npm - decocms - Versions diffs - 4.192.9 → 4.193.0 - Mend

decocms 4.192.9 → 4.193.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (221) hide show

package/dist/server/server.js CHANGED Viewed

@@ -1555,7 +1555,7 @@ Use this to continue with the user's request \u2014 do NOT call subtask again fo
 Task description:
 ${Z.description}
 `:"","How to work:",`- Call \`${K}\` with the task id below to find the pull request under review.`,J?`- The repository ${J.owner}/${J.name} is already cloned at your working directory and \`git\` and \`gh\` are authenticated \u2014 check the PR's branch out there to inspect / exercise the change.`:W?"- Your working directory is EMPTY. Call `mcp__studio__TASK_ADD_REPO` with the connectionId of the PR's repository FIRST; it clones the repository and waits for the checkout, and `git` and `gh` are authenticated once it returns.":"- Load the PR's repository to inspect / exercise the change.",`- End the run by calling \`${H}\` exactly once with the task id, reviewer "${X}", the reviewToken below, and your decision:`,"  - `approve` when it's good to ship. Include a short summary of what you verified.","  - `request_changes` when something is wrong or missing. Include specific, actionable notes \u2014 the task goes back to the Super Agent with your notes.","- The reviewToken proves you are this reviewer \u2014 pass it through EXACTLY as given. Without it your approval won't count toward an automatic merge.",`- \`${H}\` is how the verdict is recorded. A review that ends without it is thrown away and the task stays stuck In Review, so call it even when your notes are short.`,"",`(task id: ${Z.id})`,`(reviewToken: ${Q})`].join(`
-`);await kp($,Z,{runClass:"reviewer",title:`${Xm[X]}: ${Z.title}`,prompt:F,temperature:0.3,...W?{harnessId:"claude-code",agent:{instructions:N,disallowedTools:AF4[X]}}:{},...J?{repo:J}:{}}),await kZ($,{taskBoardItemId:Z.id,action:"review_requested",actorId:null,data:{reviewer:X}});let U=await $.storage.taskBoard.getById(Z.id,Y);if(U)I6(Y,U)}var JN$,AF4,TF4,RF4=2;var ht0=B(()=>{b7();UK();MZ();xt0();gt0();JN$=new Set(["completed","failed","expired"]),AF4={qa:["Edit","NotebookEdit"],code_review:["Write","Edit","NotebookEdit"]},TF4={qa:"You are the QA Agent. Your job is to confirm the task ACTUALLY SOLVED THE "+"PROBLEM \u2014 not to review code style. Exercise the feature/behavior the task "+"describes (use the PR's preview / dev server when available), check the acceptance criteria implied by the title and description, and look for regressions in the affected flow. Judge outcomes, not the diff.",code_review:"You are the Code Reviewer. Review the code changes for correctness, security, and quality. FIRST look for a review skill/command appropriate to this repository's stack (e.g. a `/review`, `code-review`, or `security-review` skill, or the repo's CONTRIBUTING/review guidelines) and use it. Read the diff critically and flag concrete issues with file/line references."}});function SF4($){return $.filter((X)=>X.action==="merge_conflict_resolution").length>=WN$}async function SO0($,Z,X,Q){if(X.status!=="in_review")return!1;if(X.assigneeId!==p4)return!1;if(Q.conflict!==!0)return!1;let G=(await $.storage.organizationSettings.get(Z))?.flags??{};if(G.auto_merge!==!0)return!1;let J=mJ.filter((N)=>G[Zw[N]]===!0),W=await $.storage.taskBoard.listActivity(X.id,Z);if(!Sf(W,J,{verifiedOnly:!0}))return!1;if(SF4(W))return console.warn(`[task-board] conflict auto-resolve cap (${WN$}) reached on task ${X.id} \u2014 leaving the PR for a human`),!1;let K=Q.pr,H=await $.storage.taskBoard.claimConflictResolution(X.id,Z,X.updatedBy);if(!H)return!1;await kZ($,{taskBoardItemId:X.id,action:"merge_conflict_resolution",actorId:null,data:{prNumber:K.number}}),I6(Z,H);try{await qN($,H,{pr:{number:K.number,url:K.url},resolveConflict:!0})}catch(N){throw await $.storage.taskBoard.update(H.id,Z,{status:"in_review"},"system").then((F)=>I6(Z,F)).catch((F)=>console.error("[task-board] conflict-resolution status revert failed",F)),N}return!0}var WN$=3;var ut0=B(()=>{b7();UK();MZ();NO()});import{z as VO0}from"zod";function VF4($){let Z=$ instanceof Error?$.message:String($);return/too many requests|rate limit|\b429\b/i.test(Z)}function HN$($){KN$.invalidate($)}async function it0($,Z,X,Q,Y){try{let G=await KN$.fetch({type:"tools/call",connectionId:Z,scope:{kind:"org"},params:{name:X,arguments:Q},fetchLive:()=>fZ(async()=>{let J=await $.callTool({name:X,arguments:Q},void 0,{timeout:CO0});if(J&&typeof J==="object"&&J.isError)throw Error(J.content?.[0]?.text??`${X} returned isError`);return J},{maxAttempts:3,minTimeout:300,maxTimeout:3000,jitter:1,isRetriable:(J)=>!VF4(J)})});return _O0(G)}catch(G){let J=G instanceof aG?G.cause:G;return console.error(`[task-board] ${X} failed for ${Y}:`,J),null}}async function wy($,Z,X,Q){if(X){let J=await $.storage.connections.findById(X,Z);if(J&&J.status==="active")return J}let{items:Y}=await $.storage.connections.list(Z,{slug:"mcp-github"}),G=Y.filter((J)=>J.status==="active");if(Q){let J=G.find((W)=>{let K=_X(W);return K?.owner===Q.owner&&K?.repo===Q.name});if(J)return J}return G.find((J)=>_X(J)===null)??G[0]??null}function _O0($){if(!$||typeof $!=="object")return null;let Z=$;if(Z.isError)return null;if(Z.structuredContent&&typeof Z.structuredContent==="object"&&Object.keys(Z.structuredContent).length>0)return Z.structuredContent;let X=Z.content?.find((Q)=>Q.type==="text")?.text;if(!X)return null;try{return JSON.parse(X)}catch{return null}}function dt0($){let Z;try{Z=new URL($).hostname.toLowerCase()}catch{return!1}return Z==="deco.site"||Z.endsWith(".decocdn.com")||Z.endsWith(".deco-cx.workers.dev")||Z.endsWith(".deco.site")||Z.endsWith(".vercel.app")||Z.endsWith(".preview.vtex.app")}function CF4($){if(!$||!Array.isArray($.statuses))return null;let Z=$.statuses.map((X)=>X&&typeof X==="object"?X:null).filter((X)=>!!X&&typeof X.target_url==="string"&&dt0(X.target_url));if(Z.length===0)return null;return Z.find((X)=>X.state==="success")?.target_url??Z[0].target_url}function _F4($){let Z=Array.isArray($)?$:Array.isArray($?.comments)?$.comments:Array.isArray($?.items)?$.items:[],X=(Y)=>{let G=Y;return Date.parse(G?.updated_at)||Date.parse(G?.created_at)},Q=Z.map((Y,G)=>({c:Y,index:G})).sort((Y,G)=>{let J=X(Y.c),W=X(G.c);if(Number.isNaN(J)||Number.isNaN(W))return Y.index-G.index;return W-J}).map(({c:Y})=>Y);for(let Y of Q){let G=Y&&typeof Y.body==="string"?Y.body:"";if(!G)continue;let J=G.match(/href=['"]([^'"]+)['"][^>]*>\s*Branch Preview/i);if(J?.[1]&&dt0(J[1]))return J[1];let W=(G.match(/https?:\/\/[^\s"'<>)\]]+/g)??[]).find((K)=>dt0(K));if(W)return W}return null}function NN$($){if(!$)return null;if((typeof $.total_count==="number"?$.total_count:null)===0)return null;switch($.state){case"success":return"passing";case"failure":case"error":return"failing";case"pending":return"pending";default:return null}}function UN$($){let Z=Array.isArray($)?$:Array.isArray($?.check_runs)?$.check_runs:[];if(Z.length===0)return null;let X=!1,Q=!1;for(let Y of Z){if(!Y||typeof Y!=="object")continue;let{status:G,conclusion:J}=Y;if(G!=="completed")Q=!0;else if(typeof J==="string"&&FN$.has(J))X=!0}if(X)return"failing";if(Q)return"pending";return"passing"}function wN$($,Z){if($==="failing"||Z==="failing")return"failing";if($==="pending"||Z==="pending")return"pending";if($==="passing"||Z==="passing")return"passing";return null}function vF4($){let Z=Array.isArray($)?$:Array.isArray($?.check_runs)?$.check_runs:[],X=[];for(let Q of Z){if(!Q||typeof Q!=="object")continue;let Y=Q;X.push({id:typeof Y.id==="number"?Y.id:null,name:typeof Y.name==="string"?Y.name:"",status:typeof Y.status==="string"?Y.status:"completed",conclusion:typeof Y.conclusion==="string"?Y.conclusion:null,detailsUrl:typeof Y.html_url==="string"?Y.html_url:typeof Y.details_url==="string"?Y.details_url:null})}return X}function bF4($){return $.status==="completed"&&$.conclusion!=null&&FN$.has($.conclusion)}async function fF4($,Z,X,Q){let G=(await it0($,Z,"GET_CHECK_RUN",{owner:X.repoOwner,repo:X.repoName,checkRunId:Q},`${mt0(X)} check-run ${Q}`))?.output,J=typeof G?.summary==="string"?G.summary:null,W=typeof G?.text==="string"?G.text:null;return J??W??null}async function ON$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0),G=async(J)=>_O0(await Y.callTool({name:"pull_request_read",arguments:{method:J,owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0}));try{let J=null;try{J=NN$(await G("get_status"))}catch{}try{J=wN$(J,UN$(await G("get_check_runs")))}catch{}return J}finally{await Y.close().catch(()=>{})}}function BN$($){if(!$)return null;if($.state!=="open")return!1;return typeof $.mergeable==="boolean"?!$.mergeable:null}async function DN$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0);try{return BN$(_O0(await Y.callTool({name:"pull_request_read",arguments:{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0})))}catch{return null}finally{await Y.close().catch(()=>{})}}async function xF4($,Z,X){let Q=(N)=>it0($,Z,"pull_request_read",{method:N,owner:X.repoOwner,repo:X.repoName,pullNumber:X.number},`${mt0(X)} (${N})`),[Y,G,J]=await Promise.all([Q("get_status"),Q("get_check_runs"),Q("get_comments")]),W=wN$(NN$(Y),UN$(G)),K=CF4(Y)??_F4(J),H=await Promise.all(vF4(G).map(async(N)=>({name:N.name,status:N.status,conclusion:N.conclusion,detailsUrl:N.detailsUrl,summary:bF4(N)&&N.id!=null?await fF4($,Z,X,N.id):null})));return{checksStatus:W,checks:H,previewUrl:K}}async function pt0($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return lt0;let Y=await D5(Q,$,!0);try{let[G,J]=await Promise.all([it0(Y,Q.id,"pull_request_read",{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number},`${mt0(X)} (get)`),xF4(Y,Q.id,X)]);if(!G)return lt0;let W=G.state,K=W==="open";return{title:typeof G.title==="string"?G.title:null,body:typeof G.body==="string"?G.body:null,state:W==="closed"?"closed":K?"open":null,draft:typeof G.draft==="boolean"?G.draft:null,merged:typeof G.merged==="boolean"?G.merged:null,mergeable:K&&typeof G.mergeable==="boolean"?G.mergeable:null,checksStatus:K?J.checksStatus:null,checks:K?J.checks:[],previewUrl:K?J.previewUrl:null}}catch{return lt0}finally{await Y.close().catch(()=>{})}}async function LN$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0);try{let G=_O0(await Y.callTool({name:"pull_request_read",arguments:{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0}));if(!G||G.state!=="open")return null;let J=G.head?.ref;return typeof J==="string"&&J.length>0?J:null}catch{return null}finally{await Y.close().catch(()=>{})}}var CO0=8000,ct0,KN$,mt0=($)=>`${$.repoOwner}/${$.repoName}#${$.number}`,lt0,FN$,nt0=($)=>{let Z=$.find((X)=>X.state!=="closed"&&X.merged!==!0);return Z!=null&&Z.checksStatus!=="pending"&&Z.checksStatus!=="failing"},tt0;var Oy=B(()=>{b0();XN();dW();b7();B6();td();JK();UK();MZ();ht0();ut0();ct0={revalidateAfterMs:55000,maxStaleMs:1800000,maxValueBytes:524288},KN$=new n40({"tools/call":ct0,"resources/read":ct0,"prompts/get":ct0});lt0={title:null,body:null,state:null,draft:null,merged:null,mergeable:null,checksStatus:null,checks:[],previewUrl:null};FN$=new Set(["failure","cancelled","timed_out","action_required","startup_failure","stale"]);tt0=d({name:"TASK_BOARD_ITEM_PRS_GET",description:"Get the GitHub pull requests linked to a task board item, each enriched with live state (title, open/closed, draft, merged) fetched from GitHub.",annotations:{title:"Get Task Board Item Pull Requests",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:VO0.object({taskBoardItemId:VO0.string()}),outputSchema:VO0.object({prs:VO0.array(NJ$)}),handler:async({taskBoardItemId:$},Z)=>{$0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.taskBoard.getById($,X),Y=await Z.storage.taskBoard.listPrs($,X),G=await Promise.all(Y.map(async(K)=>{let H=await pt0(Z,X,K);return{url:K.url,number:K.number,repoOwner:K.repoOwner,repoName:K.repoName,createdAt:K.createdAt,...H}})),J=G.find((K)=>K.state==="open"&&!K.merged);if(Q&&Q.status==="in_review"&&Q.assigneeId===p4&&nt0(G))await kO0(Z,Q).catch((K)=>{console.error("[task-board] reviewer auto-handoff failed",K)});let W=J?BN$({state:J.state,mergeable:J.mergeable}):null;if(Q&&Q.status==="in_review"&&Q.assigneeId===p4&&J&&W===!0)await SO0(Z,X,Q,{pr:{number:J.number,url:J.url},conflict:!0}).catch((K)=>{console.error("[task-board] conflict auto-resolve failed",K)});if(G.some((K)=>K.merged))try{if(Q&&Q.status!=="done"){let K=await Z.storage.taskBoard.update($,X,{status:"done"},Q.updatedBy);await kZ(Z,{taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:Q.status,to:"done"}}),I6(X,K)}}catch(K){console.error("[task-board] merge\u2192done reconcile failed",K)}return{prs:G}}})});async function By($,Z){if(Z.assigneeId!==p4)return;await qN($,Z).catch((X)=>{if(X instanceof DG)throw X;console.error("[task-board] Super Agent enqueue failed",X)})}function yF4($,Z){return["You've been assigned this task. Complete it.","","You are running AUTONOMOUSLY \u2014 no human is watching this run, so drive it "+"to completion on your own. Use `user_ask` ONLY for a genuine, unresolvable blocker a human must clear (a missing credential/secret, or "+"a decision so ambiguous you truly cannot proceed) \u2014 that should be rare. "+"Do not ask for confirmation of a reasonable choice; make it and move on.","",`Title: ${$.title}`,$.description?`
+`);await kp($,Z,{runClass:"reviewer",title:`${Xm[X]}: ${Z.title}`,prompt:F,temperature:0.3,...W?{harnessId:"claude-code",agent:{instructions:N,disallowedTools:AF4[X]}}:{},...J?{repo:J}:{}}),await kZ($,{taskBoardItemId:Z.id,action:"review_requested",actorId:null,data:{reviewer:X}});let U=await $.storage.taskBoard.getById(Z.id,Y);if(U)I6(Y,U)}var JN$,AF4,TF4,RF4=2;var ht0=B(()=>{b7();UK();MZ();xt0();gt0();JN$=new Set(["completed","failed","expired"]),AF4={qa:["Edit","NotebookEdit"],code_review:["Write","Edit","NotebookEdit"]},TF4={qa:"You are the QA Agent. Your job is to confirm the task ACTUALLY SOLVED THE "+"PROBLEM \u2014 not to review code style. Exercise the feature/behavior the task "+"describes (use the PR's preview / dev server when available), check the acceptance criteria implied by the title and description, and look for regressions in the affected flow. Judge outcomes, not the diff.",code_review:"You are the Code Reviewer. Review the code changes for correctness, security, and quality. FIRST look for a review skill/command appropriate to this repository's stack (e.g. a `/review`, `code-review`, or `security-review` skill, or the repo's CONTRIBUTING/review guidelines) and use it. Read the diff critically and flag concrete issues with file/line references."}});function SF4($){return $.filter((X)=>X.action==="merge_conflict_resolution").length>=WN$}async function SO0($,Z,X,Q){if(X.status!=="in_review")return!1;if(X.assigneeId!==p4)return!1;if(Q.conflict!==!0)return!1;let G=(await $.storage.organizationSettings.get(Z))?.flags??{};if(G.auto_merge!==!0)return!1;let J=mJ.filter((N)=>G[Zw[N]]===!0),W=await $.storage.taskBoard.listActivity(X.id,Z);if(!Sf(W,J,{verifiedOnly:!0}))return!1;if(SF4(W))return console.warn(`[task-board] conflict auto-resolve cap (${WN$}) reached on task ${X.id} \u2014 leaving the PR for a human`),!1;let K=Q.pr,H=await $.storage.taskBoard.claimConflictResolution(X.id,Z,X.updatedBy);if(!H)return!1;await kZ($,{taskBoardItemId:X.id,action:"merge_conflict_resolution",actorId:null,data:{prNumber:K.number}}),I6(Z,H);try{await qN($,H,{pr:{number:K.number,url:K.url},resolveConflict:!0})}catch(N){throw await $.storage.taskBoard.update(H.id,Z,{status:"in_review"},"system").then((F)=>I6(Z,F)).catch((F)=>console.error("[task-board] conflict-resolution status revert failed",F)),N}return!0}var WN$=3;var ut0=B(()=>{b7();UK();MZ();NO()});import{z as VO0}from"zod";function VF4($){let Z=$ instanceof Error?$.message:String($);return/too many requests|rate limit|\b429\b/i.test(Z)}function HN$($){KN$.invalidate($)}async function it0($,Z,X,Q,Y,G){try{let J=await KN$.fetch({type:"tools/call",connectionId:Z,scope:{kind:"org"},params:{name:X,arguments:Q},fetchLive:()=>fZ(async()=>{let W=await $.callTool({name:X,arguments:Q},void 0,{timeout:CO0});if(W&&typeof W==="object"&&W.isError)throw Error(W.content?.[0]?.text??`${X} returned isError`);return W},{maxAttempts:3,minTimeout:300,maxTimeout:3000,jitter:1,isRetriable:(W)=>!VF4(W)}),onRevalidation:(W)=>G.push(W)});return _O0(J)}catch(J){let W=J instanceof aG?J.cause:J;return console.error(`[task-board] ${X} failed for ${Y}:`,W),null}}async function wy($,Z,X,Q){if(X){let J=await $.storage.connections.findById(X,Z);if(J&&J.status==="active")return J}let{items:Y}=await $.storage.connections.list(Z,{slug:"mcp-github"}),G=Y.filter((J)=>J.status==="active");if(Q){let J=G.find((W)=>{let K=_X(W);return K?.owner===Q.owner&&K?.repo===Q.name});if(J)return J}return G.find((J)=>_X(J)===null)??G[0]??null}function _O0($){if(!$||typeof $!=="object")return null;let Z=$;if(Z.isError)return null;if(Z.structuredContent&&typeof Z.structuredContent==="object"&&Object.keys(Z.structuredContent).length>0)return Z.structuredContent;let X=Z.content?.find((Q)=>Q.type==="text")?.text;if(!X)return null;try{return JSON.parse(X)}catch{return null}}function dt0($){let Z;try{Z=new URL($).hostname.toLowerCase()}catch{return!1}return Z==="deco.site"||Z.endsWith(".decocdn.com")||Z.endsWith(".deco-cx.workers.dev")||Z.endsWith(".deco.site")||Z.endsWith(".vercel.app")||Z.endsWith(".preview.vtex.app")}function CF4($){if(!$||!Array.isArray($.statuses))return null;let Z=$.statuses.map((X)=>X&&typeof X==="object"?X:null).filter((X)=>!!X&&typeof X.target_url==="string"&&dt0(X.target_url));if(Z.length===0)return null;return Z.find((X)=>X.state==="success")?.target_url??Z[0].target_url}function _F4($){let Z=Array.isArray($)?$:Array.isArray($?.comments)?$.comments:Array.isArray($?.items)?$.items:[],X=(Y)=>{let G=Y;return Date.parse(G?.updated_at)||Date.parse(G?.created_at)},Q=Z.map((Y,G)=>({c:Y,index:G})).sort((Y,G)=>{let J=X(Y.c),W=X(G.c);if(Number.isNaN(J)||Number.isNaN(W))return Y.index-G.index;return W-J}).map(({c:Y})=>Y);for(let Y of Q){let G=Y&&typeof Y.body==="string"?Y.body:"";if(!G)continue;let J=G.match(/href=['"]([^'"]+)['"][^>]*>\s*Branch Preview/i);if(J?.[1]&&dt0(J[1]))return J[1];let W=(G.match(/https?:\/\/[^\s"'<>)\]]+/g)??[]).find((K)=>dt0(K));if(W)return W}return null}function NN$($){if(!$)return null;if((typeof $.total_count==="number"?$.total_count:null)===0)return null;switch($.state){case"success":return"passing";case"failure":case"error":return"failing";case"pending":return"pending";default:return null}}function UN$($){let Z=Array.isArray($)?$:Array.isArray($?.check_runs)?$.check_runs:[];if(Z.length===0)return null;let X=!1,Q=!1;for(let Y of Z){if(!Y||typeof Y!=="object")continue;let{status:G,conclusion:J}=Y;if(G!=="completed")Q=!0;else if(typeof J==="string"&&FN$.has(J))X=!0}if(X)return"failing";if(Q)return"pending";return"passing"}function wN$($,Z){if($==="failing"||Z==="failing")return"failing";if($==="pending"||Z==="pending")return"pending";if($==="passing"||Z==="passing")return"passing";return null}function vF4($){let Z=Array.isArray($)?$:Array.isArray($?.check_runs)?$.check_runs:[],X=[];for(let Q of Z){if(!Q||typeof Q!=="object")continue;let Y=Q;X.push({id:typeof Y.id==="number"?Y.id:null,name:typeof Y.name==="string"?Y.name:"",status:typeof Y.status==="string"?Y.status:"completed",conclusion:typeof Y.conclusion==="string"?Y.conclusion:null,detailsUrl:typeof Y.html_url==="string"?Y.html_url:typeof Y.details_url==="string"?Y.details_url:null})}return X}function bF4($){return $.status==="completed"&&$.conclusion!=null&&FN$.has($.conclusion)}async function fF4($,Z,X,Q,Y){let J=(await it0($,Z,"GET_CHECK_RUN",{owner:X.repoOwner,repo:X.repoName,checkRunId:Q},`${mt0(X)} check-run ${Q}`,Y))?.output,W=typeof J?.summary==="string"?J.summary:null,K=typeof J?.text==="string"?J.text:null;return W??K??null}async function ON$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0),G=async(J)=>_O0(await Y.callTool({name:"pull_request_read",arguments:{method:J,owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0}));try{let J=null;try{J=NN$(await G("get_status"))}catch{}try{J=wN$(J,UN$(await G("get_check_runs")))}catch{}return J}finally{await Y.close().catch(()=>{})}}function BN$($){if(!$)return null;if($.state!=="open")return!1;return typeof $.mergeable==="boolean"?!$.mergeable:null}async function DN$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0);try{return BN$(_O0(await Y.callTool({name:"pull_request_read",arguments:{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0})))}catch{return null}finally{await Y.close().catch(()=>{})}}async function xF4($,Z,X,Q){let Y=(F)=>it0($,Z,"pull_request_read",{method:F,owner:X.repoOwner,repo:X.repoName,pullNumber:X.number},`${mt0(X)} (${F})`,Q),[G,J,W]=await Promise.all([Y("get_status"),Y("get_check_runs"),Y("get_comments")]),K=wN$(NN$(G),UN$(J)),H=CF4(G)??_F4(W),N=await Promise.all(vF4(J).map(async(F)=>({name:F.name,status:F.status,conclusion:F.conclusion,detailsUrl:F.detailsUrl,summary:bF4(F)&&F.id!=null?await fF4($,Z,X,F.id,Q):null})));return{checksStatus:K,checks:N,previewUrl:H}}async function pt0($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return lt0;let Y=await D5(Q,$,!0),G=[];try{let[J,W]=await Promise.all([it0(Y,Q.id,"pull_request_read",{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number},`${mt0(X)} (get)`,G),xF4(Y,Q.id,X,G)]);if(!J)return lt0;let K=J.state,H=K==="open";return{title:typeof J.title==="string"?J.title:null,body:typeof J.body==="string"?J.body:null,state:K==="closed"?"closed":H?"open":null,draft:typeof J.draft==="boolean"?J.draft:null,merged:typeof J.merged==="boolean"?J.merged:null,mergeable:H&&typeof J.mergeable==="boolean"?J.mergeable:null,checksStatus:H?W.checksStatus:null,checks:H?W.checks:[],previewUrl:H?W.previewUrl:null}}catch{return lt0}finally{Promise.allSettled(G).then(()=>Y.close().catch(()=>{}))}}async function LN$($,Z,X){let Q=await wy($,Z,X.connectionId,{owner:X.repoOwner,name:X.repoName});if(!Q)return null;let Y=await D5(Q,$,!0);try{let G=_O0(await Y.callTool({name:"pull_request_read",arguments:{method:"get",owner:X.repoOwner,repo:X.repoName,pullNumber:X.number}},void 0,{timeout:CO0}));if(!G||G.state!=="open")return null;let J=G.head?.ref;return typeof J==="string"&&J.length>0?J:null}catch{return null}finally{await Y.close().catch(()=>{})}}var CO0=8000,ct0,KN$,mt0=($)=>`${$.repoOwner}/${$.repoName}#${$.number}`,lt0,FN$,nt0=($)=>{let Z=$.find((X)=>X.state!=="closed"&&X.merged!==!0);return Z!=null&&Z.checksStatus!=="pending"&&Z.checksStatus!=="failing"},tt0;var Oy=B(()=>{b0();XN();dW();b7();B6();td();JK();UK();MZ();ht0();ut0();ct0={revalidateAfterMs:55000,maxStaleMs:1800000,maxValueBytes:524288},KN$=new n40({"tools/call":ct0,"resources/read":ct0,"prompts/get":ct0});lt0={title:null,body:null,state:null,draft:null,merged:null,mergeable:null,checksStatus:null,checks:[],previewUrl:null};FN$=new Set(["failure","cancelled","timed_out","action_required","startup_failure","stale"]);tt0=d({name:"TASK_BOARD_ITEM_PRS_GET",description:"Get the GitHub pull requests linked to a task board item, each enriched with live state (title, open/closed, draft, merged) fetched from GitHub.",annotations:{title:"Get Task Board Item Pull Requests",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:VO0.object({taskBoardItemId:VO0.string()}),outputSchema:VO0.object({prs:VO0.array(NJ$)}),handler:async({taskBoardItemId:$},Z)=>{$0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.taskBoard.getById($,X),Y=await Z.storage.taskBoard.listPrs($,X),G=await Promise.all(Y.map(async(K)=>{let H=await pt0(Z,X,K);return{url:K.url,number:K.number,repoOwner:K.repoOwner,repoName:K.repoName,createdAt:K.createdAt,...H}})),J=G.find((K)=>K.state==="open"&&!K.merged);if(Q&&Q.status==="in_review"&&Q.assigneeId===p4&&nt0(G))await kO0(Z,Q).catch((K)=>{console.error("[task-board] reviewer auto-handoff failed",K)});let W=J?BN$({state:J.state,mergeable:J.mergeable}):null;if(Q&&Q.status==="in_review"&&Q.assigneeId===p4&&J&&W===!0)await SO0(Z,X,Q,{pr:{number:J.number,url:J.url},conflict:!0}).catch((K)=>{console.error("[task-board] conflict auto-resolve failed",K)});if(G.some((K)=>K.merged))try{if(Q&&Q.status!=="done"){let K=await Z.storage.taskBoard.update($,X,{status:"done"},Q.updatedBy);await kZ(Z,{taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:Q.status,to:"done"}}),I6(X,K)}}catch(K){console.error("[task-board] merge\u2192done reconcile failed",K)}return{prs:G}}})});async function By($,Z){if(Z.assigneeId!==p4)return;await qN($,Z).catch((X)=>{if(X instanceof DG)throw X;console.error("[task-board] Super Agent enqueue failed",X)})}function yF4($,Z){return["You've been assigned this task. Complete it.","","You are running AUTONOMOUSLY \u2014 no human is watching this run, so drive it "+"to completion on your own. Use `user_ask` ONLY for a genuine, unresolvable blocker a human must clear (a missing credential/secret, or "+"a decision so ambiguous you truly cannot proceed) \u2014 that should be rare. "+"Do not ask for confirmation of a reasonable choice; make it and move on.","",`Title: ${$.title}`,$.description?`
 Description:
 ${$.description}
 `:"",Z?.resolveConflict&&Z.pr?[`Your pull request #${Z.pr.number} (${Z.pr.url}) is approved but can't be merged \u2014 it has a MERGE CONFLICT with its base branch.`,`Load the repo, CHECK OUT that PR's branch (e.g. \`gh pr checkout ${Z.pr.number}\`), then merge (or rebase) the base branch into it and resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one or start a new branch. Resolve conflicts by preserving BOTH sides' intent; never blindly discard either side. Change only what resolving the conflict requires.`,""].join(`
@@ -2726,7 +2726,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
-Respond with the structured verdict and a short reason.`,$_$;var X_$=B(()=>{S4();ZO();k81();D$6=S81.object({requiresReview:S81.boolean().describe("true if the changes should go through pull-request review"),reason:S81.string().describe("One short sentence explaining the decision (max ~120 chars)")});$_$={requiresReview:!1,reason:""}});function z$6($){if(!$||$.includes(".."))return!1;return j$6.test($)}function Q_$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!z$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Y_$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var j$6;var G_$=B(()=>{j$6=/^[\w./@-]+$/});function V81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function J_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function W_$($,Z,X,Q){if(!Q.connectionId)throw new gg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new gg(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new gg(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Xj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,P$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var P$6=10485760,gg;var K_$=B(()=>{Pw();P81();Jp();Vn();gg=class gg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function T$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!A$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(I$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function C81($,Z){let Q=(Qj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Qj0.set($,Y),Y.finally(()=>{if(Qj0.get($)===Y)Qj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?M$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function M$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Yj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function k$6($){return F_$.includes($)}var A$6,H_$=524288,R$6=65536,I$6=1e4,N_$=2000,q$6,Qj0,xY,F_$,U_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",q$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!k$6(X))return Z.json({error:`step must be one of: ${F_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Kw0(Q.virtualMcpMetadata);try{await Hw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return tC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return C81(Q,async()=>{try{await A81(J,X,Q);let W=J_$(Y,G);if(W)await W_$(J,X,Q,W)}catch(W){if(W instanceof gg)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return C81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return C81(Q,async()=>{try{await A81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await eC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await Z_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=V81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:R$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=Q_$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Y_$(Y,J.resolveType),K=V81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var w_$=B(()=>{v8();gO();yg();mC$();FN();nC$();j3();aw();pC$();oC$();gn0();Gp();k81();X_$();G_$();K_$();A$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;q$6=dC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{T$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=In({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=iC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Qj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};F_$=["clone","install","start"]});var O_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",jE0()),Z.route("/",Mk$()),Z.route("/",VC$()),Z.route("/",MC$()),Z.route("/",eE0()),Z.route("/tools",yC$()),Z.route("/",bC$()),Z.route("/",HC$({kvStorage:$.kvStorage})),Z.route("/",WC$()),Z.route("/fs",zC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",U_$()),Z.route("/",RC$()),Z.route("/deco-sites",PE0()),Z.route("/sso",UE0()),Z.route("/",$j0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",jk$()),$.mountDevAssets)Z.route("/dev-assets",AE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",is1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",AC$()),Z.route("/mcp",pO0()),Z.route("/mcp/self",sE0()),Z.route("/mcp",rO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var B_$=B(()=>{v8();l11();zk$();p11();TE0();st();u11();KC$();NC$();PC$();bi();C11();aO0();O81();TC$();IC$();kC$();CC$();fC$();D81();gC$();L81();tO0();w_$()});function V$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function C$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(S$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var S$6=1e4,_$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},D_$=()=>{let $=new B1;return $.use("*",_$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await C$6(Q,Y);return Z.json({apps:V$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var L_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function l$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function d$6($,Z,X){try{return JSON.parse($)}catch{throw new z_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function m$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:d$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function i$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function n$6($){if(!$)return;return{openai:{response_format:$}}}function p$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function E_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function j_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var v$6=256,b$6,f$6,x$6,y$6,g$6,h$6,u$6,c$6,z_$,P_$,A_$;var T_$=B(()=>{S4();v8();yg();CN();b$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),f$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),x$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(f$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),y$6=M1.object({type:M1.literal("text")}),g$6=M1.object({type:M1.literal("json_object")}),h$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),u$6=M1.union([y$6,g$6,h$6]),c$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(x$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(b$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:u$6.optional(),user:M1.string().optional()});z_$=class z_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};P_$=new B1;P_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=c$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=l$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=m$6(G.messages),U=G.tools?i$6(G.tools):void 0,w=n$6(G.response_format),O=p$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=E_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=v$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:j_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=E_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:j_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});A_$=P_$});var I_$;var R_$=B(()=>{I_$={name:"decocms",version:"4.192.9",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function r$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??o$6}}var q_$,o$6="https://ph.studio.decocms.com",M_$;var k_$=B(()=>{v8();lC0();hV();BZ();S$();q11();R_$();q_$=new B1;q_$.get("/",($)=>{let Z={version:I_$.version,theme:oM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:a21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bM$(),posthog:r$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});M_$=q_$});function hg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _81($){return(hg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function V_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(hg($))}&sz=${Z}`}function S_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function C_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?S_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):S_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,a$6,s$6,e$6,$86,__$;var v_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),a$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),s$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(a$6)),e$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$86=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(s$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),__$=l0.object({...e$6,template:$86})});function Gj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=__$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var v81=B(()=>{v_$()});import{join as b_$}from"path";async function X86($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Z86)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Gj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||_81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Q86($,Z){let X=hg($),Q=Z?.brand?.trim()||_81(X),Y=V_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=C_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
+Respond with the structured verdict and a short reason.`,$_$;var X_$=B(()=>{S4();ZO();k81();D$6=S81.object({requiresReview:S81.boolean().describe("true if the changes should go through pull-request review"),reason:S81.string().describe("One short sentence explaining the decision (max ~120 chars)")});$_$={requiresReview:!1,reason:""}});function z$6($){if(!$||$.includes(".."))return!1;return j$6.test($)}function Q_$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!z$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Y_$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var j$6;var G_$=B(()=>{j$6=/^[\w./@-]+$/});function V81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function J_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function W_$($,Z,X,Q){if(!Q.connectionId)throw new gg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new gg(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new gg(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Xj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,P$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var P$6=10485760,gg;var K_$=B(()=>{Pw();P81();Jp();Vn();gg=class gg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function T$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!A$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(I$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function C81($,Z){let Q=(Qj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Qj0.set($,Y),Y.finally(()=>{if(Qj0.get($)===Y)Qj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?M$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function M$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Yj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function k$6($){return F_$.includes($)}var A$6,H_$=524288,R$6=65536,I$6=1e4,N_$=2000,q$6,Qj0,xY,F_$,U_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",q$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!k$6(X))return Z.json({error:`step must be one of: ${F_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Kw0(Q.virtualMcpMetadata);try{await Hw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return tC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return C81(Q,async()=>{try{await A81(J,X,Q);let W=J_$(Y,G);if(W)await W_$(J,X,Q,W)}catch(W){if(W instanceof gg)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return C81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return C81(Q,async()=>{try{await A81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await eC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await Z_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=V81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:R$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=Q_$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Y_$(Y,J.resolveType),K=V81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var w_$=B(()=>{v8();gO();yg();mC$();FN();nC$();j3();aw();pC$();oC$();gn0();Gp();k81();X_$();G_$();K_$();A$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;q$6=dC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{T$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=In({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=iC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Qj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};F_$=["clone","install","start"]});var O_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",jE0()),Z.route("/",Mk$()),Z.route("/",VC$()),Z.route("/",MC$()),Z.route("/",eE0()),Z.route("/tools",yC$()),Z.route("/",bC$()),Z.route("/",HC$({kvStorage:$.kvStorage})),Z.route("/",WC$()),Z.route("/fs",zC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",U_$()),Z.route("/",RC$()),Z.route("/deco-sites",PE0()),Z.route("/sso",UE0()),Z.route("/",$j0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",jk$()),$.mountDevAssets)Z.route("/dev-assets",AE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",is1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",AC$()),Z.route("/mcp",pO0()),Z.route("/mcp/self",sE0()),Z.route("/mcp",rO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var B_$=B(()=>{v8();l11();zk$();p11();TE0();st();u11();KC$();NC$();PC$();bi();C11();aO0();O81();TC$();IC$();kC$();CC$();fC$();D81();gC$();L81();tO0();w_$()});function V$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function C$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(S$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var S$6=1e4,_$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},D_$=()=>{let $=new B1;return $.use("*",_$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await C$6(Q,Y);return Z.json({apps:V$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var L_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function l$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function d$6($,Z,X){try{return JSON.parse($)}catch{throw new z_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function m$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:d$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function i$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function n$6($){if(!$)return;return{openai:{response_format:$}}}function p$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function E_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function j_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var v$6=256,b$6,f$6,x$6,y$6,g$6,h$6,u$6,c$6,z_$,P_$,A_$;var T_$=B(()=>{S4();v8();yg();CN();b$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),f$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),x$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(f$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),y$6=M1.object({type:M1.literal("text")}),g$6=M1.object({type:M1.literal("json_object")}),h$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),u$6=M1.union([y$6,g$6,h$6]),c$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(x$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(b$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:u$6.optional(),user:M1.string().optional()});z_$=class z_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};P_$=new B1;P_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=c$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=l$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=m$6(G.messages),U=G.tools?i$6(G.tools):void 0,w=n$6(G.response_format),O=p$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=E_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=v$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:j_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=E_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:j_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});A_$=P_$});var I_$;var R_$=B(()=>{I_$={name:"decocms",version:"4.193.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function r$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??o$6}}var q_$,o$6="https://ph.studio.decocms.com",M_$;var k_$=B(()=>{v8();lC0();hV();BZ();S$();q11();R_$();q_$=new B1;q_$.get("/",($)=>{let Z={version:I_$.version,theme:oM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:a21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bM$(),posthog:r$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});M_$=q_$});function hg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _81($){return(hg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function V_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(hg($))}&sz=${Z}`}function S_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function C_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?S_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):S_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,a$6,s$6,e$6,$86,__$;var v_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),a$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),s$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(a$6)),e$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$86=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(s$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),__$=l0.object({...e$6,template:$86})});function Gj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=__$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var v81=B(()=>{v_$()});import{join as b_$}from"path";async function X86($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Z86)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Gj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||_81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Q86($,Z){let X=hg($),Q=Z?.brand?.trim()||_81(X),Y=V_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=C_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
     `)}function Y86($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function f_$($){let Z=new B1;return Z.get("/:domain/og.png",async(X)=>{let Q=hg(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(b_$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(G86)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?b_$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await X86(hg(Q)),K=Q86(Q,W);return X.html(Y86(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var Z86=2500,G86=1e4;var x_$=B(()=>{v8();v81();SD();S$()});function Io($,Z){return fetch(`${LW({})}${$}`,Z)}async function J86($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await Io(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=Gj0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var W86,x3,Jj0=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},y_$;var g_$=B(()=>{v8();qG();SD();v81();W86=new Set(["complete","errored","terminated","unknown"]),x3=new B1;x3.use("*",async($,Z)=>{let X=await E8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});x3.use("/run",Jj0);x3.use("/status",Jj0);x3.use("/link-token/*",Jj0);x3.use("/suggest",Jj0);x3.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await J86(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});x3.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Io("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${kD({})}`},body:JSON.stringify({url:Q,email:Y,distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});x3.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Io(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${kD({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:W86.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});x3.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Io(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});x3.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Io(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});y_$=x3});import{createHmac as K86,timingSafeEqual as H86}from"crypto";function h_$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let N=H.indexOf("=");if(N<=0)continue;let F=H.slice(0,N).trim(),U=H.slice(N+1).trim();if(F==="t")Y=U;else if(F==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>N86)return!1;let W=K86("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let N=Buffer.from(H,"hex");return K.length===N.length&&H86(K,N)})}function u_$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=oG(Z),Q=oG(oG(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:fK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function F86($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function fK($){return typeof $==="string"?$:void 0}function oG($){return typeof $==="object"&&$!==null?$:void 0}function Wj0($){return typeof $==="number"?new Date($*1000):null}function x81($){return fK($)??fK(oG($)?.id)}function U86($){return x81($.subscription)??fK(oG(oG($.parent)?.subscription_details)?.subscription)}function w86($){let Z=Wj0($.current_period_end);if(Z)return Z;let X=oG($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=oG(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function b81($,Z){let X=Wj0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function f81($,Z){let X=Wj0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function O86($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=fK(oG(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(fK(oG(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=fK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(oG(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:oG(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=x81(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(b81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:x81(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=fK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&b81(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":F86(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:w86(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=U86(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(b81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:Wj0(X.period_end),lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}async function c_$($){let Z=new kW(c8().db),X=await O86(Z,$);if(X.handled&&X.topUp)await mF$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId});if(!X.handled&&X.orphanSubscriptionId)try{await _1$(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof K3&&(Q.status===400||Q.status===404)))throw Q}return X}var N86=300;var l_$=B(()=>{GG();Jn();Ur0()});var B86=1048576,y81;var d_$=B(()=>{v8();gO();S$();l_$();y81=new B1;y81.post("/webhook",GZ({maxSize:B86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=c0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!h_$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=u_$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await c_$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as D86}from"crypto";function E86($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return D86(Buffer.from(Y),Buffer.from(Q))}var L86=5242880,g81;var m_$=B(()=>{v8();gO();Xp();g81=new B1;g81.post("/webhook",GZ({maxSize:L86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!E86(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await vn0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function i_$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var n_$,j86,z86,p_$;var t_$=B(()=>{v8();RJ();Yy();Av();n_$=new B1,j86=["range","if-none-match","if-modified-since"],z86=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];n_$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(Eg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Q$(401,{message:"Authentication required"})}if(!X)throw new Q$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Q$(400,{message:"Missing file key"});let Y=await zp(Q,Z);if(!Y)throw new Q$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&TJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Q$(500,{message:"Invalid data URL from storage"});let[,H,N]=K,F=Buffer.from(N,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return i_$(U,H),new Response(F,{status:200,headers:U})}let G=new Headers;for(let K of j86){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Q$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Q$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of z86){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),i_$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});p_$=n_$});var qo=C((hC)=>{var P86=hC&&hC.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),A86=hC&&hC.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))P86(Z,$,X)};Object.defineProperty(hC,"__esModule",{value:!0});A86(oQ(),hC)});var a_$=C((o_$)=>{Object.defineProperty(o_$,"__esModule",{value:!0});o_$.version=void 0;o_$.version="3.4.0"});var $v$=C((xK)=>{var T86=xK&&xK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(xK,"__esModule",{value:!0});xK.NodeTransport=xK.VERSION=void 0;xK.nodeResolveHost=S86;var l6=qo(),R86=z0("net"),h81=z0("tls"),I86=z0("path"),s_$=z0("fs"),q86=T86(z0("dns")),M86=a_$();xK.VERSION=M86.version;var k86="nats.js";class e_${socket;version;lang;yields=[];signal=(0,l6.deferred)();closedNotification=(0,l6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=k86,this.version=xK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,l6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw l6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new l6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new l6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,l6.deferred)(),X,Q=(0,R86.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,l6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=l6.DataBuffer.concat(...this.yields),Y=(0,l6.extractProtocolMessage)(Q);if(Y!=="")try{let G=l6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,l6.deferred)();try{if($=(0,I86.resolve)($),!(0,s_$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,s_$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,l6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,l6.deferred)();try{let Y=(0,h81.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,l6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,l6.deferred)();try{let Q=(0,h81.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,l6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,l6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof h81.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,l6.render)($)}`);let Z=(0,l6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}xK.NodeTransport=e_$;function S86($){let Z=(0,l6.deferred)();return q86.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Gv$=C((Yv$)=>{Object.defineProperty(Yv$,"__esModule",{value:!0});Yv$.connect=V86;var Zv$=$v$(),Xv$=qo(),Qv$=qo();function V86($={}){if((0,Qv$.hasWsProtocol)($))return Promise.reject(Qv$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Xv$.setTransportFactory)({factory:()=>{return new Zv$.NodeTransport},dnsResolveFn:Zv$.nodeResolveHost}),Xv$.NatsConnectionImpl.connect($)}});var Jv$=C((eN)=>{var _86=eN&&eN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),v86=eN&&eN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))_86(Z,$,X)};Object.defineProperty(eN,"__esModule",{value:!0});eN.connect=void 0;var b86=Gv$();Object.defineProperty(eN,"connect",{enumerable:!0,get:function(){return b86.connect}});v86(qo(),eN)});function Nv$($){let Z=$?.connectFn??g86,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function N(U){(async()=>{for await(let w of U.status())if(w.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(w.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function F(U,w){let O=0;while(!G)try{X=await Z({servers:U,timeout:y86,reconnect:!0,maxReconnectAttempts:-1,...w?{authenticator:w}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,N(X),H();return}catch{O++;let D=JX(x86,f86,O-1,2,0.5);await y$(D)}}return{init(U,w){if(Y)return;Y=!0,G=!1;let O=w?.creds?Wv$.credsAuthenticator(new TextEncoder().encode(w.creds)):void 0;F(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=Hv$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function g86($){return Kv$.connect($)}var Wv$,Kv$,Hv$,f86=100,x86=3000,y86=3000;var Fv$=B(()=>{B6();Wv$=S(Fh(),1),Kv$=S(Jv$(),1),Hv$=S(GB(),1)});function u81($,Z){return`${$}.${Z}`}class c81{cache;constructor($){this.cache=Og({ttlMs:$?.ttlMs??h86,maxSize:$?.maxSize??u86})}async get($,Z){return this.cache.get(u81($,Z))??null}async set($,Z,X){this.cache.set(u81($,Z),X)}async invalidate($,Z){this.cache.delete(u81($,Z))}teardown(){this.cache.clear()}}var h86=600000,u86=5000;var Uv$=()=>{};function Kj0($,Z){return`${$}:${Z}`}function l81($){let Z=Og({ttlMs:$?.ttlMs??c86,maxSize:$?.maxSize??l86}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let N=X?.();if(!N)return;try{N.publish(wv$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,H){return Z.get(Kj0(K,H))},set(K,H,N){Z.set(Kj0(K,H),N)},invalidate(K,H){Z.delete(Kj0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(wv$),(async()=>{for await(let H of J)try{let N=JSON.parse(G.decode(H.data));if(N.originId===Q)continue;Z.delete(Kj0(N.organizationId,N.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var wv$="studio.ai-provider-keys.invalidate",c86=30000,l86=5000;var Ov$=()=>{};class d81{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=Bv$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of Bv$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Bv$;var Dv$=B(()=>{Bv$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var Lv$=($)=>{let Z;return()=>Z??=$()},m81,i81;var Ev$=B(()=>{N5();m81=Lv$(()=>W8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),i81=Lv$(()=>W8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function o86(){return{name:IN,subjects:[`${DO0}.>`],storage:y3.StorageType.File,max_age:i86,max_bytes:p86,max_msgs_per_subject:t86,discard:y3.DiscardPolicy.Old,retention:y3.RetentionPolicy.Limits,duplicate_window:n86,num_replicas:1}}class Pv${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function jv$($){let Z=zv$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function e86($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,m86().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function $46($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class n81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=o86(),X=await fZ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await y3.jetstreamManager($);try{await Q.streams.info(IN),await Q.streams.update(IN,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(IN),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:$46});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=e86(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=AH$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let N=performance.now(),F=Ot0(H,{runId:Z}),U=performance.now()-N;if(m81().record(U),i81().add(1,{"org.id":Q??"unknown"}),s86?.record(U,F.reduce((w,O)=>w+O.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let w of F)G.publish(Y,w.subject,w.data,w.headers?jv$(w.headers):void 0)};return(async()=>{let H=$.getReader(),N=0,F=0,U;try{while(!0){let{done:w,value:O}=await H.read();if(w)break;if(K(O),F++,++N>=64)N=0,await new Promise((D)=>setImmediate(D))}}catch(w){U=w,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,w?.message??w)}finally{if(H.releaseLock(),W(),a86)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Ot0(Z,{runId:$,dedup:X});if(m81().record(performance.now()-Y),i81().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:jv$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=PH$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?y3.DeliverPolicy.New:y3.DeliverPolicy.All,G=X?.closeOnDone??!1,J=HO($),W;try{W=await(await Q.consumers.get(IN,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let N=PO0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(LO0()).pipeThrough(EO0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{N.releaseLock()}catch{}},w=!1,O=()=>{if(w)return;w=!0,W.stop(),N.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await N.read();if(L){O(),D.close();return}let j=E;if(j.kind==="done"){if(G){O(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(IN,{filter:HO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var y3,zv$,d86=($)=>{let Z;return()=>Z??=$()},m86,i86=86400000000000,n86=120000000000,p86=4294967296,t86=500000,r86,a86,s86;var Av$=B(()=>{B6();Bt0();AO0();jO0();N5();Ev$();y3=S(GB(),1),zv$=S(Fh(),1),m86=d86(()=>W8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));r86=process.env.STREAM_ENCODE_TRACE==="1",a86=process.env.DECOPILOT_STREAM_TRACE==="1";s86=r86?new Pv$:null});function Hj0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,YW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Tv$=B(()=>{B8()});class p81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}class t81{taskBoard;contextFactory;options;timer=null;running=!1;cursor=null;constructor($,Z,X={}){this.taskBoard=$;this.contextFactory=Z;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??Z46;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??Q46,X=this.options.itemIntervalMs??X46,Q=await this.taskBoard.listItemsPendingReview(Z,this.cursor,new Date(Date.now()-X)),Y=Q.at(-1);this.cursor=Q.length===Z&&Y?{updatedAt:Y.updatedAt,id:Y.id}:null;for(let{id:G,organizationId:J}of Q)try{if(await this.reconcileItem(G,J))$++}catch(W){console.error(`[task-board-review-sweeper] ${G} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-RW$),rt0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-G46));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await lp0(this.taskBoard,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==p4)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await qN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+Y46)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(X.status!=="in_review"||X.assigneeId!==p4)return!1;await this.taskBoard.markSwept($,Z);let Q=await this.taskBoard.listPrs($,Z);if(Q.length===0)return!1;let Y=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!Y)return!1;let G=await Promise.all(Q.map(async(J)=>({...J,...await pt0(Y,Z,J)})));if(G.every((J)=>J.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${G.length} PR(s)) \u2014 proceeding on unknown`);if(!nt0(G))return!1;return await kO0(Y,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var Z46=60000,X46=300000,Q46=50,Y46=60000,G46=120000;var Rv$=B(()=>{b7();ht0();NO();MZ();at0();Oy()});import{readdir as J46,rm as Nj0}from"fs/promises";import{join as Fj0}from"path";async function Uj0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-W46),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await uC($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Iv$($,Y,Z);else if(!Y.startsWith(".")){let G=Fj0($,Y),J=await uC(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Iv$(G,K,Z)}if((await uC(G)).length===0)await Nj0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Iv$($,Z,X){let Q=0,Y=Fj0($,Z),G=await uC(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=Fj0(Y,W),H=await uC(K);for(let F of H){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let w=Fj0(K,F);await Nj0(w,{recursive:!0,force:!0}),Q++}}if((await uC(K)).length===0)await Nj0(K,{recursive:!0,force:!0})}if((await uC(Y)).length===0)await Nj0(Y,{recursive:!0,force:!0});return Q}async function uC($){try{return(await J46($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var W46=30;var o81=()=>{};import{DBOS as r81,SchedulerMode as K46}from"@dbos-inc/dbos-sdk";async function N46(){let $=[$J(),cC(),gK()],Z=0;for(let X of $)try{Z+=await Uj0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function F46($,Z){await r81.runStep(()=>N46(),{name:"monitoringRetention"})}function Mv$(){if(qv$)return;qv$=!0;let $=r81.registerWorkflow(F46,{name:"monitoringRetentionWorkflow"});r81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:H46,mode:K46.ExactlyOncePerIntervalWhenActive})}var H46="23 4 * * *",qv$=!1;var kv$=B(()=>{iQ();o81()});function Sv$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await zw.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await vc0($.db,Z,Q.role);return Y.boundAuth=_c0({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new ZL(X,void 0,Y.boundAuth,Q.role,"self"),D50(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Vv$=B(()=>{XL();Ci()});function U46(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function O46(){for(let $ of w46)$()}function Cv$($){let Z=[...a81.logs,$];a81={...a81,logs:Z.length>500?Z.slice(-500):Z},O46()}function s81(){return B46}var a81,w46,B46=!1;var e81=B(()=>{a81=U46(),w46=new Set});import{EventEmitter as D46}from"events";var $41;var _v$=B(()=>{e81();$41=new D46;$41.on("request",($)=>{Cv$($)})});function vv$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let w=ug(U.params.name),O=U.params.arguments||{},D=Object.keys(O).map((E)=>ug(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";G=`${a6.tool}${w}${a6.dim}(${L})${a6.reset}`}else if(U.method)G=`${a6.dim}${ug(U.method)}${a6.reset}`}}catch{}}let W=ug(Y);if(Y.startsWith("/mcp/conn_")){let N=Y.split("/")[2]??"";W=`/mcp/${a6.mcp}${ug(N.slice(0,12))}\u2026${a6.reset}`}else if(Y==="/mcp")W=`${a6.mcp}/mcp${a6.reset}`;else if(Y==="/mcp/registry")W=`${a6.mcp}/mcp/registry${a6.reset}`;let K=E46(Q),H=J?"\u25C0":"\u2190";if(!s81())console.log(`${a6.dim}${H}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let N=Date.now()-X,F=$.res.status,U=L46(F),w=N<1000?`${N}ms`:`${(N/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!s81())console.log(`${a6.dim}${O}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""} ${U}${F}${a6.reset} ${a6.duration}${w}${a6.reset}`);$41.emit("request",{method:Q,path:ug(Y),status:F,duration:N,timestamp:new Date})}}}var a6,L46=($)=>{if($>=500)return a6.serverError;if($>=400)return a6.clientError;if($>=300)return a6.redirect;return a6.ok},E46=($)=>{return a6[$]||a6.reset},ug=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var bv$=B(()=>{e81();_v$();a6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as gv$}from"crypto";import{mkdir as j46,readdir as z46,rm as fv$,stat as hv$}from"fs/promises";import{join as X41,relative as P46}from"path";import{z as L$}from"zod";function cv$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return X41(A46,Z)}function lv$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function Z41($,Z){let X=cv$($),Q=lv$(Z);return X41(X,Q)}function T46($,Z,X,Q){let Y=c0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return gv$("sha256",Y).update(G).digest("hex")}function yv$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=T46(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${lv$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function dv$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${gv$("md5","etag").update(Q).digest("hex")}"`}async function mv$($,Z,X,Q,Y){try{let G=await z46($,{withFileTypes:!0});for(let J of G){let W=X41($,J.name),H=P46(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let N=H+"/";if(!X||N.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(N)}}else await mv$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let N=H.slice(X.length);if(N.includes(Q)){let F=N.indexOf(Q),U=X+N.slice(0,F+1);Y.commonPrefixes.add(U);continue}}try{let N=await hv$(W);Y.objects.push({key:H,size:N.size,lastModified:N.mtime.toISOString(),etag:dv$(W,N.mtime,N.size)})}catch{}}}}catch{}}function iv$($,Z){let Q=r($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:L$.object({prefix:L$.string().optional(),maxKeys:L$.number().optional().default(1000),continuationToken:L$.string().optional(),delimiter:L$.string().optional()}),outputSchema:L$.object({objects:L$.array(L$.object({key:L$.string(),size:L$.number(),lastModified:L$.string(),etag:L$.string()})),nextContinuationToken:L$.string().optional(),isTruncated:L$.boolean(),commonPrefixes:L$.array(L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,N=cv$(Q);await j46(N,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await mv$(N,N,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(H){if(U=F.objects.findIndex((L)=>L.key>H),U===-1)U=F.objects.length}let w=F.objects.slice(U,U+W),O=U+W<F.objects.length,D=O?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:O,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({contentType:L$.string().optional(),contentLength:L$.number(),lastModified:L$.string(),etag:L$.string(),metadata:L$.record(L$.string(),L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=Z41(Q,G.key),W=await hv$(J);return{contentType:o11(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:dv$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??xv$;return{url:yv$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional(),contentType:L$.string().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??xv$;return{url:yv$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({success:L$.boolean(),key:L$.string()}),handler:async(Y)=>{let G=Y,J=Z41(Q,G.key);try{return await fv$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:L$.object({keys:L$.array(L$.string()).max(1000)}),outputSchema:L$.object({deleted:L$.array(L$.string()),errors:L$.array(L$.object({key:L$.string(),message:L$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=Z41(Q,K);try{await fv$(H),J.push(K)}catch(N){W.push({key:K,message:N instanceof Error?N.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function Q41($,Z,X){let Q=iv$(Z,X),Y=new OW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:X5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:L$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:L$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let N=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let G=new cX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),uG(Y,G,$,"mcp:dev-assets")}async function nv$($,Z,X,Q){let G=iv$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var A46="./data/assets",xv$=3600,uv$,pv$;var tv$=B(()=>{S$();jy();v8();Nl();nV();qX();TE0();uv$=new B1;uv$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return Q41($.req.raw,Z,Q)});pv$=uv$});var ov$={};H4(ov$,{mountDevRoutes:()=>R46});function R46($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return Q41(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await nv$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",pv$);let X=new B1;X.use("*",b3({mountPath:"/api/dev-assets"})),X.route("/",AE0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var rv$=B(()=>{v8();c11();TE0();tv$()});import{sql as I46}from"kysely";import{randomUUID as av$}from"crypto";import{z as q46}from"zod";async function k46($){let Z=new Date().toISOString(),X=av$(),Q=x4.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:av$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await I46`SELECT
       pg_notify('studio_events', ${X}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.192.9",
+  "version": "4.193.0",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {