};let G=await $.getBillingByStripeSubscriptionId(Q);if(!G)return{handled:!1,reason:"unknown subscription"};if(F81(Z,G))return{handled:!1,reason:"stale event"};return await $.updateStripeState(G.organizationId,{status:"active",currentPeriodEnd:aE0(X.period_end),lastStripeEventAt:U81(Z,G)}),{handled:!0,organizationId:G.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}async function rC$($){let Z=new TW(c8().db),X=await Y$6(Z,$);if(X.handled&&X.topUp)await $F$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId});if(!X.handled&&X.orphanSubscriptionId)try{await W1$(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof J3&&(Q.status===400||Q.status===404)))throw Q}return X}var Z$6=300;var aC$=B(()=>{GY();$n();do0()});var J$6=1048576,O81;var sC$=B(()=>{u8();TC();V$();aC$();O81=new D1;O81.post("/webhook",F7({maxSize:J$6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=d0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!tC$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let G=oC$(X);if(!G)return $.json({error:"invalid payload"},400);let Y=await rC$(G);return console.log("stripe webhook",{eventId:G.id,type:G.type,livemode:G.livemode,...Y}),$.json({received:!0})})});function eC$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var $_$,W$6,K$6,Z_$;var X_$=B(()=>{u8();AJ();Zy();Ev();$_$=new D1,W$6=["range","if-none-match","if-modified-since"],K$6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];$_$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(Og($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Q$(401,{message:"Authentication required"})}if(!X)throw new Q$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Q$(400,{message:"Missing file key"});let G=await Up(Q,Z);if(!G)throw new Q$(503,{message:"Object storage not configured"});if(G.startsWith("data:")&&PJ()){let K=G.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Q$(500,{message:"Invalid data URL from storage"});let[,N,H]=K,F=Buffer.from(H,"base64"),U=new Headers({"Content-Type":N,"Cache-Control":"private, max-age=86400"});return eC$(U,N),new Response(F,{status:200,headers:U})}let Y=new Headers;for(let K of W$6){let N=$.req.header(K);if(N)Y.set(K,N)}let J=await fetch(G,{headers:Y});if(J.status===403||J.status===404)throw new Q$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Q$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of K$6){let N=J.headers.get(K);if(N)W.set(K,N)}return W.set("Cache-Control","private, max-age=86400"),eC$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Z_$=$_$});var Ao=_((fC)=>{var N$6=fC&&fC.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var G=Object.getOwnPropertyDescriptor(Z,X);if(!G||("get"in G?!Z.__esModule:G.writable||G.configurable))G={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,G)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),H$6=fC&&fC.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))N$6(Z,$,X)};Object.defineProperty(fC,"__esModule",{value:!0});H$6(tQ(),fC)});var Y_$=_((Q_$)=>{Object.defineProperty(Q_$,"__esModule",{value:!0});Q_$.version=void 0;Q_$.version="3.4.0"});var K_$=_((_K)=>{var F$6=_K&&_K.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(_K,"__esModule",{value:!0});_K.NodeTransport=_K.VERSION=void 0;_K.nodeResolveHost=L$6;var h6=Ao(),U$6=j0("net"),B81=j0("tls"),w$6=j0("path"),J_$=j0("fs"),O$6=F$6(j0("dns")),B$6=Y_$();_K.VERSION=B$6.version;var D$6="nats.js";class W_${socket;version;lang;yields=[];signal=(0,h6.deferred)();closedNotification=(0,h6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=D$6,this.version=_K.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let G=await this.peekInfo();(0,h6.checkOptions)(G,Z);let{tls_required:Y,tls_available:J}=G,W=J===!0&&Z.tls!==null;if(!Q&&(Y||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Y&&this.socket.encrypted!==!0)throw h6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(G){let Y=G;if(!Y)Y=new h6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Y,W=J==="ECONNREFUSED"?new h6.errors.ConnectionError("connection refused",{cause:Y}):Y;throw this.socket?.destroy(),W}}dial($){let Z=(0,h6.deferred)(),X,Q=(0,U$6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(G)=>{X=G}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,h6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=h6.DataBuffer.concat(...this.yields),G=(0,h6.extractProtocolMessage)(Q);if(G!=="")try{let Y=h6.INFO.exec(G);if(!Y)throw Error("unexpected response from server");let J=JSON.parse(Y[1]);$.resolve(J)}catch(Y){$.reject(Y)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,h6.deferred)();try{if($=(0,w$6.resolve)($),!(0,J_$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,J_$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:G,keyFile:Y,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(Y){let W=await this.loadFile(Y);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(G)$.ca=G;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let G=await this.loadClientCerts()||{};X=(0,h6.extend)(X,this.options.tls,G)}catch(G){return Promise.reject(new h6.errors.ConnectionError(G.message,{cause:G}))}let Q=(0,h6.deferred)();try{let G=(0,B81.connect)($.port,$.hostname,X,()=>{G.removeAllListeners(),Q.resolve(G)});G.on("error",(Y)=>{Z=Y}),G.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!G.authorized)throw G.authorizationError}),G.on("close",()=>{Q.reject(Z),G.removeAllListeners()}),G.setNoDelay(!0)}catch(G){Q.reject(new h6.errors.ConnectionError(G.message,{cause:G}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,h6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new h6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,h6.deferred)();try{let Q=(0,B81.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(G)=>{$=G}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new h6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,h6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,h6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof B81.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,h6.render)($)}`);let Z=(0,h6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,h6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,h6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}_K.NodeTransport=W_$;function L$6($){let Z=(0,h6.deferred)();return O$6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let G=[];for(let Y of Q)G.push(Y.address);if(G.length===0)G.push($);Z.resolve(G)}),Z}});var w_$=_((U_$)=>{Object.defineProperty(U_$,"__esModule",{value:!0});U_$.connect=E$6;var N_$=K_$(),H_$=Ao(),F_$=Ao();function E$6($={}){if((0,F_$.hasWsProtocol)($))return Promise.reject(F_$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,H_$.setTransportFactory)({factory:()=>{return new N_$.NodeTransport},dnsResolveFn:N_$.nodeResolveHost}),H_$.NatsConnectionImpl.connect($)}});var O_$=_((oH)=>{var j$6=oH&&oH.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var G=Object.getOwnPropertyDescriptor(Z,X);if(!G||("get"in G?!Z.__esModule:G.writable||G.configurable))G={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,G)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),P$6=oH&&oH.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))j$6(Z,$,X)};Object.defineProperty(oH,"__esModule",{value:!0});oH.connect=void 0;var A$6=w_$();Object.defineProperty(oH,"connect",{enumerable:!0,get:function(){return A$6.connect}});P$6(Ao(),oH)});function E_$($){let Z=$?.connectFn??q$6,X=null,Q=null,G=!1,Y=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function N(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function H(U){(async()=>{for await(let w of U.status())if(w.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(w.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,N()})().catch(()=>{})}async function F(U,w){let O=0;while(!Y)try{X=await Z({servers:U,timeout:I$6,reconnect:!0,maxReconnectAttempts:-1,...w?{authenticator:w}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,H(X),N();return}catch{O++;let D=lQ(R$6,T$6,O-1,2,0.5);await a$(D)}}return{init(U,w){if(G)return;G=!0,Y=!1;let O=w?.creds?B_$.credsAuthenticator(new TextEncoder().encode(w.creds)):void 0;F(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=L_$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(Y=!0,G=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function q$6($){return D_$.connect($)}var B_$,D_$,L_$,T$6=100,R$6=3000,I$6=3000;var z_$=B(()=>{K5();B_$=k(Wh(),1),D_$=k(O_$(),1),L_$=k($B(),1)});function D81($,Z){return`${$}.${Z}`}class L81{cache;constructor($){this.cache=Hg({ttlMs:$?.ttlMs??M$6,maxSize:$?.maxSize??k$6})}async get($,Z){return this.cache.get(D81($,Z))??null}async set($,Z,X){this.cache.set(D81($,Z),X)}async invalidate($,Z){this.cache.delete(D81($,Z))}teardown(){this.cache.clear()}}var M$6=600000,k$6=5000;var j_$=()=>{};function sE0($,Z){return`${$}:${Z}`}function E81($){let Z=Hg({ttlMs:$?.ttlMs??S$6,maxSize:$?.maxSize??V$6}),X=$?.getConnection,Q=crypto.randomUUID(),G=new TextEncoder,Y=new TextDecoder,J=null;function W(K,N){let H=X?.();if(!H)return;try{H.publish(P_$,G.encode(JSON.stringify({organizationId:K,keyId:N,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,N){return Z.get(sE0(K,N))},set(K,N,H){Z.set(sE0(K,N),H)},invalidate(K,N){Z.delete(sE0(K,N)),W(K,N)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(P_$),(async()=>{for await(let N of J)try{let H=JSON.parse(Y.decode(N.data));if(H.originId===Q)continue;Z.delete(sE0(H.organizationId,H.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var P_$="studio.ai-provider-keys.invalidate",S$6=30000,V$6=5000;var A_$=()=>{};class z81{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=T_$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let G of Q)try{let Y=JSON.parse(X.decode(G.data));if(Y.originId===this.originId)continue;if(Y.messageId&&this.hasSeen(Y.messageId))continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of T_$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var T_$;var R_$=B(()=>{T_$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var I_$=($)=>{let Z;return()=>Z??=$()},j81,P81;var q_$=B(()=>{N5();j81=I_$(()=>W8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),P81=I_$(()=>W8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function y$6(){return{name:AH,subjects:[`${KO0}.>`],storage:v3.StorageType.File,max_age:v$6,max_bytes:f$6,max_msgs_per_subject:x$6,discard:v3.DiscardPolicy.Old,retention:v3.RetentionPolicy.Limits,duplicate_window:b$6,num_replicas:1}}class S_${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function M_$($){let Z=k_$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function c$6($,Z){let X=0;return{publish(Q,G,Y,J){Q.publish(G,Y,J?{headers:J}:void 0).catch((W)=>{if(X++,_$6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function l$6($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class A81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=y$6(),X=await dQ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await v3.jetstreamManager($);try{await Q.streams.info(AH),await Q.streams.update(AH,Z)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Q.streams.add(Z);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Q.streams.delete(AH),await Q.streams.add(Z);else throw G}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:l$6});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let G=this.js;if(!G)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let Y=c$6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let N=xK$(Z);G.publish(N.subject,N.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(N)=>{let H=performance.now(),F=ap0(N,{runId:Z}),U=performance.now()-H;if(j81().record(U),P81().add(1,{"org.id":Q??"unknown"}),u$6?.record(U,F.reduce((w,O)=>w+O.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let w of F)Y.publish(G,w.subject,w.data,w.headers?M_$(w.headers):void 0)};return(async()=>{let N=$.getReader(),H=0,F=0,U;try{while(!0){let{done:w,value:O}=await N.read();if(w)break;if(K(O),F++,++H>=64)H=0,await new Promise((D)=>setImmediate(D))}}catch(w){U=w,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,w?.message??w)}finally{if(N.releaseLock(),W(),h$6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Y.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let G=performance.now(),Y=ap0(Z,{runId:$,dedup:X});if(j81().record(performance.now()-G),P81().add(1),Y.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Y)await Q.publish(J.subject,J.data,{...J.headers?{headers:M_$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let G=fK$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(G.subject,G.data,{msgID:G.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let G=X?.deliverPolicy==="new"?v3.DeliverPolicy.New:v3.DeliverPolicy.All,Y=X?.closeOnDone??!1,J=JO($),W;try{W=await(await Q.consumers.get(AH,{filter_subjects:J,deliver_policy:G})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let H=wO0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(NO0()).pipeThrough(HO0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{H.releaseLock()}catch{}},w=!1,O=()=>{if(w)return;w=!0,W.stop(),H.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await H.read();if(L){O(),D.close();return}let z=E;if(z.kind==="done"){if(Y){O(),D.close();return}continue}D.enqueue(z.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(AH,{filter:JO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var v3,k_$,C$6=($)=>{let Z;return()=>Z??=$()},_$6,v$6=86400000000000,b$6=120000000000,f$6=4294967296,x$6=500000,g$6,h$6,u$6;var V_$=B(()=>{K5();sp0();OO0();FO0();N5();q_$();v3=k($B(),1),k_$=k(Wh(),1),_$6=C$6(()=>W8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));g$6=process.env.STREAM_ENCODE_TRACE==="1",h$6=process.env.DECOPILOT_STREAM_TRACE==="1";u$6=g$6?new S_$:null});function eE0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,e3(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var C_$=B(()=>{B8()});class T81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}class R81{taskBoard;contextFactory;options;timer=null;running=!1;cursor=null;constructor($,Z,X={}){this.taskBoard=$;this.contextFactory=Z;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??d$6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??m$6,X=await this.taskBoard.listItemsPendingReview(Z,this.cursor),Q=X.at(-1);this.cursor=X.length===Z&&Q?{updatedAt:Q.updatedAt,id:Q.id}:null;for(let{id:G,organizationId:Y}of X)try{if(await this.reconcileItem(G,Y))$++}catch(J){console.error(`[task-board-review-sweeper] ${G} failed`,J)}}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;for(let J of X.threads){let W=J.lastMessage?Xy(J.lastMessage):null;if(!W)continue;await this.taskBoard.linkPr({taskBoardItemId:$,organizationId:Z,url:W.url,prNumber:W.number,repoOwner:W.owner,repoName:W.repo,connectionId:null})}let Q=await this.taskBoard.listPrs($,Z);if(Q.length===0)return!1;let G=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!G)return!1;let Y=await Promise.all(Q.map(async(J)=>({...J,...await _t0(G,Z,J)})));if(Y.every((J)=>J.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${Y.length} PR(s)) \u2014 proceeding on unknown`);if(!Ct0(Y))return!1;return await PO0(G,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var d$6=60000,m$6=50;var __$=B(()=>{gw0();Mt0();Rp()});import{readdir as i$6,rm as $z0}from"fs/promises";import{join as Zz0}from"path";async function Xz0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-n$6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await xC($);for(let G of Q)if(/^\d{4}$/.test(G))X+=await v_$($,G,Z);else if(!G.startsWith(".")){let Y=Zz0($,G),J=await xC(Y);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await v_$(Y,K,Z)}if((await xC(Y)).length===0)await $z0(Y,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function v_$($,Z,X){let Q=0,G=Zz0($,Z),Y=await xC(G);for(let W of Y){if(!/^\d{2}$/.test(W))continue;let K=Zz0(G,W),N=await xC(K);for(let F of N){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let w=Zz0(K,F);await $z0(w,{recursive:!0,force:!0}),Q++}}if((await xC(K)).length===0)await $z0(K,{recursive:!0,force:!0})}if((await xC(G)).length===0)await $z0(G,{recursive:!0,force:!0});return Q}async function xC($){try{return(await i$6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var n$6=30;var I81=()=>{};import{DBOS as q81,SchedulerMode as p$6}from"@dbos-inc/dbos-sdk";async function o$6(){let $=[sY(),yC(),xK()],Z=0;for(let X of $)try{Z+=await Xz0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function r$6($,Z){await q81.runStep(()=>o$6(),{name:"monitoringRetention"})}function f_$(){if(b_$)return;b_$=!0;let $=q81.registerWorkflow(r$6,{name:"monitoringRetentionWorkflow"});q81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:t$6,mode:p$6.ExactlyOncePerIntervalWhenActive})}var t$6="23 4 * * *",b_$=!1;var x_$=B(()=>{mQ();I81()});function y_$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let G=await Dw.create();G.auth.user={id:X,role:Q.role},G.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let Y=await Ac0($.db,Z,Q.role);return G.boundAuth=Pc0({auth:G.authInstance,headers:new Headers,role:Q.role,permissions:Y,userId:X}),G.access=new rD(X,void 0,G.boundAuth,Q.role,"self"),w50(G,{id:Q.orgId,slug:Q.orgSlug}),G}}var g_$=B(()=>{aD();Ii()});function a$6(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function e$6(){for(let $ of s$6)$()}function h_$($){let Z=[...M81.logs,$];M81={...M81,logs:Z.length>500?Z.slice(-500):Z},e$6()}function k81(){return $86}var M81,s$6,$86=!1;var S81=B(()=>{M81=a$6(),s$6=new Set});import{EventEmitter as Z86}from"events";var V81;var u_$=B(()=>{S81();V81=new Z86;V81.on("request",($)=>{h_$($)})});function c_$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,G=$.req.path;if(G==="/api/auth/get-session"||G.includes("favicon")){await Z();return}let Y="",J=!1;if(G.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let w=xg(U.params.name),O=U.params.arguments||{},D=Object.keys(O).map((E)=>xg(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";Y=`${o6.tool}${w}${o6.dim}(${L})${o6.reset}`}else if(U.method)Y=`${o6.dim}${xg(U.method)}${o6.reset}`}}catch{}}let W=xg(G);if(G.startsWith("/mcp/conn_")){let H=G.split("/")[2]??"";W=`/mcp/${o6.mcp}${xg(H.slice(0,12))}\u2026${o6.reset}`}else if(G==="/mcp")W=`${o6.mcp}/mcp${o6.reset}`;else if(G==="/mcp/registry")W=`${o6.mcp}/mcp/registry${o6.reset}`;let K=Q86(Q),N=J?"\u25C0":"\u2190";if(!k81())console.log(`${o6.dim}${N}${o6.reset} ${K}${Q}${o6.reset} ${W}${Y?` ${Y}`:""}`);try{await Z()}finally{let H=Date.now()-X,F=$.res.status,U=X86(F),w=H<1000?`${H}ms`:`${(H/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!k81())console.log(`${o6.dim}${O}${o6.reset} ${K}${Q}${o6.reset} ${W}${Y?` ${Y}`:""} ${U}${F}${o6.reset} ${o6.duration}${w}${o6.reset}`);V81.emit("request",{method:Q,path:xg(G),status:F,duration:H,timestamp:new Date})}}}var o6,X86=($)=>{if($>=500)return o6.serverError;if($>=400)return o6.clientError;if($>=300)return o6.redirect;return o6.ok},Q86=($)=>{return o6[$]||o6.reset},xg=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var l_$=B(()=>{S81();u_$();o6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as n_$}from"crypto";import{mkdir as G86,readdir as Y86,rm as d_$,stat as p_$}from"fs/promises";import{join as _81,relative as J86}from"path";import{z as L$}from"zod";function o_$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return _81(W86,Z)}function r_$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function C81($,Z){let X=o_$($),Q=r_$(Z);return _81(X,Q)}function K86($,Z,X,Q){let G=d0().encryptionKey||"dev-secret",Y=`${$}:${Z}:${X}:${Q}`;return n_$("sha256",G).update(Y).digest("hex")}function i_$($,Z,X,Q,G){let Y=Math.floor(Date.now()/1000)+Q,J=K86(Z,X,Y,G),W=new URL(`/api/dev-assets/${Z}/${r_$(X)}`,$);return W.searchParams.set("expires",Y.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",G),W.toString()}function a_$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${n_$("md5","etag").update(Q).digest("hex")}"`}async function s_$($,Z,X,Q,G){try{let Y=await Y86($,{withFileTypes:!0});for(let J of Y){let W=_81($,J.name),N=J86(Z,W).replace(/\\/g,"/");if(X&&!N.startsWith(X))continue;if(J.isDirectory())if(Q){let H=N+"/";if(!X||H.startsWith(X)){if(!(X?N.slice(X.length):N).includes("/"))G.commonPrefixes.add(H)}}else await s_$(W,Z,X,Q,G);else if(J.isFile()){if(Q&&X){let H=N.slice(X.length);if(H.includes(Q)){let F=H.indexOf(Q),U=X+H.slice(0,F+1);G.commonPrefixes.add(U);continue}}try{let H=await p_$(W);G.objects.push({key:N,size:H.size,lastModified:H.mtime.toISOString(),etag:a_$(W,H.mtime,H.size)})}catch{}}}}catch{}}function e_$($,Z){let Q=a($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:L$.object({prefix:L$.string().optional(),maxKeys:L$.number().optional().default(1000),continuationToken:L$.string().optional(),delimiter:L$.string().optional()}),outputSchema:L$.object({objects:L$.array(L$.object({key:L$.string(),size:L$.number(),lastModified:L$.string(),etag:L$.string()})),nextContinuationToken:L$.string().optional(),isTruncated:L$.boolean(),commonPrefixes:L$.array(L$.string()).optional()}),handler:async(G)=>{let Y=G,J=Y.prefix||"",W=Y.maxKeys??1000,K=Y.delimiter,N=Y.continuationToken,H=o_$(Q);await G86(H,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await s_$(H,H,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(N){if(U=F.objects.findIndex((L)=>L.key>N),U===-1)U=F.objects.length}let w=F.objects.slice(U,U+W),O=U+W<F.objects.length,D=O?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:O,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({contentType:L$.string().optional(),contentLength:L$.number(),lastModified:L$.string(),etag:L$.string(),metadata:L$.record(L$.string(),L$.string()).optional()}),handler:async(G)=>{let Y=G,J=C81(Q,Y.key),W=await p_$(J);return{contentType:q11(Y.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:a_$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(G)=>{let Y=G,J=Y.expiresIn??m_$;return{url:i_$(Z,Q,Y.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional(),contentType:L$.string().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(G)=>{let Y=G,J=Y.expiresIn??m_$;return{url:i_$(Z,Q,Y.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({success:L$.boolean(),key:L$.string()}),handler:async(G)=>{let Y=G,J=C81(Q,Y.key);try{return await d_$(J),{success:!0,key:Y.key}}catch{return{success:!1,key:Y.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:L$.object({keys:L$.array(L$.string()).max(1000)}),outputSchema:L$.object({deleted:L$.array(L$.string()),errors:L$.array(L$.object({key:L$.string(),message:L$.string()}))}),handler:async(G)=>{let Y=G,J=[],W=[];return await Promise.all(Y.keys.map(async(K)=>{let N=C81(Q,K);try{await d_$(N),J.push(K)}catch(H){W.push({key:K,message:H instanceof Error?H.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function v81($,Z,X){let Q=e_$(Z,X),G=new NW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:$5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:L$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:L$.object({}).shape;G.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(N)=>{try{let H=await J.handler(N);return{content:[{type:"text",text:JSON.stringify(H)}],structuredContent:H}}catch(H){return{content:[{type:"text",text:`Error: ${H.message}`}],isError:!0}}})}let Y=new hX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await G.connect(Y),hY(G,Y,$,"mcp:dev-assets")}async function $v$($,Z,X,Q){let Y=e_$(X,Q).find((J)=>J.name===$);if(!Y)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Y.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var W86="./data/assets",m_$=3600,t_$,Zv$;var Xv$=B(()=>{V$();By();u8();Jl();cV();TX();wE0();t_$=new D1;t_$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return v81($.req.raw,Z,Q)});Zv$=t_$});var Qv$={};N4(Qv$,{mountDevRoutes:()=>N86});function N86($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let G=Q.get("studioContext"),Y=new URL(Q.req.url),J=`${Y.protocol}//${Y.host}`;return v81(Q.req.raw,G,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let G=Q.get("studioContext"),Y=new URL(Q.req.url),J=`${Y.protocol}//${Y.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),N=await $v$(W,K,G,J);if(N.isError)return Q.json(N.content,500);return Q.json(N.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Zv$);let X=new D1;X.use("*",V3({mountPath:"/api/dev-assets"})),X.route("/",UE0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var Gv$=B(()=>{u8();E11();wE0();Xv$()});import{sql as H86}from"kysely";import{randomUUID as Yv$}from"crypto";import{z as F86}from"zod";async function w86($){let Z=new Date().toISOString(),X=Yv$(),Q=x4.SELF($.organizationId),G="registry.publish_request.created",Y={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Y),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:Yv$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await H86`SELECT
       pg_notify('studio_events', ${X}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.188.5",
+  "version": "4.189.0",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/decopilot-sse-pool-qyhyktlG.js DELETED Viewed

@@ -1 +0,0 @@

- import"./index-Ds0RoHlz.js";import{e as g}from"./backoff-CrEUbyZT.js";const k={STEP:"decopilot.step",FINISH:"decopilot.finish",THREAD_STATUS:"decopilot.thread.status"},w=Object.values(k),U="super-agent";function $(r){return r.createdBy==="system"}const N={qa:"QA Agent",code_review:"Code Reviewer"};function Y(r,s){return r?.startsWith(`${N[s]}:`)??!1}function R(r){let s=0;for(const l of r)l.action==="status_changed"&&l.data?.to==="in_review"&&(s=Math.max(s,new Date(l.occurredAt).getTime()));return s}function M(r,s){const l=R(r),a=new Map;for(const o of r){if(o.action!=="review_approved"&&o.action!=="review_changes_requested"||new Date(o.occurredAt).getTime()<l)continue;const i=o.data??{};i.reviewer!=="qa"&&i.reviewer!=="code_review"||(o.action==="review_approved"?a.set(i.reviewer,"approved"):a.set(i.reviewer,"changes_requested"))}return a}function x(r,s,l){if(s.length===0)return!1;const a=M(r);return s.every(o=>a.get(o)==="approved")}const S="task-board.item.updated",_="task-board.item.deleted",O=3e4,I=1e3;function P(r){const{buildUrl:s,eventTypes:l,name:a,crossTab:o=!1}=r,i=new Map,d=o&&typeof BroadcastChannel<"u"&&typeof navigator<"u"&&typeof navigator.locks<"u";if(d&&!a)throw new Error("createSSESubscription: `name` is required when crossTab");function f(e,t){e.bootDone=!0;for(const n of e.handlers)try{n(t)}catch{}}function p(e){for(const t of e.reconnectHandlers)try{t()}catch{}}function E(e){const t=new EventSource(s(e.key));e.es=t,t.onopen=()=>{e.reconnectAttempt=0,e.bootDone&&(p(e),e.channel?.postMessage({kind:"reconnect"})),e.bootDone=!0},t.onerror=()=>{e.es===t&&t.readyState===EventSource.CLOSED&&C(e)};const n=u=>{e.channel?.postMessage({kind:"event",type:u.type,data:u.data}),f(e,u)};for(const u of l)t.addEventListener(u,n)}function C(e){if(e.refCount<=0||e.reconnectTimer)return;const t=g(O,I,e.reconnectAttempt,2,0);e.reconnectAttempt++,e.reconnectTimer=setTimeout(()=>{e.reconnectTimer=null,!(e.refCount<=0||!e.isLeader)&&(e.es?.close(),E(e))},t)}function T(e){if(e.refCount<=0){e.releaseLeadership?.(),e.releaseLeadership=null;return}e.isLeader=!0,E(e)}function m(e){if(!d){T(e);return}e.lockAbort=new AbortController,navigator.locks.request(`sse-leader:${a}:${e.key}`,{signal:e.lockAbort.signal},()=>new Promise(t=>{e.releaseLeadership=t,T(e)})).catch(()=>{})}function L(e,t){t.kind==="event"?f(e,new MessageEvent(t.type,{data:t.data})):t.kind==="reconnect"&&p(e)}function y(e){const t=i.get(e);if(t)return t;const n={key:e,refCount:0,handlers:new Set,reconnectHandlers:new Set,bootDone:!1,es:null,isLeader:!1,reconnectAttempt:0,reconnectTimer:null,channel:null,lockAbort:null,releaseLeadership:null};if(i.set(e,n),d){const u=new BroadcastChannel(`sse:${a}:${e}`);u.onmessage=c=>L(n,c.data),n.channel=u}return n}function D(e){e.reconnectTimer&&(clearTimeout(e.reconnectTimer),e.reconnectTimer=null),e.es?.close(),e.es=null,e.releaseLeadership?.(),e.releaseLeadership=null,e.lockAbort?.abort(),e.lockAbort=null,e.channel?.close(),e.channel=null,i.delete(e.key)}return{subscribe(e,t,n){const u=!i.has(e),c=y(e);c.refCount++,c.handlers.add(t),n&&c.reconnectHandlers.add(n),u&&m(c);let h=!1;return()=>{h||(h=!0,c.handlers.delete(t),n&&c.reconnectHandlers.delete(n),c.refCount--,c.refCount<=0&&D(c))}}}}function v(r,s){const l=new Set(s);return{subscribe(a,o,i){const d=f=>{l.has(f.type)&&o(f)};return r.subscribe(a,d,i)}}}const A=[...w,S,_],B=A,H=A,b=P({name:"watch",buildUrl:r=>`/api/${encodeURIComponent(r)}/watch?types=${B.join(",")}`,eventTypes:H,crossTab:!0}),V=v(b,[...w]),j=v(b,[S,_]),G=V;export{k as D,U as S,_ as T,x as a,Y as b,G as d,$ as i,j as t};