npm - decocms - Versions diffs - 4.252.8 → 4.252.10 - Mend

decocms 4.252.8 → 4.252.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (225) hide show

package/dist/server/server.js CHANGED Viewed

@@ -1476,7 +1476,7 @@ ${"text"in A?A.text:""}`.trim()}});else z=[{type:"text",text:D},...E];return[...
                 case
                   when count(distinct up.metadata->'models'->'thinking'->>'provider') = 1
                   then max(up.metadata->'models'->'thinking'->>'provider')
-                end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(J)=>J.onTrue()).select((J)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",J.or([J.exists(J.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),J.exists(J.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",X).where("link.task_board_item_id","in",Q).orderBy("link.created_at","desc").execute(),G=new Map;for(let J of Y){let W={threadId:J.threadId,virtualMcpId:J.virtualMcpId??null,status:J.status??null,failureKind:J.failureKind??null,title:J.title??null,lastMessage:UK$(J.lastMessagePayload),hasPreview:nO4(J.metadata),hasMessages:!!J.hasMessages,lastActiveAt:oO4(J.updatedAt,J.lastProgressAt),costUsd:tO4(J.costUsd),costProvider:J.costProvider??null,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},K=G.get(J.taskId);if(K)K.push(W);else G.set(J.taskId,[W])}for(let J of Z)J.threads=G.get(J.id)??[]}async attachTags($,Z){let X=Z.map((G)=>G.id),Q=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",X).orderBy("tag.name","asc").execute(),Y=new Map;for(let G of Q){let J={id:G.id,name:G.name,color:G.color??null,createdBy:G.createdBy,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},W=Y.get(G.taskId);if(W)W.push(J);else Y.set(G.taskId,[J])}for(let G of Z)G.tags=Y.get(G.id)??[]}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:p8("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute()}async resolveReviewClaimByToken($,Z){let X=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return X?{reviewer:X.reviewer,cycleAt:X.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),X=[];for(let Q of $)if(!(iO4.has(Q.action)&&await this.touchRecentActivity(Q,Z)))X.push(Q);if(X.length===0)return;await this.db.insertInto("task_board_activity").values(X.map((Q)=>({id:p8("act"),task_board_item_id:Q.taskBoardItemId,action:Q.action,actor_id:Q.actorId,data:Q.data?JSON.stringify(Q.data):null,occurred_at:Z}))).execute()}async touchRecentActivity($,Z){let X=new Date(Date.parse(Z)-pO4).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((Y)=>$.actorId===null?Y("actor_id","is",null):Y("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(X)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((Q)=>({id:Q.id,taskBoardItemId:Q.task_board_item_id,action:Q.action,actorId:Q.actor_id,data:typeof Q.data==="string"?JSON.parse(Q.data):Q.data??{},occurredAt:Q.occurred_at instanceof Date?Q.occurred_at.toISOString():Q.occurred_at}))}async hasHumanRejectedDone($,Z){let X=IB`a.data->>'from'`,Q=IB`a.data->>'reason'`,Y="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(X,"=","done").where(Q,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((Q)=>Ht0(Q))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let X=null;if($.parentId){let Y=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!Y)return null;X=Y.parent_id??Y.id}let Q=await this.db.insertInto("task_board_comments").values({id:p8("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:X,author_id:$.authorId,body:$.body}).returningAll().executeTakeFirstOrThrow();return Ht0(Q)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let X=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return X?Ht0(X):null}async deleteComment($,Z,X){let Q=await this.commentInOrg($,Z);if(!Q)return!1;if(Q.authorId!==X&&Q.authorId!==t8)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async commentInOrg($,Z){let X=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return X?{authorId:X.author_id,parentId:X.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,sortOrder:$.sort_order,keySeq:$.key_seq??null,retryAttempts:$.retry_attempts??0,threads:[],tags:[],createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var iO4,pO4=600000,Ln;var MK=w(()=>{z3();bX();j9();cB0();iO4=new Set(["description_changed","title_changed"]);Ln=new Set(["completed","failed","expired"])});function OK$($){let Z=$[1],X=$[2],Q=Number($[3]);return{owner:Z,repo:X,number:Q,url:`https://github.com/${Z}/${X}/pull/${Q}`}}function oB0($){let Z=$.length>200000?$.slice(0,200000):$,X=rO4.exec(Z);if(X&&Number(X[3])>0)return OK$(X);let Q=aO4.exec(Z);if(Q&&Number(Q[3])>0)return OK$(Q);return null}function BK$($){if($==null)return null;if(typeof $==="string")return oB0($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?oB0(Z):null}var rO4,aO4;var Ut0=w(()=>{rO4=/https?:\/\/github\.com\/([^/\s"']+)\/([^/\s"']+)\/pull\/(\d+)/,aO4=/https?:\/\/api\.github\.com\/repos\/([^/\s"']+)\/([^/\s"']+)\/pulls\/(\d+)/});function DK$($){if(wK$.has($.kind??""))return 0;return XB4($)?$B4:ZB4}function XB4($){let Z=$.kind??"";if(wK$.has(Z))return!1;if(sO4.has(Z))return!0;let X=$.errorText??"";if(!X)return!1;if(X.includes(LB0))return!0;let Q=X.replace(/https?:\/\/\S+/gi," ");return eO4.some((Y)=>Y.test(Q))}var sO4,wK$,eO4,$B4=3,ZB4=1;var LK$=w(()=>{cB0();sO4=new Set(["stall","liveness","projection","abandoned"]),wK$=new Set(["cancelled",...wn]),eO4=[/sandbox did not become ready/i,/sandbox (?:provisioning|claim) failed/i,/mcp is unusable/i,/harness_crashed: unexpected eof/i,/too many clients already|timeout exceeded when trying to connect/i,/\b(?:429|503)\b|too many requests|service unavailable/i]});class zK${listeners=new Map;totalCount=0;strategy=null;started=!1;async start($){if(this.started){if(!$)return;await this.stop()}this.strategy=$,await this.strategy.start((Z,X)=>this.localEmit(Z,X)),this.started=!0}async stop(){if(!this.started||!this.strategy)return;await this.strategy.stop(),this.started=!1}add($){if(this.totalCount>=jK$)return console.warn(`[SSEHub] Total connection limit reached (${jK$})`),null;let Z=this.listeners.get($.organizationId);if(!Z)Z=new Map,this.listeners.set($.organizationId,Z);if(Z.size>=EK$)return console.warn(`[SSEHub] Per-org connection limit reached for ${$.organizationId} (${EK$})`),null;return Z.set($.id,$),this.totalCount++,$.id}remove($,Z){let X=this.listeners.get($);if(!X)return;if(X.delete(Z)){if(this.totalCount--,X.size===0)this.listeners.delete($)}}emit($,Z){if(this.strategy)this.strategy.broadcast($,Z);else this.localEmit($,Z)}countForOrg($){return this.listeners.get($)?.size??0}get count(){return this.totalCount}localEmit($,Z){let X=this.listeners.get($);if(!X||X.size===0)return;for(let Q of X.values()){if(Q.typePatterns&&!QB4(Z.type,Q.typePatterns))continue;try{Q.push(Z)}catch{this.remove($,Q.id)}}}}function QB4($,Z){for(let X of Z){if(X===$)return!0;if(X.endsWith(".*")){let Q=X.slice(0,-1);if($.startsWith(Q))return!0}}return!1}var EK$=50,jK$=500,W9;var rB0=w(()=>{R6();W9=new zK$;w$.createObservableGauge("sse_hub.connections",{description:"Active SSE listeners held by this pod",unit:"{connections}"}).addCallback(($)=>$.observe(W9.count))});import{z as aB0}from"zod";async function v6($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(X){console.error("[task-board] activity log write failed",X)}}async function PK$($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(X){console.error("[task-board] activity log write failed",X)}}var Ot0;var ZQ=w(()=>{S0();f3();Ot0=c({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:aB0.object({taskBoardItemId:aB0.string()}),outputSchema:aB0.object({activity:aB0.array(_Y$)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,X)}}})});async function kK($,Z){let X=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!X)return null;let Q=await XJ.create();return Q.organization={id:X.id,slug:X.slug,name:X.name},qB(Q,{id:X.id,slug:X.slug}),Q}var Iy=w(()=>{FC()});function En($){return $ instanceof Date?$.toISOString():String($)}class HC{db;vault;constructor($,Z){this.db=$;this.vault=Z}async toEntity($){return{id:$.id,organizationId:$.organization_id,siteUrl:$.site_url,email:$.email,apiToken:await this.vault.decrypt($.api_token),boardId:$.board_id,boardName:$.board_name,statusMapping:typeof $.status_mapping==="string"?JSON.parse($.status_mapping):$.status_mapping,jqlFilter:$.jql_filter,autoDelegate:$.auto_delegate,webhookSecret:$.webhook_secret,enabled:$.enabled,lastSyncedAt:$.last_synced_at?En($.last_synced_at):null,lastSyncError:$.last_sync_error,createdBy:$.created_by,createdAt:En($.created_at),updatedAt:En($.updated_at)}}async getByOrg($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("organization_id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async upsert($){let Z=await this.vault.encrypt($.apiToken),X=await this.db.insertInto("org_jira_integrations").values({organization_id:$.organizationId,site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,status_mapping:JSON.stringify($.statusMapping),jql_filter:$.jqlFilter,auto_delegate:$.autoDelegate,enabled:$.enabled,created_by:$.createdBy}).onConflict((Q)=>Q.column("organization_id").doUpdateSet({site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,status_mapping:JSON.stringify($.statusMapping),jql_filter:$.jqlFilter,auto_delegate:$.autoDelegate,enabled:$.enabled,updated_at:new Date})).returningAll().executeTakeFirstOrThrow();return this.toEntity(X)}async getByWebhookSecret($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("webhook_secret","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async delete($){return(await this.db.deleteFrom("org_jira_integrations").where("organization_id","=",$).executeTakeFirst()).numDeletedRows>0n}async listEnabledIds(){return(await this.db.selectFrom("org_jira_integrations").select("id").where("enabled","=",!0).orderBy("created_at","asc").execute()).map((Z)=>Z.id)}async getById($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async recordSyncResult($,Z){await this.db.updateTable("org_jira_integrations").set({last_sync_error:Z.error,...Z.watermark?{last_synced_at:Z.watermark}:{},updated_at:new Date}).where("id","=",$).execute()}async getLinksByIssueIds($,Z){if(Z.length===0)return new Map;let X=await this.db.selectFrom("task_board_item_jira_links").selectAll().where("organization_id","=",$).where("jira_issue_id","in",Z).execute();return new Map(X.map((Q)=>[Q.jira_issue_id,{itemId:Q.item_id,jiraIssueId:Q.jira_issue_id,jiraIssueKey:Q.jira_issue_key,jiraUpdatedAt:En(Q.jira_updated_at),jiraStatus:Q.jira_status}]))}async createLink($){await this.db.insertInto("task_board_item_jira_links").values({item_id:$.itemId,organization_id:$.organizationId,jira_issue_id:$.jiraIssueId,jira_issue_key:$.jiraIssueKey,jira_updated_at:$.jiraUpdatedAt,jira_status:$.jiraStatus}).execute()}async touchLink($,Z){await this.db.updateTable("task_board_item_jira_links").set({...Z.jiraUpdatedAt!==void 0?{jira_updated_at:Z.jiraUpdatedAt}:{},...Z.jiraStatus!==void 0?{jira_status:Z.jiraStatus}:{}}).where("item_id","=",$).execute()}async getLinkByItemId($,Z){let X=await this.db.selectFrom("task_board_item_jira_links").selectAll().where("item_id","=",$).where("organization_id","=",Z).executeTakeFirst();if(!X)return null;return{itemId:X.item_id,jiraIssueId:X.jira_issue_id,jiraIssueKey:X.jira_issue_key,jiraUpdatedAt:En(X.jira_updated_at),jiraStatus:X.jira_status}}async knownJiraCommentIds($,Z){if(Z.length===0)return new Set;let X=await this.db.selectFrom("task_board_comment_jira_links").select("jira_comment_id").where("organization_id","=",$).where("jira_comment_id","in",Z).execute();return new Set(X.map((Q)=>Q.jira_comment_id))}async hasCommentLink($){return await this.db.selectFrom("task_board_comment_jira_links").select("comment_id").where("comment_id","=",$).executeTakeFirst()!==void 0}async createCommentLink($){await this.db.insertInto("task_board_comment_jira_links").values({comment_id:$.commentId,organization_id:$.organizationId,jira_comment_id:$.jiraCommentId}).execute()}}function IK$($,Z=new Map){let X=[],Q=(G)=>NB4(G,Z,X),Y=qK$($).map((G)=>{if(G.type==="code")return`\`\`\`${G.lang}
+                end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(J)=>J.onTrue()).select((J)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",J.or([J.exists(J.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),J.exists(J.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",X).where("link.task_board_item_id","in",Q).orderBy("link.created_at","desc").execute(),G=new Map;for(let J of Y){let W={threadId:J.threadId,virtualMcpId:J.virtualMcpId??null,status:J.status??null,failureKind:J.failureKind??null,title:J.title??null,lastMessage:UK$(J.lastMessagePayload),hasPreview:nO4(J.metadata),hasMessages:!!J.hasMessages,lastActiveAt:oO4(J.updatedAt,J.lastProgressAt),costUsd:tO4(J.costUsd),costProvider:J.costProvider??null,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},K=G.get(J.taskId);if(K)K.push(W);else G.set(J.taskId,[W])}for(let J of Z)J.threads=G.get(J.id)??[]}async attachTags($,Z){let X=Z.map((G)=>G.id),Q=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",X).orderBy("tag.name","asc").execute(),Y=new Map;for(let G of Q){let J={id:G.id,name:G.name,color:G.color??null,createdBy:G.createdBy,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},W=Y.get(G.taskId);if(W)W.push(J);else Y.set(G.taskId,[J])}for(let G of Z)G.tags=Y.get(G.id)??[]}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:p8("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute()}async resolveReviewClaimByToken($,Z){let X=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return X?{reviewer:X.reviewer,cycleAt:X.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),X=[];for(let Q of $)if(!(iO4.has(Q.action)&&await this.touchRecentActivity(Q,Z)))X.push(Q);if(X.length===0)return;await this.db.insertInto("task_board_activity").values(X.map((Q)=>({id:p8("act"),task_board_item_id:Q.taskBoardItemId,action:Q.action,actor_id:Q.actorId,data:Q.data?JSON.stringify(Q.data):null,occurred_at:Z}))).execute()}async touchRecentActivity($,Z){let X=new Date(Date.parse(Z)-pO4).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((Y)=>$.actorId===null?Y("actor_id","is",null):Y("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(X)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((Q)=>({id:Q.id,taskBoardItemId:Q.task_board_item_id,action:Q.action,actorId:Q.actor_id,data:typeof Q.data==="string"?JSON.parse(Q.data):Q.data??{},occurredAt:Q.occurred_at instanceof Date?Q.occurred_at.toISOString():Q.occurred_at}))}async hasHumanRejectedDone($,Z){let X=IB`a.data->>'from'`,Q=IB`a.data->>'reason'`,Y="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(X,"=","done").where(Q,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((Q)=>Ht0(Q))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let X=null;if($.parentId){let Y=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!Y)return null;X=Y.parent_id??Y.id}let Q=await this.db.insertInto("task_board_comments").values({id:p8("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:X,author_id:$.authorId,body:$.body}).returningAll().executeTakeFirstOrThrow();return Ht0(Q)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let X=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return X?Ht0(X):null}async deleteComment($,Z,X){let Q=await this.commentInOrg($,Z);if(!Q)return!1;if(Q.authorId!==X&&Q.authorId!==t8)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async commentInOrg($,Z){let X=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return X?{authorId:X.author_id,parentId:X.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,sortOrder:$.sort_order,keySeq:$.key_seq,retryAttempts:$.retry_attempts??0,threads:[],tags:[],createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var iO4,pO4=600000,Ln;var MK=w(()=>{z3();bX();j9();cB0();iO4=new Set(["description_changed","title_changed"]);Ln=new Set(["completed","failed","expired"])});function OK$($){let Z=$[1],X=$[2],Q=Number($[3]);return{owner:Z,repo:X,number:Q,url:`https://github.com/${Z}/${X}/pull/${Q}`}}function oB0($){let Z=$.length>200000?$.slice(0,200000):$,X=rO4.exec(Z);if(X&&Number(X[3])>0)return OK$(X);let Q=aO4.exec(Z);if(Q&&Number(Q[3])>0)return OK$(Q);return null}function BK$($){if($==null)return null;if(typeof $==="string")return oB0($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?oB0(Z):null}var rO4,aO4;var Ut0=w(()=>{rO4=/https?:\/\/github\.com\/([^/\s"']+)\/([^/\s"']+)\/pull\/(\d+)/,aO4=/https?:\/\/api\.github\.com\/repos\/([^/\s"']+)\/([^/\s"']+)\/pulls\/(\d+)/});function DK$($){if(wK$.has($.kind??""))return 0;return XB4($)?$B4:ZB4}function XB4($){let Z=$.kind??"";if(wK$.has(Z))return!1;if(sO4.has(Z))return!0;let X=$.errorText??"";if(!X)return!1;if(X.includes(LB0))return!0;let Q=X.replace(/https?:\/\/\S+/gi," ");return eO4.some((Y)=>Y.test(Q))}var sO4,wK$,eO4,$B4=3,ZB4=1;var LK$=w(()=>{cB0();sO4=new Set(["stall","liveness","projection","abandoned"]),wK$=new Set(["cancelled",...wn]),eO4=[/sandbox did not become ready/i,/sandbox (?:provisioning|claim) failed/i,/mcp is unusable/i,/harness_crashed: unexpected eof/i,/too many clients already|timeout exceeded when trying to connect/i,/\b(?:429|503)\b|too many requests|service unavailable/i]});class zK${listeners=new Map;totalCount=0;strategy=null;started=!1;async start($){if(this.started){if(!$)return;await this.stop()}this.strategy=$,await this.strategy.start((Z,X)=>this.localEmit(Z,X)),this.started=!0}async stop(){if(!this.started||!this.strategy)return;await this.strategy.stop(),this.started=!1}add($){if(this.totalCount>=jK$)return console.warn(`[SSEHub] Total connection limit reached (${jK$})`),null;let Z=this.listeners.get($.organizationId);if(!Z)Z=new Map,this.listeners.set($.organizationId,Z);if(Z.size>=EK$)return console.warn(`[SSEHub] Per-org connection limit reached for ${$.organizationId} (${EK$})`),null;return Z.set($.id,$),this.totalCount++,$.id}remove($,Z){let X=this.listeners.get($);if(!X)return;if(X.delete(Z)){if(this.totalCount--,X.size===0)this.listeners.delete($)}}emit($,Z){if(this.strategy)this.strategy.broadcast($,Z);else this.localEmit($,Z)}countForOrg($){return this.listeners.get($)?.size??0}get count(){return this.totalCount}localEmit($,Z){let X=this.listeners.get($);if(!X||X.size===0)return;for(let Q of X.values()){if(Q.typePatterns&&!QB4(Z.type,Q.typePatterns))continue;try{Q.push(Z)}catch{this.remove($,Q.id)}}}}function QB4($,Z){for(let X of Z){if(X===$)return!0;if(X.endsWith(".*")){let Q=X.slice(0,-1);if($.startsWith(Q))return!0}}return!1}var EK$=50,jK$=500,W9;var rB0=w(()=>{R6();W9=new zK$;w$.createObservableGauge("sse_hub.connections",{description:"Active SSE listeners held by this pod",unit:"{connections}"}).addCallback(($)=>$.observe(W9.count))});import{z as aB0}from"zod";async function v6($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(X){console.error("[task-board] activity log write failed",X)}}async function PK$($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(X){console.error("[task-board] activity log write failed",X)}}var Ot0;var ZQ=w(()=>{S0();f3();Ot0=c({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:aB0.object({taskBoardItemId:aB0.string()}),outputSchema:aB0.object({activity:aB0.array(_Y$)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,X)}}})});async function kK($,Z){let X=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!X)return null;let Q=await XJ.create();return Q.organization={id:X.id,slug:X.slug,name:X.name},qB(Q,{id:X.id,slug:X.slug}),Q}var Iy=w(()=>{FC()});function En($){return $ instanceof Date?$.toISOString():String($)}class HC{db;vault;constructor($,Z){this.db=$;this.vault=Z}async toEntity($){return{id:$.id,organizationId:$.organization_id,siteUrl:$.site_url,email:$.email,apiToken:await this.vault.decrypt($.api_token),boardId:$.board_id,boardName:$.board_name,statusMapping:typeof $.status_mapping==="string"?JSON.parse($.status_mapping):$.status_mapping,jqlFilter:$.jql_filter,autoDelegate:$.auto_delegate,webhookSecret:$.webhook_secret,enabled:$.enabled,lastSyncedAt:$.last_synced_at?En($.last_synced_at):null,lastSyncError:$.last_sync_error,createdBy:$.created_by,createdAt:En($.created_at),updatedAt:En($.updated_at)}}async getByOrg($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("organization_id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async upsert($){let Z=await this.vault.encrypt($.apiToken),X=await this.db.insertInto("org_jira_integrations").values({organization_id:$.organizationId,site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,status_mapping:JSON.stringify($.statusMapping),jql_filter:$.jqlFilter,auto_delegate:$.autoDelegate,enabled:$.enabled,created_by:$.createdBy}).onConflict((Q)=>Q.column("organization_id").doUpdateSet({site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,status_mapping:JSON.stringify($.statusMapping),jql_filter:$.jqlFilter,auto_delegate:$.autoDelegate,enabled:$.enabled,updated_at:new Date})).returningAll().executeTakeFirstOrThrow();return this.toEntity(X)}async getByWebhookSecret($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("webhook_secret","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async delete($){return(await this.db.deleteFrom("org_jira_integrations").where("organization_id","=",$).executeTakeFirst()).numDeletedRows>0n}async listEnabledIds(){return(await this.db.selectFrom("org_jira_integrations").select("id").where("enabled","=",!0).orderBy("created_at","asc").execute()).map((Z)=>Z.id)}async getById($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async recordSyncResult($,Z){await this.db.updateTable("org_jira_integrations").set({last_sync_error:Z.error,...Z.watermark?{last_synced_at:Z.watermark}:{},updated_at:new Date}).where("id","=",$).execute()}async getLinksByIssueIds($,Z){if(Z.length===0)return new Map;let X=await this.db.selectFrom("task_board_item_jira_links").selectAll().where("organization_id","=",$).where("jira_issue_id","in",Z).execute();return new Map(X.map((Q)=>[Q.jira_issue_id,{itemId:Q.item_id,jiraIssueId:Q.jira_issue_id,jiraIssueKey:Q.jira_issue_key,jiraUpdatedAt:En(Q.jira_updated_at),jiraStatus:Q.jira_status}]))}async createLink($){await this.db.insertInto("task_board_item_jira_links").values({item_id:$.itemId,organization_id:$.organizationId,jira_issue_id:$.jiraIssueId,jira_issue_key:$.jiraIssueKey,jira_updated_at:$.jiraUpdatedAt,jira_status:$.jiraStatus}).execute()}async touchLink($,Z){await this.db.updateTable("task_board_item_jira_links").set({...Z.jiraUpdatedAt!==void 0?{jira_updated_at:Z.jiraUpdatedAt}:{},...Z.jiraStatus!==void 0?{jira_status:Z.jiraStatus}:{}}).where("item_id","=",$).execute()}async getLinkByItemId($,Z){let X=await this.db.selectFrom("task_board_item_jira_links").selectAll().where("item_id","=",$).where("organization_id","=",Z).executeTakeFirst();if(!X)return null;return{itemId:X.item_id,jiraIssueId:X.jira_issue_id,jiraIssueKey:X.jira_issue_key,jiraUpdatedAt:En(X.jira_updated_at),jiraStatus:X.jira_status}}async knownJiraCommentIds($,Z){if(Z.length===0)return new Set;let X=await this.db.selectFrom("task_board_comment_jira_links").select("jira_comment_id").where("organization_id","=",$).where("jira_comment_id","in",Z).execute();return new Set(X.map((Q)=>Q.jira_comment_id))}async hasCommentLink($){return await this.db.selectFrom("task_board_comment_jira_links").select("comment_id").where("comment_id","=",$).executeTakeFirst()!==void 0}async createCommentLink($){await this.db.insertInto("task_board_comment_jira_links").values({comment_id:$.commentId,organization_id:$.organizationId,jira_comment_id:$.jiraCommentId}).execute()}}function IK$($,Z=new Map){let X=[],Q=(G)=>NB4(G,Z,X),Y=qK$($).map((G)=>{if(G.type==="code")return`\`\`\`${G.lang}
 ${AK$(G.content)}
 \`\`\``;if(G.type==="quote")return RK$(Q(AK$(G.content))).split(`
 `).map((J)=>`> ${J}`).join(`
@@ -2910,7 +2910,7 @@ Respond with the structured verdict and a short reason.`,Dg$;var Eg$=w(()=>{v4()
 ${G.join(`
 `)}`:Y}function iJ6($){let Z=new Set;for(let X of $)for(let Q of X.split(`
 `)){let Y=Q.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var Xh$=200,xJ6=12,gJ6,uJ6=300,y91=3;var g91=w(()=>{S_();ZA0();gJ6={aheadBy:0,behindBy:0,files:[]}});function nJ6($){if(!$||$.includes(".."))return!1;return pJ6.test($)}function Yh$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!nJ6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Gh$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var pJ6;var Jh$=w(()=>{pJ6=/^[\w./@-]+$/});function h91($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function wa($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Wh$($,Z,X,Q){if(!Q.connectionId)throw new __("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new __(Q9);await rO({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(H)=>{let N=H instanceof Error?H.message:Q9;throw new __(N)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await aO(Q.connectionId,Q.owner,Q.name,$.db,$.vault).catch((H)=>{let{code:N,message:U}=q4$(H instanceof Error?H.message:String(H));throw N?new __(U):H}),K=th($),F=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!F.ok){let H=await wB(F,tJ6).catch(()=>F.statusText);throw Error(`Failed to refresh sandbox git credentials (${F.status}): ${H}`)}}var tJ6=10485760,__;var u91=w(()=>{mG();dP0();ip();Gm0();mx();__=class __ extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function rJ6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!oJ6.test(Z))throw Error(`Invalid branch name: ${$}`)}function v_($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(sJ6)])}function eJ6($,Z,X){let Q=w5($)[Z]?.[X];return!!Q&&Object.keys(IY(Q)).length>0}function f_($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function $u($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=wa(Z,X);if(!Y)throw new g4(404,"AUTH","repo","Project has no GitHub repository");let G=t(Q);return iP0(Q,G.id,Y)}function c91($,Z){if(Z instanceof mP0)return $.json({error:Z.message},429,{...C5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof g4){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,C5)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,C5)}async function Hh$($,Z,X){let Q;try{Q=await fetch(Z,X)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await Q.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}async function Nh$($){try{let Z=await $u($),X=await XA0(Z,$.get("vmClaim").branch);return $.json(X,200,C5)}catch(Z){return c91($,Z)}}function Da($,Z){let Q=(GA0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return GA0.set($,Y),Y.finally(()=>{if(GA0.get($)===Y)GA0.delete($)}),Q}async function mZ($,Z,X){if($.get("vmClaim").fastPreview)return $.json({error:"sandbox not found: Fast Preview projects are sandbox-less"},404,C5);let Q=f_($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,F=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,F.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),F.set("content-type","application/json");let H=X?.signal,N={method:W,headers:F,body:K,...H?{signal:H}:{}},U=async()=>{let O=await Q.proxyDaemonRequest(Y,Z,N);if(X?.map404to410&&O.status===404){try{await O.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))O=await Q.proxyDaemonRequest(Y,Z,N);if(O.status===404){try{await O.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...C5}})}}let B=await O.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?Z36(B):B,L=O.headers.get("content-type")??"application/json";return new Response(D,{status:O.status,headers:{"content-type":L,...C5}})};try{if(H){let O=U();return O.catch(()=>{}),await Promise.race([O,new Promise((D,L)=>{if(H.aborted)return L(H.reason);H.addEventListener("abort",()=>L(H.reason),{once:!0})})])}return await U()}catch(O){let B=O instanceof Error?O.message:String(O);return $.json({error:`Daemon unreachable: ${B}`},502)}}function Z36($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function JA0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function X36($){return Uh$.includes($)}var oJ6,Kh$=524288,aJ6=65536,sJ6=1e4,Fh$=2000,$36,GA0,C5,Uh$,Oh$=()=>{let $=new H1;$.use("/:virtualMcpId/:branch/*",$36),$.post("/:virtualMcpId/:branch/write",(X)=>mZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>mZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>mZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>mZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>mZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>mZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>mZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:v_(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return mZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return mZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>mZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>mZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!X36(Q))return X.json({error:`step must be one of: ${Uh$.join(", ")}`},400);if(Q==="start"){let Y=X.get("vmClaim");if(Y.runner){let G=t(X.var.studioContext),J=Ky(Y.virtualMcpMetadata);try{await dO0({ctx:X.var.studioContext,runner:Y.runner,handle:Y.claimName,orgId:G.id,userId:Y.callerUserId,entries:J})}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:`Failed to push env to daemon: ${K}`},502)}}}return mZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return IN(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Hg$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").fastPreview)return Nh$(X);return Z(X)});let Z=(X)=>mZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Fh$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").fastPreview)return Nh$(X);return mZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Fh$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.fastPreview)try{let Y=await X.req.json().catch(()=>({})),G=await $u(X),J=await QA0(G,Q.branch,Y.base);return X.json(J,200,C5)}catch(Y){return c91(X,Y)}return mZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").fastPreview)return X.json({ok:!0},200,C5);let Q=f_(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),W=X.var.studioContext;return Da(Y,async()=>{try{await E91(W,Q,Y);let K=wa(G,J);if(K)await Wh$(W,Q,Y,K)}catch(K){if(K instanceof __)return X.json({error:K.message},403,C5);let F=K instanceof Error?K.message:String(K);return X.json({error:F},502,C5)}return mZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let Q=X.get("vmClaim");if(Q.fastPreview)return Da(Q.claimName,async()=>{let Y=await X.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return X.json({error:"filepaths is required"},400,C5);try{let J=await $u(X);return await Qh$(J,Q.branch,G),X.json({ok:!0},200,C5)}catch(J){let W=J instanceof g4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return X.json({error:K},W,C5)}});return Da(Q.claimName,()=>mZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.fastPreview)return Da(Q.claimName,async()=>{try{let W=await X.req.json().catch(()=>({})),K=await $u(X),F=W.base??await K.getDefaultBranch();return await YA0(K,Q.branch,F),X.json({ok:!0},200,C5)}catch(W){return c91(X,W)}});let Y=f_(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return Da(G,async()=>{try{await E91(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:K},502,C5)}return mZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",k9({maxSize:Kh$,onError:(X)=>X.json({error:"Payload too large"},413,C5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(!Q.fastPreview){let F=f_(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=P91(H)&&U?[H,N]:Y?await Promise.all([JA0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),JA0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await $u(X);return Promise.all([XA0(L,Q.branch),QA0(L,Q.branch)])})(),D=await wg$(K,O,B);return X.json(D,200,C5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,C5);return X.json({error:H},502,C5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",k9({maxSize:Kh$,onError:(X)=>X.json({error:"Payload too large"},413,C5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(!Q.fastPreview){let F=f_(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=P91(H)&&U?[H,N]:Y?await Promise.all([JA0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),JA0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await $u(X);return Promise.all([XA0(L,Q.branch),QA0(L,Q.branch)])})(),D=await Lg$(K,O,B,typeof F.language==="string"?F.language:void 0);return X.json(D,200,C5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,C5);return X.json({error:H},502,C5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=f_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,""),K=h91(`${W}${G}`);return Hh$(X,K?.url??`${W}${G}`,{...K?{headers:{host:K.hostHeader}}:{}})}),$.post("/:virtualMcpId/:branch/preview-invoke",k9({maxSize:aJ6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=f_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let W=Yh$(J);if(!W)return X.json({error:"Invalid or missing __resolveType"},400);let K=Gh$(G,W.resolveType),F=h91(K);return Hh$(X,F?.url??K,{method:"POST",headers:{"content-type":"application/json",...F?{host:F.hostHeader}:{}},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var Bh$=w(()=>{D8();DN();nh();L91();IH();Kg$();_3();pX();O8();dB0();NB();Fg$();Ng$();Mp0();dp();R91();Eg$();V91();S_();g91();Jh$();u91();oJ6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;$36=lP0(async($,Z)=>{let X=$.var.studioContext;try{r(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=G1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=t(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{rJ6(J)}catch(O){let B=O instanceof Error?O.message:String(O);return $.json({error:B},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Jp({orgId:Y.id,virtualMcpId:G,branch:J}),F=await bH(X,J,Q),H=Wg$({userId:F,projectRef:K}),N=W.metadata??null;if(lW$(N).fastPreviewCapability&&!eJ6(N,F,J))return $.set("vmClaim",{claimName:H,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],fastPreview:!0}),Z();let U;try{U=(await sX(X,{userId:F,branch:J,virtualMcpMetadata:N})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:H,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[]}),Z()});GA0=new Map;C5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Uh$=["clone","install","start"]});function wh$($,Z,X){let Q=l91.get($);if(!Q)Q={pending:null,running:!1},l91.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,W]of Object.entries(X.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!Q.running)Y36($,Q);return G}async function Y36($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await G36(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)l91.delete($)}}async function G36($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await eh(Z,X),J=await Z.getCommitTreeSha(G),W=await Z.getTreeRecursive(J),K=b91(W,Q),F=[],H=new Map(K.map((B)=>[B.path,{stem:B.stem,sha:B.sha}]));for(let[B,D]of $.set){let L=x91(K,B),E=`${JSON.stringify(D,null,2)}
-`,j=await Z.createBlob(E);await eg$(Z.owner,Z.repo,j,E);let z=L[0]??`${$A0(Q)}/${S91(B)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of L.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let B of $.del)for(let D of x91(K,B))F.push({path:D,mode:"100644",type:"blob",sha:null}),H.delete(D);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:D,skipped:L}=Na(B);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(D);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),O=await Z.createCommit({message:J36($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof g4&&B.status===422)||Y>=Q36-1)throw B;await M$(nZ(2000,200,Y,2,0.5))}}}function J36($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return rd0(Q,$.deps.coAuthor)}var Q36=3,l91;var Dh$=w(()=>{bO0();nP0();u4();S_();ZA0();l91=new Map});import{createHmac as Lh$,randomBytes as W36,timingSafeEqual as K36}from"crypto";function Eh$(){if(WA0)return WA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return WA0=$?Buffer.from($):W36(32),WA0}function d91($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+F36)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=Lh$("sha256",Eh$()).update(Q).digest("base64url");return`${Q}.${Y}`}function jh$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(Lh$("sha256",Eh$()).update(Q).digest("base64url"));if(Y.length!==G.length||!K36(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var F36=21600000,WA0=null;var zh$=w(()=>{R$()});import{z as Zu}from"zod";function N36($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&H36.test($)}function Ah$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function KA0($){let Z=$.get("decofileScope");return iP0($.var.studioContext,Z.organizationId,Z.githubRepo)}function FA0($,Z){if(Z instanceof g4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function Th$(){let $=new H1;return $.use("/:virtualMcpId/:branch",Ph$),$.use("/:virtualMcpId/:branch/*",Ph$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await $h$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=d91({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(Ah$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return FA0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=U36.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{pP0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await KA0(Z),W=await wh$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:th(Q)},G),K=d91({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:Ah$(Z)})}catch(J){return FA0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof g4&&W.status===409))throw W;await YA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof g4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof g4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return FA0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof g4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return FA0(Z,Q)}}),$}var H36,U36,Ph$;var Rh$=w(()=>{nP0();D8();L91();dP0();u91();V91();Dh$();zh$();g91();S_();ZA0();H36=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;U36=Zu.object({set:Zu.record(Zu.string(),Zu.unknown()).optional(),delete:Zu.array(Zu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),Ph$=lP0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!N36(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!jh$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!lB0(K)||K?.fastPreview!==!0)return $.json({error:"Fast Preview is not enabled for this project"},404);let H=W.connections?.map((O)=>O.connection_id)??[],N=wa(K,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var Ih$=($)=>{let Z=new H1;if(Z.use("*",P_),Z.route("/",GP0()),Z.route("/",lf$()),Z.route("/",ty$()),Z.route("/",iy$()),Z.route("/",hP0()),Z.route("/tools",Zg$()),Z.route("/",sy$()),Z.route("/",Ry$({kvStorage:$.kvStorage})),Z.route("/",Ay$()),Z.route("/fs",gy$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Oh$()),Z.route("/decofile",Th$()),Z.route("/",ly$()),Z.route("/deco-sites",WP0()),Z.route("/sso",ez0()),Z.route("/",uP0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ff$()),$.mountDevAssets)Z.route("/dev-assets",KP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",w_$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",uy$()),Z.route("/mcp",KD0()),Z.route("/mcp/self",gP0()),Z.route("/mcp",ND0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var qh$=w(()=>{D8();h61();bf$();d61();FP0();yr();y61();Ty$();Iy$();hy$();dn();V61();UD0();H91();cy$();dy$();py$();oy$();ey$();U91();Xg$();O91();FD0();Bh$();Rh$()});function O36($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var B36=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Mh$=()=>{let $=new H1;return $.use("*",B36),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await dZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:O36(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var kh$=w(()=>{D8();R$();Xz0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function R36($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function I36($,Z,X){try{return JSON.parse($)}catch{throw new Ch$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function q36($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:I36(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function M36($){let Z=$.map((X)=>{let Q=X.function.parameters?hY(X.function.parameters):hY({type:"object",properties:{}});return[X.function.name,b$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function k36($){if(!$)return;return{openai:{response_format:$}}}function V36(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Vh$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Sh$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var w36=256,D36,L36,E36,j36,z36,P36,A36,T36,Ch$,_h$,vh$;var fh$=w(()=>{v4();D8();nh();YN();D36=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),L36=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),E36=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(L36).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),j36=M1.object({type:M1.literal("text")}),z36=M1.object({type:M1.literal("json_object")}),P36=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),A36=M1.union([j36,z36,P36]),T36=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(E36),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(D36).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:A36.optional(),user:M1.string().optional()});Ch$=class Ch$ extends Error{constructor($){super($);this.name="MessageConversionError"}};_h$=new H1;_h$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=T36.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=R36(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>fD(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),N=q36(G.messages),U=G.tools?M36(G.tools):void 0,O=k36(G.response_format),B=V36(),D=Math.floor(Date.now()/1000);if(G.stream)return IN($,async(L)=>{let E=Vh$(H,N,U,G,O,$.req.raw.signal);try{let j=tO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=w36)await I()}else if(k.type==="tool-call"){await I();let q=A++;await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:Sh$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Vh$(H,N,U,G,O,$.req.raw.signal),E=await pO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:Sh$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(GF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(GF(Y.message,"server_error"),500)}});vh$=_h$});function S36($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function bh$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=G1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!uG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let F of J){if(!F.slug||W7(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(Ba1(N)!==G)continue;if(!S36(N.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var xh$=w(()=>{D8();fO()});var gh$;var yh$=w(()=>{gh$={name:"decocms",version:"4.252.8",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function v36(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??_36}}var hh$,_36="https://ph.studio.decocms.com",uh$;var ch$=w(()=>{D8();Mh0();KC();f9();R$();R61();yh$();hh$=new H1;hh$.get("/",($)=>{let Z={version:gh$.version,theme:gd1(),...RL().logo&&{logo:RL().logo},...qK()&&{internalUrl:wS1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:ev$(),posthog:v36(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!qK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});uh$=hh$});function Xu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function m91($){return(Xu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function dh$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Xu($))}&sz=${Z}`}function lh$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function mh$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?lh$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):lh$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var b_,f36,b36,x36,y36,ih$;var ph$=w(()=>{b_=l0.enum(["good","bad","neutral"]),f36=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:b_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),b36=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(f36)),x36={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},y36=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:b_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:b_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:b_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:b_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(b36).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:b_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:b_.optional()})).min(1)})]),ih$=l0.object({...x36,template:y36})});function HA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=ih$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var i91=w(()=>{ph$()});import{join as nh$}from"path";async function h36($){try{let Z=await fetch(`${aW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(g36)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=HA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||m91($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function WG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function u36($,Z){let X=Xu($),Q=Z?.brand?.trim()||m91(X),Y=dh$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=mh$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${WG(W)}</title>`,`<meta name="description" content="${WG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${WG(W)}" />`,`<meta property="og:description" content="${WG(K)}" />`,`<meta property="og:url" content="${WG(J)}" />`,`<meta property="og:image" content="${WG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${WG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${WG(W)}" />`,`<meta name="twitter:description" content="${WG(K)}" />`,`<meta name="twitter:image" content="${WG(F)}" />`,`<meta name="twitter:image:alt" content="${WG(H)}" />`,`<link rel="canonical" href="${WG(J)}" />`,`<link rel="icon" href="${WG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await eg$(Z.owner,Z.repo,j,E);let z=L[0]??`${$A0(Q)}/${S91(B)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of L.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let B of $.del)for(let D of x91(K,B))F.push({path:D,mode:"100644",type:"blob",sha:null}),H.delete(D);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:D,skipped:L}=Na(B);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(D);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),O=await Z.createCommit({message:J36($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof g4&&B.status===422)||Y>=Q36-1)throw B;await M$(nZ(2000,200,Y,2,0.5))}}}function J36($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return rd0(Q,$.deps.coAuthor)}var Q36=3,l91;var Dh$=w(()=>{bO0();nP0();u4();S_();ZA0();l91=new Map});import{createHmac as Lh$,randomBytes as W36,timingSafeEqual as K36}from"crypto";function Eh$(){if(WA0)return WA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return WA0=$?Buffer.from($):W36(32),WA0}function d91($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+F36)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=Lh$("sha256",Eh$()).update(Q).digest("base64url");return`${Q}.${Y}`}function jh$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(Lh$("sha256",Eh$()).update(Q).digest("base64url"));if(Y.length!==G.length||!K36(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var F36=21600000,WA0=null;var zh$=w(()=>{R$()});import{z as Zu}from"zod";function N36($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&H36.test($)}function Ah$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function KA0($){let Z=$.get("decofileScope");return iP0($.var.studioContext,Z.organizationId,Z.githubRepo)}function FA0($,Z){if(Z instanceof g4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function Th$(){let $=new H1;return $.use("/:virtualMcpId/:branch",Ph$),$.use("/:virtualMcpId/:branch/*",Ph$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await $h$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=d91({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(Ah$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return FA0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=U36.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{pP0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await KA0(Z),W=await wh$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:th(Q)},G),K=d91({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:Ah$(Z)})}catch(J){return FA0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof g4&&W.status===409))throw W;await YA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof g4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof g4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return FA0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await KA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof g4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return FA0(Z,Q)}}),$}var H36,U36,Ph$;var Rh$=w(()=>{nP0();D8();L91();dP0();u91();V91();Dh$();zh$();g91();S_();ZA0();H36=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;U36=Zu.object({set:Zu.record(Zu.string(),Zu.unknown()).optional(),delete:Zu.array(Zu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),Ph$=lP0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!N36(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!jh$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!lB0(K)||K?.fastPreview!==!0)return $.json({error:"Fast Preview is not enabled for this project"},404);let H=W.connections?.map((O)=>O.connection_id)??[],N=wa(K,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var Ih$=($)=>{let Z=new H1;if(Z.use("*",P_),Z.route("/",GP0()),Z.route("/",lf$()),Z.route("/",ty$()),Z.route("/",iy$()),Z.route("/",hP0()),Z.route("/tools",Zg$()),Z.route("/",sy$()),Z.route("/",Ry$({kvStorage:$.kvStorage})),Z.route("/",Ay$()),Z.route("/fs",gy$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Oh$()),Z.route("/decofile",Th$()),Z.route("/",ly$()),Z.route("/deco-sites",WP0()),Z.route("/sso",ez0()),Z.route("/",uP0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ff$()),$.mountDevAssets)Z.route("/dev-assets",KP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",w_$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",uy$()),Z.route("/mcp",KD0()),Z.route("/mcp/self",gP0()),Z.route("/mcp",ND0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var qh$=w(()=>{D8();h61();bf$();d61();FP0();yr();y61();Ty$();Iy$();hy$();dn();V61();UD0();H91();cy$();dy$();py$();oy$();ey$();U91();Xg$();O91();FD0();Bh$();Rh$()});function O36($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var B36=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Mh$=()=>{let $=new H1;return $.use("*",B36),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await dZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:O36(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var kh$=w(()=>{D8();R$();Xz0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function R36($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function I36($,Z,X){try{return JSON.parse($)}catch{throw new Ch$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function q36($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:I36(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function M36($){let Z=$.map((X)=>{let Q=X.function.parameters?hY(X.function.parameters):hY({type:"object",properties:{}});return[X.function.name,b$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function k36($){if(!$)return;return{openai:{response_format:$}}}function V36(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Vh$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Sh$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var w36=256,D36,L36,E36,j36,z36,P36,A36,T36,Ch$,_h$,vh$;var fh$=w(()=>{v4();D8();nh();YN();D36=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),L36=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),E36=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(L36).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),j36=M1.object({type:M1.literal("text")}),z36=M1.object({type:M1.literal("json_object")}),P36=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),A36=M1.union([j36,z36,P36]),T36=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(E36),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(D36).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:A36.optional(),user:M1.string().optional()});Ch$=class Ch$ extends Error{constructor($){super($);this.name="MessageConversionError"}};_h$=new H1;_h$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=T36.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=R36(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>fD(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),N=q36(G.messages),U=G.tools?M36(G.tools):void 0,O=k36(G.response_format),B=V36(),D=Math.floor(Date.now()/1000);if(G.stream)return IN($,async(L)=>{let E=Vh$(H,N,U,G,O,$.req.raw.signal);try{let j=tO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=w36)await I()}else if(k.type==="tool-call"){await I();let q=A++;await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await L.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:Sh$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Vh$(H,N,U,G,O,$.req.raw.signal),E=await pO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:Sh$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(GF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(GF(Y.message,"server_error"),500)}});vh$=_h$});function S36($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function bh$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=G1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!uG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let F of J){if(!F.slug||W7(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(Ba1(N)!==G)continue;if(!S36(N.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var xh$=w(()=>{D8();fO()});var gh$;var yh$=w(()=>{gh$={name:"decocms",version:"4.252.10",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function v36(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??_36}}var hh$,_36="https://ph.studio.decocms.com",uh$;var ch$=w(()=>{D8();Mh0();KC();f9();R$();R61();yh$();hh$=new H1;hh$.get("/",($)=>{let Z={version:gh$.version,theme:gd1(),...RL().logo&&{logo:RL().logo},...qK()&&{internalUrl:wS1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:ev$(),posthog:v36(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!qK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});uh$=hh$});function Xu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function m91($){return(Xu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function dh$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Xu($))}&sz=${Z}`}function lh$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function mh$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?lh$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):lh$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var b_,f36,b36,x36,y36,ih$;var ph$=w(()=>{b_=l0.enum(["good","bad","neutral"]),f36=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:b_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),b36=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(f36)),x36={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},y36=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:b_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:b_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:b_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:b_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(b36).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:b_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:b_.optional()})).min(1)})]),ih$=l0.object({...x36,template:y36})});function HA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=ih$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var i91=w(()=>{ph$()});import{join as nh$}from"path";async function h36($){try{let Z=await fetch(`${aW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(g36)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=HA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||m91($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function WG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function u36($,Z){let X=Xu($),Q=Z?.brand?.trim()||m91(X),Y=dh$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=mh$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${WG(W)}</title>`,`<meta name="description" content="${WG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${WG(W)}" />`,`<meta property="og:description" content="${WG(K)}" />`,`<meta property="og:url" content="${WG(J)}" />`,`<meta property="og:image" content="${WG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${WG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${WG(W)}" />`,`<meta name="twitter:description" content="${WG(K)}" />`,`<meta name="twitter:image" content="${WG(F)}" />`,`<meta name="twitter:image:alt" content="${WG(H)}" />`,`<link rel="canonical" href="${WG(J)}" />`,`<link rel="icon" href="${WG(Y)}" sizes="any" />`].join(`
     `)}function c36($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function th$($){let Z=new H1;return Z.get("/:domain/og.png",async(X)=>{let Q=Xu(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(nh$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${aW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(l36)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?nh$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await h36(Xu(Q)),K=u36(Q,W);return X.html(c36(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var g36=2500,l36=1e4;var oh$=w(()=>{D8();i91();gL();R$()});function La($,Z){return fetch(`${aW({})}${$}`,Z)}async function d36($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await La(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=HA0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var m36,MN,rh$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},ah$;var sh$=w(()=>{D8();bY();gL();i91();m36=new Set(["complete","errored","terminated","unknown"]),MN=new H1;MN.use("*",async($,Z)=>{let X=await F8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});MN.use("/link-token/*",rh$);MN.use("/suggest",rh$);MN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await d36(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});MN.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await La("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${yL({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});MN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await La(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${yL({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:m36.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});MN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await La(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});MN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await La(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});ah$=MN});import{createHmac as i36,timingSafeEqual as p36}from"crypto";function $u$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let F of Z.split(",")){let H=F.indexOf("=");if(H<=0)continue;let N=F.slice(0,H).trim(),U=F.slice(H+1).trim();if(N==="t")Y=U;else if(N==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>n36)return!1;let W=i36("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((F)=>{let H=Buffer.from(F,"hex");return K.length===H.length&&p36(K,H)})}function Zu$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=IJ(Z),Q=IJ(IJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:JF(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function Xu$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function JF($){return typeof $==="string"?$:void 0}function IJ($){return typeof $==="object"&&$!==null?$:void 0}function NA0($){return typeof $==="number"?new Date($*1000):null}function t91($){return JF($)??JF(IJ($)?.id)}function t36($){return t91($.subscription)??JF(IJ(IJ($.parent)?.subscription_details)?.subscription)}function o36($){let Z=NA0($.current_period_end);if(Z)return Z;let X=IJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=IJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function p91($,Z){let X=NA0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function n91($,Z){let X=NA0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function r36($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=JF(IJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(JF(IJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(JF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=JF(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(IJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:IJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(JF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=t91(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(p91(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:t91(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:n91(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=JF(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&p91(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Xu$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:o36(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:n91(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=t36(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(p91(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:NA0(X.period_end),lastStripeEventAt:n91(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function a36($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Xu$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function eh$($,Z){let X=a36($,Z);if(!X)return;SY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:pi1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Qu$($){let Z=new nW(u8().db),X=await r36(Z,$);if(!(X.handled&&X.topUp))eh$($,X);if(X.handled&&X.topUp)await yw$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),eh$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await Hs1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof xY&&(Q.status===400||Q.status===404)))throw Q}return X}var n36=300;var Yu$=w(()=>{bG();k4();j60();nL();Je0()});var s36=1048576,o91;var Gu$=w(()=>{D8();DN();R$();Yu$();o91=new H1;o91.post("/webhook",k9({maxSize:s36,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=b0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!$u$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=Zu$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Qu$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as e36}from"crypto";function ZW6($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return e36(Buffer.from(Y),Buffer.from(Q))}var $W6=5242880,r91;var Ju$=w(()=>{D8();DN();up();r91=new H1;r91.post("/webhook",k9({maxSize:$W6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!ZW6(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await Pp0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function Wu$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Ku$,XW6,QW6,Fu$;var Hu$=w(()=>{D8();N3();Ry();Px();Ku$=new H1,XW6=["range","if-none-match","if-modified-since"],QW6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Ku$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(kh($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new $$(401,{message:"Authentication required"})}if(!X)throw new $$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new $$(400,{message:"Missing file key"});let Y=await Dn(Q,Z);if(!Y)throw new $$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&D3()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new $$(500,{message:"Invalid data URL from storage"});let[,F,H]=K,N=Buffer.from(H,"base64"),U=new Headers({"Content-Type":F,"Cache-Control":"private, max-age=86400"});return Wu$(U,F),new Response(N,{status:200,headers:U})}let G=new Headers;for(let K of XW6){let F=$.req.header(K);if(F)G.set(K,F)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new $$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new $$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of QW6){let F=J.headers.get(K);if(F)W.set(K,F)}return W.set("Cache-Control","private, max-age=86400"),Wu$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Fu$=Ku$});var Ea=_((x_)=>{var YW6=x_&&x_.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),GW6=x_&&x_.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))YW6(Z,$,X)};Object.defineProperty(x_,"__esModule",{value:!0});GW6(OY(),x_)});var Ou$=_((Nu$)=>{Object.defineProperty(Nu$,"__esModule",{value:!0});Nu$.version=void 0;Nu$.version="3.4.0"});var Du$=_((WF)=>{var JW6=WF&&WF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(WF,"__esModule",{value:!0});WF.NodeTransport=WF.VERSION=void 0;WF.nodeResolveHost=UW6;var r6=Ea(),WW6=z0("net"),a91=z0("tls"),KW6=z0("path"),Bu$=z0("fs"),FW6=JW6(z0("dns")),HW6=Ou$();WF.VERSION=HW6.version;var NW6="nats.js";class wu${socket;version;lang;yields=[];signal=(0,r6.deferred)();closedNotification=(0,r6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=NW6,this.version=WF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,r6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw r6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new r6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new r6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,r6.deferred)(),X,Q=(0,WW6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,r6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=r6.DataBuffer.concat(...this.yields),Y=(0,r6.extractProtocolMessage)(Q);if(Y!=="")try{let G=r6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,r6.deferred)();try{if($=(0,KW6.resolve)($),!(0,Bu$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Bu$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,r6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,r6.deferred)();try{let Y=(0,a91.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,r6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,r6.deferred)();try{let Q=(0,a91.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,r6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,r6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof a91.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,r6.render)($)}`);let Z=(0,r6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}WF.NodeTransport=wu$;function UW6($){let Z=(0,r6.deferred)();return FW6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Pu$=_((zu$)=>{Object.defineProperty(zu$,"__esModule",{value:!0});zu$.connect=OW6;var Lu$=Du$(),Eu$=Ea(),ju$=Ea();function OW6($={}){if((0,ju$.hasWsProtocol)($))return Promise.reject(ju$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Eu$.setTransportFactory)({factory:()=>{return new Lu$.NodeTransport},dnsResolveFn:Lu$.nodeResolveHost}),Eu$.NatsConnectionImpl.connect($)}});var Au$=_((kN)=>{var wW6=kN&&kN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),DW6=kN&&kN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))wW6(Z,$,X)};Object.defineProperty(kN,"__esModule",{value:!0});kN.connect=void 0;var LW6=Pu$();Object.defineProperty(kN,"connect",{enumerable:!0,get:function(){return LW6.connect}});DW6(Ea(),kN)});function qu$($){let Z=$?.connectFn??PW6,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function F(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function H(U){(async()=>{for await(let O of U.status())if(O.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(O.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,F()})().catch(()=>{})}async function N(U,O){let B=0;while(!G)try{X=await Z({servers:U,timeout:zW6,reconnect:!0,maxReconnectAttempts:-1,...O?{authenticator:O}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${B} attempt(s)`),Q=null,J=!1,H(X),F();return}catch{B++;let D=nZ(jW6,EW6,B-1,2,0.5);await M$(D)}}return{init(U,O){if(Y)return;Y=!0,G=!1;let B=O?.creds?Tu$.credsAuthenticator(new TextEncoder().encode(O.creds)):void 0;N(U,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=Iu$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function PW6($){return Ru$.connect($)}var Tu$,Ru$,Iu$,EW6=100,jW6=3000,zW6=3000;var Mu$=w(()=>{u4();Tu$=V(Mu(),1),Ru$=V(Au$(),1),Iu$=V(uw(),1)});function s91($,Z){return`${$}.${Z}`}class e91{cache;constructor($){this.cache=Bh({ttlMs:$?.ttlMs??AW6,maxSize:$?.maxSize??TW6})}async get($,Z){return this.cache.get(s91($,Z))??null}async set($,Z,X){this.cache.set(s91($,Z),X)}async invalidate($,Z){this.cache.delete(s91($,Z))}teardown(){this.cache.clear()}}var AW6=600000,TW6=5000;var ku$=()=>{};function UA0($,Z){return`${$}:${Z}`}function $Z1($){let Z=Bh({ttlMs:$?.ttlMs??RW6,maxSize:$?.maxSize??IW6}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,F){let H=X?.();if(!H)return;try{H.publish(Vu$,Y.encode(JSON.stringify({organizationId:K,keyId:F,originId:Q})))}catch(N){console.warn("[ProviderKeyCache] Publish failed (non-critical):",N)}}return{get(K,F){return Z.get(UA0(K,F))},set(K,F,H){Z.set(UA0(K,F),H)},invalidate(K,F){Z.delete(UA0(K,F)),W(K,F)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(Vu$),(async()=>{for await(let F of J)try{let H=JSON.parse(G.decode(F.data));if(H.originId===Q)continue;Z.delete(UA0(H.organizationId,H.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Vu$="studio.ai-provider-keys.invalidate",RW6=30000,IW6=5000;var Su$=()=>{};class ZZ1{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=Cu$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of Cu$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Cu$;var _u$=w(()=>{Cu$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var vu$=($)=>{let Z;return()=>Z??=$()},XZ1,QZ1;var fu$=w(()=>{R6();XZ1=vu$(()=>w$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),QZ1=vu$(()=>w$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function _W6(){return{name:pH,subjects:[`${Mw0}.>`],storage:WW.StorageType.File,max_age:kW6,max_bytes:SW6,max_msgs_per_subject:CW6,discard:WW.DiscardPolicy.Old,retention:WW.RetentionPolicy.Limits,duplicate_window:VW6,num_replicas:1}}class yu${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function bu$($){let Z=xu$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function xW6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,MW6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function yW6($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class YZ1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=_W6(),X=await v5(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await WW.jetstreamManager($);try{await Q.streams.info(pH),await Q.streams.update(pH,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(pH),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:yW6});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=xW6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let F=wH$(Z);Y.publish(F.subject,F.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(F)=>{let H=performance.now(),N=Yo0(F,{runId:Z}),U=performance.now()-H;if(XZ1().record(U),QZ1().add(1,{"org.id":Q??"unknown"}),bW6?.record(U,N.reduce((O,B)=>O+B.data.length,0)),N.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let O of N)G.publish(Y,O.subject,O.data,O.headers?bu$(O.headers):void 0)};return(async()=>{let F=$.getReader(),H=0,N=0,U;try{while(!0){let{done:O,value:B}=await F.read();if(O)break;if(K(B),N++,++H>=64)H=0,await new Promise((D)=>setImmediate(D))}}catch(O){U=O,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,O?.message??O)}finally{if(F.releaseLock(),W(),fW6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:N,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Yo0(Z,{runId:$,dedup:X});if(XZ1().record(performance.now()-Y),QZ1().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:bu$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=BH$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?WW.DeliverPolicy.New:WW.DeliverPolicy.All,G=X?.closeOnDone??!1,J=CB($),W;try{W=await(await Q.consumers.get(pH,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let H=_w0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(kw0()).pipeThrough(Vw0()).getReader(),N=!1,U=()=>{if(N)return;N=!0;try{H.releaseLock()}catch{}},O=!1,B=()=>{if(O)return;O=!0,W.stop(),H.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await H.read();if(L){B(),D.close();return}let j=E;if(j.kind==="done"){if(G){B(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(pH,{filter:CB($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var WW,xu$,qW6=($)=>{let Z;return()=>Z??=$()},MW6,kW6=86400000000000,VW6=120000000000,SW6=4294967296,CW6=500000,vW6,fW6,bW6;var gu$=w(()=>{u4();Go0();vw0();Sw0();R6();fu$();WW=V(uw(),1),xu$=V(Mu(),1),MW6=qW6(()=>w$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));vW6=process.env.STREAM_ENCODE_TRACE==="1",fW6=process.env.DECOPILOT_STREAM_TRACE==="1";bW6=vW6?new yu$:null});function OA0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,SW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var hu$=w(()=>{O8()});class GZ1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function uu$($,Z,X){let Q=Z.organizationId;if(Z.status!=="in_review")return!1;if(!Sr(X))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Q))return!1;let Y=await $.storage.taskBoard.update(Z.id,Q,{status:"done"},Z.updatedBy);return await v6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:"done",reason:"pr_merged"}}),H8(Q,Y),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to done`),!0}var cu$=w(()=>{ZQ();Cr();l5()});function mW6($){return $ instanceof t7}function iW6($,Z){return Z-$>=lW6}class JZ1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??gW6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??uW6,X=this.options.itemIntervalMs??hW6,Q=new Date(Date.now()-X),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Q),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of Y)try{if(await this.reconcileItem(J,W,Q))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-on0),co0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-dW6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Mt0(this.taskBoard,Y,Q),await kt0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==t8)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await nH(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),mW6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+cW6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),H8(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!iW6(jH(X),Date.now()))return;await VK($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,X){if(!await this.taskBoard.claimSweep($,Z,X))return!1;let Q=await this.taskBoard.getById($,Z);if(!Q)return!1;if(Q.status!=="in_review")return!1;let Y=Q.assigneeId===t8,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Q.assignedBy??Q.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,Q);return!1}let W=await Promise.all(G.map(async(K)=>({...K,...await gy(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await uu$(J,Q,W.map((K)=>K.merged)))return!0;if(await MN$(J,Q))return!0;if(!Y)return!1;if(!yo0(W))return!1;return await hw0(J,Q,{previewMatchesHead:go0(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var gW6=60000,hW6=300000,uW6=50,cW6=60000,lW6=900000,dW6=120000;var lu$=w(()=>{j9();Vo0();dH();gn();cu$();l5();z3();lo0();CK();Cn()});import{readdir as pW6,rm as BA0}from"fs/promises";import{join as wA0}from"path";async function DA0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-nW6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await y_($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await du$($,Y,Z);else if(!Y.startsWith(".")){let G=wA0($,Y),J=await y_(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await du$(G,K,Z)}if((await y_(G)).length===0)await BA0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function du$($,Z,X){let Q=0,Y=wA0($,Z),G=await y_(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=wA0(Y,W),F=await y_(K);for(let N of F){if(!/^\d{2}$/.test(N))continue;let U=new Date(`${Z}-${W}-${N}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let O=wA0(K,N);await BA0(O,{recursive:!0,force:!0}),Q++}}if((await y_(K)).length===0)await BA0(K,{recursive:!0,force:!0})}if((await y_(Y)).length===0)await BA0(Y,{recursive:!0,force:!0});return Q}async function y_($){try{return(await pW6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var nW6=30;var WZ1=()=>{};import{DBOS as KZ1,SchedulerMode as tW6}from"@dbos-inc/dbos-sdk";async function rW6(){let $=[VJ(),g_(),NF()],Z=0;for(let X of $)try{Z+=await DA0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function aW6($,Z){await KZ1.runStep(()=>rW6(),{name:"monitoringRetention"})}function iu$(){if(mu$)return;mu$=!0;let $=KZ1.registerWorkflow(aW6,{name:"monitoringRetentionWorkflow"});KZ1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:oW6,mode:tW6.ExactlyOncePerIntervalWhenActive})}var oW6="23 4 * * *",mu$=!1;var pu$=w(()=>{FY();WZ1()});function nu$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await XJ.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await W61($.db,Z,Q.role);return Y.boundAuth=J61({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new zL(X,void 0,Y.boundAuth,Q.role,"self"),qB(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var tu$=w(()=>{PL();FC()});function sW6(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function $K6(){for(let $ of eW6)$()}function ou$($){let Z=[...FZ1.logs,$];FZ1={...FZ1,logs:Z.length>500?Z.slice(-500):Z},$K6()}function HZ1(){return ZK6}var FZ1,eW6,ZK6=!1;var NZ1=w(()=>{FZ1=sW6(),eW6=new Set});import{EventEmitter as XK6}from"events";var UZ1;var ru$=w(()=>{NZ1();UZ1=new XK6;UZ1.on("request",($)=>{ou$($)})});function au$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let O=Qu(U.params.name),B=U.params.arguments||{},D=Object.keys(B).map((E)=>Qu(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";G=`${G5.tool}${O}${G5.dim}(${L})${G5.reset}`}else if(U.method)G=`${G5.dim}${Qu(U.method)}${G5.reset}`}}catch{}}let W=Qu(Y);if(Y.startsWith("/mcp/conn_")){let H=Y.split("/")[2]??"";W=`/mcp/${G5.mcp}${Qu(H.slice(0,12))}\u2026${G5.reset}`}else if(Y==="/mcp")W=`${G5.mcp}/mcp${G5.reset}`;else if(Y==="/mcp/registry")W=`${G5.mcp}/mcp/registry${G5.reset}`;let K=YK6(Q),F=J?"\u25C0":"\u2190";if(!HZ1())console.log(`${G5.dim}${F}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let H=Date.now()-X,N=$.res.status,U=QK6(N),O=H<1000?`${H}ms`:`${(H/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!HZ1())console.log(`${G5.dim}${B}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""} ${U}${N}${G5.reset} ${G5.duration}${O}${G5.reset}`);UZ1.emit("request",{method:Q,path:Qu(Y),status:N,duration:H,timestamp:new Date})}}}var G5,QK6=($)=>{if($>=500)return G5.serverError;if($>=400)return G5.clientError;if($>=300)return G5.redirect;return G5.ok},YK6=($)=>{return G5[$]||G5.reset},Qu=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var su$=w(()=>{NZ1();ru$();G5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Xc$}from"crypto";import{mkdir as GK6,readdir as JK6,rm as eu$,stat as Qc$}from"fs/promises";import{join as BZ1,relative as WK6}from"path";import{z as P$}from"zod";function Gc$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return BZ1(KK6,Z)}function Jc$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function OZ1($,Z){let X=Gc$($),Q=Jc$(Z);return BZ1(X,Q)}function FK6($,Z,X,Q){let Y=b0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return Xc$("sha256",Y).update(G).digest("hex")}function Zc$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=FK6(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${Jc$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function Wc$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${Xc$("md5","etag").update(Q).digest("hex")}"`}async function Kc$($,Z,X,Q,Y){try{let G=await JK6($,{withFileTypes:!0});for(let J of G){let W=BZ1($,J.name),F=WK6(Z,W).replace(/\\/g,"/");if(X&&!F.startsWith(X))continue;if(J.isDirectory())if(Q){let H=F+"/";if(!X||H.startsWith(X)){if(!(X?F.slice(X.length):F).includes("/"))Y.commonPrefixes.add(H)}}else await Kc$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let H=F.slice(X.length);if(H.includes(Q)){let N=H.indexOf(Q),U=X+H.slice(0,N+1);Y.commonPrefixes.add(U);continue}}try{let H=await Qc$(W);Y.objects.push({key:F,size:H.size,lastModified:H.mtime.toISOString(),etag:Wc$(W,H.mtime,H.size)})}catch{}}}}catch{}}function Fc$($,Z){let Q=t($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,F=G.continuationToken,H=Gc$(Q);await GK6(H,{recursive:!0});let N={objects:[],commonPrefixes:new Set};await Kc$(H,H,J,K,N),N.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(F){if(U=N.objects.findIndex((L)=>L.key>F),U===-1)U=N.objects.length}let O=N.objects.slice(U,U+W),B=U+W<N.objects.length,D=B?O[O.length-1]?.key:void 0;return{objects:O,isTruncated:B,nextContinuationToken:D,commonPrefixes:Array.from(N.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=OZ1(Q,G.key),W=await Qc$(J);return{contentType:i61(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:Wc$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??$c$;return{url:Zc$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??$c$;return{url:Zc$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let G=Y,J=OZ1(Q,G.key);try{return await eu$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let F=OZ1(Q,K);try{await eu$(F),J.push(K)}catch(H){W.push({key:K,message:H instanceof Error?H.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function wZ1($,Z,X){let Q=Fc$(Z,X),Y=new yW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:H5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(F)=>{try{let H=await J.handler(F);return{content:[{type:"text",text:JSON.stringify(H)}],structuredContent:H}}catch(H){return{content:[{type:"text",text:`Error: ${H.message}`}],isError:!0}}})}let G=new XQ({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),FJ(Y,G,$,"mcp:dev-assets")}async function Hc$($,Z,X,Q){let G=Fc$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var KK6="./data/assets",$c$=3600,Yc$,Nc$;var Uc$=w(()=>{R$();my();D8();rl();zC();fX();FP0();Yc$=new H1;Yc$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return wZ1($.req.raw,Z,Q)});Nc$=Yc$});var Oc$={};G4(Oc$,{mountDevRoutes:()=>HK6});function HK6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return wZ1(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),F=await Hc$(W,K,Y,J);if(F.isError)return Q.json(F.content,500);return Q.json(F.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Nc$);let X=new H1;X.use("*",GW({mountPath:"/api/dev-assets"})),X.route("/",KP0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var Bc$=w(()=>{D8();g61();FP0();Uc$()});import{sql as NK6}from"kysely";import{randomUUID as wc$}from"crypto";import{z as UK6}from"zod";async function BK6($){let Z=new Date().toISOString(),X=wc$(),Q=m4.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:wc$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await NK6`SELECT
       pg_notify('studio_events', ${X}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.252.8",
+  "version": "4.252.10",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {