decocms 4.263.2 → 4.263.3

package/dist/server/server.js

@@ -888,7 +888,7 @@ You are the Usage Manager. You analyze how this workspace is actually used \u201
    d. Report the failing tool/connection, error pattern, and suggest the fix or owner.
 </workflows>`,do1={id:"studio-usage-manager",title:"Usage Manager",icon:"icon://BarChart10?color=blue",description:"Analyze usage, costs, and clean up idle agents and connections",selectedTools:["MONITORING_STATS","MONITORING_LOGS_LIST","MONITORING_LOG_GET","MONITORING_THREAD_USAGE","COLLECTION_VIRTUAL_MCP_LIST","COLLECTION_VIRTUAL_MCP_GET","COLLECTION_VIRTUAL_MCP_DELETE","VIRTUAL_MCP_LAST_USED_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","COLLECTION_CONNECTIONS_DELETE","ORGANIZATION_MEMBER_LIST"],selectedConnections:null,selectedPrompts:[],instructions:mt8,getId:RQ.USAGE_MANAGER}});function Lc0($){return lw.find((Z)=>$.startsWith(`${Z.id}_`))??null}async function pt8($,Z){if("resolveRuntime"in $)return $.resolveRuntime(Z);return{instructions:$.instructions,selectedTools:$.selectedTools}}async function $90({virtualMcp:$,agentId:Z=$.id,organizationId:X,ctx:Q}){let Y=Lc0(Z);if(!Y)return $;let G=await pt8(Y,{orgId:X,ctx:Q}),J=G.selectedTools?[...G.selectedTools]:null;return{...$,metadata:{...$.metadata??{},instructions:G.instructions},connections:$.connections.map((W)=>({...W,selected_tools:J}))}}async function Z90($,Z){if(!("checklist"in $))return[];return Promise.all($.checklist.map(async(X)=>({label:X.label,activeForm:X.activeForm,action:X.action,completed:await X.isCompleted(Z),alwaysSuggest:X.alwaysSuggest})))}async function io1($,Z,X){let Q={self:S8.SELF($),registry:S8.REGISTRY($),"community-registry":S8.COMMUNITY_REGISTRY($)};await Promise.all(it8.map((Y)=>X.delete(`${Y}${$}`))),await Promise.all(lw.map(async(Y)=>{let G=Y.getId($),J=await X.findById(G,$),K=(Y.selectedConnections??["self"]).map((H)=>Q[H]);if(J){await X.update(G,Z,{metadata:{...J.metadata??{},instructions:Y.instructions},connections:K.map((H)=>{let F=J.connections.find((N)=>N.connection_id===H);return{connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:F?.selected_resources??null,selected_prompts:F?.selected_prompts??null}})});return}await X.create($,Z,{title:Y.title,description:Y.description,icon:Y.icon,status:"active",pinned:!1,metadata:{instructions:Y.instructions},connections:K.map((H)=>({connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:null,selected_prompts:Y.selectedPrompts?[...Y.selectedPrompts]:null}))},{id:G})}))}var it8,lw;var Cx=D(()=>{P8();Vo1();Co1();vo1();go1();uo1();lo1();mo1();it8=["studio-task-manager_"],lw=[yo1,ko1,_o1,ho1,So1,co1,do1]});import{DBOS as X90}from"@dbos-inc/dbos-sdk";async function nt8($){let Z=l8(),X=new Ob(Z.db);await io1($.orgId,$.createdBy,X)}async function tt8($){let Z=l8(),X=new Ob(Z.db);for(let Q of lw){let Y=Q.getId($.orgId),G=await X.findById(Y,$.orgId);if(!G)continue;let J=Q.selectedPrompts?[...Q.selectedPrompts]:null;if(G.connections.every((K)=>{let H=K.selected_prompts;if(J===null)return H===null;if(H===null)return!1;if(H.length!==J.length)return!1;return H.every((F,N)=>F===J[N])}))continue;await X.update(Y,$.createdBy,{connections:G.connections.map((K)=>({connection_id:K.connection_id,selected_tools:K.selected_tools,selected_resources:K.selected_resources,selected_prompts:J}))})}}async function ot8($){await X90.runStep(()=>nt8($),{name:"installStudioPack"}),await X90.runStep(()=>tt8($),{name:"backfillSelectedPrompts"})}async function wc0($){await X90.startWorkflow(rt8,{workflowID:`install-studio-pack:${at8}:${$.orgId}`})($)}async function po1(){let Z=await l8().db.selectFrom("member").select(["organizationId","userId"]).orderBy("createdAt","asc").execute(),X=new Map;for(let Q of Z)if(!X.has(Q.organizationId))X.set(Q.organizationId,Q.userId);await e50(Array.from(X),10,async([Q,Y])=>{try{await wc0({orgId:Q,createdBy:Y})}catch(G){console.error("[studio-pack-backfill] enqueue failed",{orgId:Q},G)}})}var rt8,at8="v6";var Q90=D(()=>{gG();Vy0();Cx();rt8=X90.registerWorkflow(ot8,{name:"installStudioPackWorkflow"})});class Vi{constructor(){this._messageQueue=[]}static createLinkedPair(){let $=new Vi,Z=new Vi;return $._otherTransport=Z,Z._otherTransport=$,[$,Z]}async start(){while(this._messageQueue.length>0){let $=this._messageQueue.shift();this.onmessage?.($.message,$.extra)}}async close(){let $=this._otherTransport;this._otherTransport=void 0,await $?.close(),this.onclose?.()}async send($,Z){if(!this._otherTransport)throw Error("Not connected");if(this._otherTransport.onmessage)this._otherTransport.onmessage($,{authInfo:Z?.authInfo});else this._otherTransport._messageQueue.push({message:$,extra:{authInfo:Z?.authInfo}})}}import{z as X4}from"zod";var Y90,no1,to1,oo1,ro1,ao1,so1,eo1,$r1,Zr1;var _x=D(()=>{Y90=X4.record(X4.string(),X4.array(X4.string())),no1=X4.object({id:X4.string().describe("Unique identifier for the API key"),name:X4.string().describe("Human-readable name for the API key"),userId:X4.string().describe("ID of the user who owns this API key"),permissions:Y90.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Example: { "self": ["API_KEY_CREATE"], "conn_abc123": ["SEND_MESSAGE"] }'),expiresAt:X4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:X4.string().datetime().describe("When the API key was created (ISO 8601)")}),to1=X4.object({name:X4.string().min(1).max(64).describe("Human-readable name for the API key"),permissions:Y90.describe(`Permissions to grant (REQUIRED \u2014 there is no implicit default). Format: { resource: [actions] }. Resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names (e.g., ["ORGANIZATION_GET"]) or ["*"] for all. Example: { "self": ["ORGANIZATION_GET", "COLLECTION_CONNECTIONS_LIST"] }. The key is authorized solely by this allowlist; the creator's role does not widen it.`),expiresIn:X4.number().positive().optional().describe("Expiration time in seconds. If not provided, key never expires."),metadata:X4.record(X4.string(),X4.unknown()).optional().describe("Additional metadata to store with the API key")}),oo1=X4.object({id:X4.string().describe("Unique identifier for the API key"),name:X4.string().describe("Human-readable name for the API key"),key:X4.string().describe("The actual API key value. STORE THIS SECURELY - it will not be shown again!"),permissions:Y90.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools'),expiresAt:X4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:X4.string().datetime().describe("When the API key was created (ISO 8601)")}),ro1=X4.object({}),ao1=X4.object({items:X4.array(no1).describe("List of API keys (without key values)")}),so1=X4.object({keyId:X4.string().describe("ID of the API key to update"),name:X4.string().min(1).max(64).optional().describe("New name for the API key"),permissions:Y90.optional().describe('New permissions. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names or "*" for all. Example: { "self": ["API_KEY_CREATE"] }. Replaces existing permissions.'),metadata:X4.record(X4.string(),X4.unknown()).optional().describe("New metadata. Replaces existing metadata.")}),eo1=X4.object({item:no1.describe("The updated API key (without key value)")}),$r1=X4.object({keyId:X4.string().describe("ID of the API key to delete")}),Zr1=X4.object({success:X4.boolean().describe("Whether the deletion was successful"),keyId:X4.string().describe("ID of the deleted API key")})});var Ec0;var Xr1=D(()=>{C4();S0();_x();Ec0=c({name:"API_KEY_CREATE",description:"Create an API key with scoped permissions. The key value is returned only once \u2014 store it immediately.",annotations:{title:"Create API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:to1,outputSchema:oo1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.create({name:$.name,permissions:$.permissions,expiresIn:$.expiresIn,metadata:{...$.metadata,organization:Z.organization}}),Q=X.expiresAt?X.expiresAt instanceof Date?X.expiresAt.toISOString():X.expiresAt:null,Y=X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,G=Y1(Z);if(G)y1.capture({distinctId:G,event:"api_key_created",...Z.organization?.id?{groups:{organization:Z.organization.id}}:{},properties:{key_id:X.id,key_name:X.name??$.name,organization_id:Z.organization?.id,has_expiry:!!Q}});return{id:X.id,name:X.name??$.name,key:X.key,permissions:X.permissions??{},expiresAt:Q,createdAt:Y}}})});var jc0;var Qr1=D(()=>{C4();S0();_x();jc0=c({name:"API_KEY_DELETE",description:"Delete and instantly revoke an API key. Cannot be undone.",annotations:{title:"Delete API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:$r1,outputSchema:Zr1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to delete API key");let Y=(await Z.boundAuth.apiKey.list())?.find((K)=>K.id===$.keyId);if(!Y)throw Error("API key not found");let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot delete API key from another organization");if(await Z.boundAuth.apiKey.delete($.keyId),W)y1.capture({distinctId:X,event:"api_key_deleted",groups:{organization:W},properties:{key_id:$.keyId,organization_id:W}});return{success:!0,keyId:$.keyId}}})});var zc0;var Yr1=D(()=>{S0();_x();zc0=c({name:"API_KEY_LIST",description:"List API keys for the current user in the current organization. Returns metadata only \u2014 key values are never shown after creation.",annotations:{title:"List API Keys",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ro1,outputSchema:ao1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.list(),Q=Z.organization?.id;return{items:(X??[]).filter((G)=>{return G.metadata?.organization?.id===Q}).map((G)=>({id:G.id,name:G.name??"Unnamed Key",userId:G.userId,permissions:G.permissions??{},expiresAt:G.expiresAt?G.expiresAt instanceof Date?G.expiresAt.toISOString():G.expiresAt:null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});var Pc0;var Gr1=D(()=>{S0();_x();Pc0=c({name:"API_KEY_UPDATE",description:"Update an API key's name, permissions, or metadata. The key value cannot be changed or retrieved.",annotations:{title:"Update API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:so1,outputSchema:eo1,handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to update API key");let Y=(await Z.boundAuth.apiKey.list())?.find((H)=>H.id===$.keyId);if(!Y)throw Error(`API key not found: ${$.keyId}`);let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot update API key from another organization");let K=await Z.boundAuth.apiKey.update({keyId:$.keyId,name:$.name,permissions:$.permissions,metadata:{...$.metadata,organization:Z.organization}});if(!K)throw Error(`Failed to update API key: ${$.keyId}`);return{item:{id:K.id,name:K.name??$.name??"Unnamed Key",userId:K.userId,permissions:K.permissions??{},expiresAt:K.expiresAt?K.expiresAt instanceof Date?K.expiresAt.toISOString():K.expiresAt:null,createdAt:K.createdAt instanceof Date?K.createdAt.toISOString():K.createdAt}}}})});var Jr1=D(()=>{Xr1();Qr1();Yr1();Gr1();_x()});function VO($){let Z=$.trim();if(!Z)return{ok:!1,error:"Enter a website URL."};let X=et8.test(Z),Q=$o8.test(Z),Y=Zo8.test(Z);if(X&&!Q&&!Y)return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let G=Q?Z:`https://${Z}`,J;try{J=new URL(G)}catch{return{ok:!1,error:"Enter a valid website URL."}}if(J.protocol!=="http:"&&J.protocol!=="https:")return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let W=J.hostname.split(".");if(W.length<2||W.some((K)=>!K||!Xo8.test(K)))return{ok:!1,error:"Enter a valid website URL."};return J.protocol="https:",{ok:!0,value:J.origin}}var et8,$o8,Zo8,Xo8;var Si=D(()=>{et8=/^[a-zA-Z][a-zA-Z\d+.-]*:/,$o8=/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//,Zo8=/^[^\s/:?#]+\.[^\s/:?#]+:\d+(?:[/?#]|$)/,Xo8=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i});import{z as mX}from"zod";function QK($){if($.baseUrl)return $.baseUrl.replace(/\/+$/,"");return(($.settings??b0()).reportsInternalApiUrl??Qo8).replace(/\/+$/,"")}function Kr1($={}){return`${QK($)}/api/v2/mcp`}function dw($){let Z=$.apiKey??($.settings??b0()).reportsInternalApiKey;if(!Z)throw Error("REPORTS_INTERNAL_API_KEY (or the legacy COMMERCE_DISCOVERY_INTERNAL_API_KEY) is required to set up reports.");return Z}function G90($){return new URL($).hostname}function Go8($){return $==="ownership_unverified"||$==="already_claimed_by_other_org"}function Jo8($,Z={}){switch($){case"ownership_unverified":{let X=Z.email?`O e-mail ${Z.email}`:"Este e-mail",Q=Z.domain?` ${Z.domain}`:" este site";return`${X} n\xE3o tem permiss\xE3o para reivindicar${Q}. Use um e-mail do dom\xEDnio do site ou pe\xE7a ao suporte para autorizar seu dom\xEDnio.`}case"already_claimed_by_other_org":return"Este site j\xE1 pertence a outra organiza\xE7\xE3o. Fale com o suporte para transferir o acesso.";case"unknown":return"N\xE3o foi poss\xEDvel configurar o Commerce Discovery. Tente novamente ou fale com o suporte.";default:return $}}async function Wo8($){let Z=await Ci($);return Go8(Z?.error)?Z.error:"unknown"}async function Ci($){let Z=await $.text().catch(()=>"");if(!Z)return;try{return JSON.parse(Z)}catch{return}}async function Ac0($){let Z=`Commerce Discovery auth failed with status ${$.status}.`,X=await $.text().catch(()=>"");if(!X)return Z;try{let Q=JSON.parse(X),Y=typeof Q.error==="string"?Q.error:typeof Q.message==="string"?Q.message:null;return Y?`Commerce Discovery auth failed: ${Y}.`:Z}catch{return Z}}async function Fr1($,Z={}){let X=QK(Z),Q=dw(Z),Y=Z.fetchImpl??fetch,G=G90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/upgrade`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.orgName?{name:$.orgName}:{},...$.email?{email:$.email}:{},...$.reportUrl?{report_url:$.reportUrl}:{}})});if(!W.ok){let H=await Wo8(W);throw new Hr1(H,{email:$.email,domain:G})}let K=Yo8.safeParse(await Ci(W));if(!K.success)throw Error("Commerce Discovery auth response did not include a token.");return{authorizationToken:K.data.token}}async function Nr1($,Z={}){let X=QK(Z),Q=dw(Z),Y=Z.fetchImpl??fetch,G=G90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/bindings`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,provider:$.provider,resource_id:$.resourceId})});if(W.status===409)return{ok:!1,reason:"resource_already_bound",detail:"Este recurso j\xE1 est\xE1 vinculado a outra loja. Se ele \xE9 seu, fale com o suporte para revis\xE3o manual."};if(W.status===422){let H=Wr1.safeParse(await Ci(W));return{ok:!1,reason:H.success?H.data.reason??"verification_failed":"verification_failed",detail:(H.success?H.data.detail:void 0)??"N\xE3o foi poss\xEDvel verificar o acesso a este recurso."}}if(!W.ok)throw Error(await Ac0(W));let K=Wr1.safeParse(await Ci(W));if(!K.success||!K.data.binding)throw Error("Commerce Discovery bind response did not include a binding.");return{ok:!0,resourceId:K.data.binding.resource_id,evidence:K.data.binding.evidence}}async function Ur1($,Z={}){let X=QK(Z),Q=dw(Z),Y=Z.fetchImpl??fetch,G=G90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/run`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.githubRepo?{github_repo:$.githubRepo}:{}})});if(W.status===409)return{triggered:!1,reason:"not_upgraded"};if(!W.ok)throw Error(await Ac0(W));return{triggered:!0}}async function Or1($,Z={}){let X=QK(Z),Q=dw(Z),Y=Z.fetchImpl??fetch,G=G90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/connections/status?org_id=${encodeURIComponent($.orgId)}`,W=await Y(J,{method:"GET",headers:{Authorization:`Bearer ${Q}`}});if(W.status===404||W.status===409)return{providers:{},claimed:!1};if(!W.ok)throw Error(await Ac0(W));let K=Ko8.safeParse(await Ci(W));return{providers:K.success?K.data.providers:{},claimed:!0}}var Qo8,Yo8,Wr1,Hr1,Ko8;var mw=D(()=>{P8();q$();Qo8=new URL(iy1).origin,Yo8=mX.object({token:mX.string().min(1)}),Wr1=mX.object({binding:mX.object({resource_id:mX.string(),evidence:mX.string()}).optional(),reason:mX.string().optional(),detail:mX.string().optional()});Hr1=class Hr1 extends Error{code;constructor($,Z={}){super(Jo8($,Z));this.name="CommerceDiscoveryClaimError",this.code=$}};Ko8=mX.object({providers:mX.record(mX.string(),mX.object({connected:mX.boolean(),via:mX.enum(["oauth","sa"]).nullable(),resource:mX.string().nullable()}))})});import{z as bY}from"zod";var Ho8,Fo8,Tc0;var Br1=D(()=>{Si();S0();mw();Ho8=bY.object({siteUrl:bY.string().min(1).describe("Website URL of the store being bound."),provider:bY.enum(["ga4","gsc"]).describe("Which Google source to bind: ga4 (Analytics) or gsc (Search Console)."),resourceId:bY.string().min(1).describe("The resource id the client typed: GA4 numeric property id, or GSC site (sc-domain:example.com or https://example.com/).")}),Fo8=bY.discriminatedUnion("ok",[bY.object({ok:bY.literal(!0),resourceId:bY.string(),evidence:bY.string()}),bY.object({ok:bY.literal(!1),reason:bY.string(),detail:bY.string()})]),Tc0=c({name:"COMMERCE_DISCOVERY_BIND",description:"Bind a GA4 property or GSC site to the org's store via the shared service account (consent-free lane). The client grants deco-reader@\u2026 access to the resource and provides its id; Commerce Discovery verifies the resource belongs to this domain before persisting. Returns ok:false with an actionable pt-BR detail when verification fails or the resource is already bound elsewhere.",annotations:{title:"Bind Commerce Discovery Data Source",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Ho8,outputSchema:Fo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);return Nr1({siteUrl:Q.value,orgId:X.id,provider:$.provider,resourceId:$.resourceId.trim()})}})});import{z as YK}from"zod";var No8,Uo8,Rc0;var Dr1=D(()=>{Si();S0();mw();No8=YK.object({siteUrl:YK.string().min(1).describe("Website URL of the store to inspect.")}),Uo8=YK.object({providers:YK.record(YK.string(),YK.object({connected:YK.boolean(),via:YK.enum(["oauth","sa"]).nullable(),resource:YK.string().nullable()})),claimed:YK.boolean().describe("False when the site isn't claimed/upgraded for this org \u2014 providers is then empty because the status is unreadable, NOT because nothing is connected. The UI must warn instead of rendering existing bindings as disconnected.")}),Rc0=c({name:"COMMERCE_DISCOVERY_CONNECTION_STATUS",description:"Read per-provider connection status (ga4/gsc/vtex) for the org's store \u2014 { connected, via: oauth|sa, resource }. The single source of truth for whether a data source is connected, unifying the OAuth (Studio vault) and shared-SA binding lanes. Read-only.",annotations:{title:"Commerce Discovery Connection Status",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:No8,outputSchema:Uo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);return Or1({siteUrl:Q.value,orgId:X.id})}})});import{z as _i}from"zod";var Oo8,Bo8,Ic0;var Lr1=D(()=>{P8();Si();S0();mw();Oo8=_i.object({siteUrl:_i.string().min(1).describe("Website URL to run the diagnostic for.")}),Bo8=_i.object({triggered:_i.boolean(),reason:_i.string().optional()}),Ic0=c({name:"COMMERCE_DISCOVERY_RUN",description:"Trigger the Commerce Discovery diagnostic run for the current organization's store. Call once the data sources (GA4/GSC/VTEX) are connected \u2014 this run resolves credentials and produces the enriched report.",annotations:{title:"Run Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Oo8,outputSchema:Bo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);let Y=S8.COMMERCE_DISCOVERY(X.id),J=(await Z.storage.connections.findById(Y,X.id))?.configuration_state,W=J&&typeof J==="object"&&typeof J.github_repo==="string"&&J.github_repo.length>0?J.github_repo:void 0;return Ur1({siteUrl:Q.value,orgId:X.id,githubRepo:W})}})});var SO=D(()=>{K80()});import{z as GK}from"zod";async function Eo8($,Z,X,Q){let Y=await $.storage.connections.findById(Z,X);if(Y)return Y;throw Q}async function jo8($,Z,X,Q){let Y=await $.storage.virtualMcps.findById(Z,X);if(Y)return Y;throw Q}var qc0,Do8=3600000,Lo8,wo8,Mc0;var wr1=D(()=>{P8();Si();S0();yW();SO();mw();qc0=k40,Lo8=GK.object({siteUrl:GK.string().min(1).describe("Website URL to configure.")}),wo8=GK.object({connection:g7,virtualMcp:h7,reportApp:GK.object({connectionId:GK.string(),virtualMcpId:GK.string(),toolName:GK.literal(qc0)}),created:GK.object({connection:GK.boolean(),virtualMcp:GK.boolean()})});Mc0=c({name:"COMMERCE_DISCOVERY_SETUP",description:"Create or return the Commerce Discovery connection and virtual MCP for the current organization.",annotations:{title:"Set Up Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Lo8,outputSchema:wo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check("COLLECTION_CONNECTIONS_CREATE");let Q=Y1(Z);if(!Q)throw Error("User ID required to set up Commerce Discovery");let Y=VO($.siteUrl);if(!Y.ok)throw Error(Y.error);let G=S8.COMMERCE_DISCOVERY(X.id),J=S40(X.id),W=new URLSearchParams({virtualmcpid:J,main:`app:${G}:${qc0}`}),K={email:Z.auth.user?.email,reportUrl:`${Z.baseUrl}/${encodeURIComponent(X.slug??X.id)}/${crypto.randomUUID()}?${W.toString()}`},H=await Z.storage.connections.findById(G,X.id),F={connection:!1,virtualMcp:!1},N=await Fr1({siteUrl:Y.value,orgId:X.id,orgName:X.name,...K}),U=Kr1();if(H)console.log("[commerce-discovery] syncing connection to claimed site",{orgId:X.id,siteUrl:Y.value,connectionId:G}),H=await Z.storage.connections.update(H.id,{connection_url:U,connection_token:N.authorizationToken,metadata:{...H.metadata??{},siteUrl:Y.value}});else{console.log("[commerce-discovery] creating connection",{orgId:X.id,siteUrl:Y.value,connectionId:G});try{let w=Yg1(X.id,N.authorizationToken,U);H=await Z.storage.connections.create({...w,metadata:{...w.metadata??{},siteUrl:Y.value},organization_id:X.id,created_by:Q}),F.connection=!0}catch(w){H=await Eo8(Z,G,X.id,w)}}let O=await Z.storage.virtualMcps.findById(J,X.id);if(!O){console.log("[commerce-discovery] creating virtual MCP",{orgId:X.id,siteUrl:Y.value,connectionId:H.id,virtualMcpId:J});try{O=await Z.storage.virtualMcps.create(X.id,Q,Gg1(X.id,H.id),{id:J}),F.virtualMcp=!0}catch(w){O=await jo8(Z,J,X.id,w)}}if(!O.pinned)O=await Z.storage.virtualMcps.update(O.id,Q,{pinned:!0});let B=await Z.db.selectFrom("organization").select(["createdAt"]).where("id","=",X.id).executeTakeFirst();if((B?Date.now()-new Date(B.createdAt).getTime():Number.POSITIVE_INFINITY)<Do8){let E=(await Z.storage.organizationSettings.get(X.id))?.flags,j={};if(E?.reports_only==null)j.reports_only=!0;if(Object.keys(j).length>0)await Z.storage.organizationSettings.upsert(X.id,{flags:j})}return{connection:H,virtualMcp:O,reportApp:{connectionId:H.id,virtualMcpId:O.id,toolName:qc0},created:F}}})});var Er1=D(()=>{Br1();Dr1();Lr1();wr1()});var kc0=_((jr1)=>{Object.defineProperty(jr1,"__esModule",{value:!0});jr1.kvPrefix=jr1.KvWatchInclude=void 0;jr1.KvWatchInclude={LastValue:"",AllHistory:"history",UpdatesOnly:"updates"};jr1.kvPrefix="KV_"});var Cr1=_((Vr1)=>{Object.defineProperty(Vr1,"__esModule",{value:!0});Vr1.KvStatusImpl=Vr1.Bucket=Vr1.Kvm=Vr1.kvOperationHdr=void 0;Vr1.Base64KeyCodec=Ao8;Vr1.NoopKvCodecs=Vc0;Vr1.defaultBucketOpts=Ar1;Vr1.validateKey=Tr1;Vr1.validateSearchKey=Rr1;Vr1.hasWildcards=Ir1;Vr1.validateBucket=J90;var x5=EY(),X5=as(),b5=kc0();function Ao8(){let $=(Z,X)=>{let Q=[];for(let Y of Z.split("."))switch(Y){case">":case"*":Q.push(Y);break;default:Q.push(X(Y));break}return Q.join(".")};return{encode(Z){return $(Z,btoa)},decode(Z){return $(Z,atob)}}}function Vc0(){return{key:{encode($){return $},decode($){return $}},value:{encode($){return typeof $==="string"?new TextEncoder().encode($):$},decode($){return $}}}}function Ar1(){return{replicas:1,history:1,timeout:2000,max_bytes:-1,maxValueSize:-1,codec:Vc0(),storage:X5.StorageType.File}}Vr1.kvOperationHdr="KV-Operation";var Pr1="$KV",To8=/^[-/=.\w]+$/,Ro8=/^[-/=.>*\w]+$/,Io8=/^[-\w]+$/;function Tr1($){if($.startsWith(".")||$.endsWith(".")||!To8.test($))throw Error(`invalid key: ${$}`)}function Rr1($){if($.startsWith(".")||$.endsWith(".")||$.includes("..")||!Ro8.test($))throw Error(`invalid key: ${$}`)}function Ir1($){if($.startsWith(".")||$.endsWith("."))throw Error(`invalid key: ${$}`);let Z=$.split("."),X=!1;for(let Q=0;Q<Z.length;Q++)switch(Z[Q]){case"*":X=!0;break;case">":if(Q!==Z.length-1)throw Error(`invalid key: ${$}`);X=!0;break;default:}return X}function J90($){if(!Io8.test($))throw Error(`invalid bucket name: ${$}`)}class qr1{js;constructor($){this.js=(0,X5.toJetStreamClient)($)}create($,Z={}){return this.#$($,Z)}open($,Z={}){return Z.bindOnly=!0,this.#$($,Z)}#$($,Z={}){let{ok:X,min:Q}=this.js.nc.features.get(x5.Feature.JS_KV);if(!X)return Promise.reject(Error(`kv is only supported on servers ${Q} or better`));if(Z.bindOnly)return vx.bind(this.js,$,Z);return vx.create(this.js,$,Z)}list(){let $=(X)=>{let Y=X.streams.filter((J)=>{return J.config.name.startsWith(b5.kvPrefix)});Y.forEach((J)=>{J.config.sealed=J.config.sealed||!1,J.config.deny_delete=J.config.deny_delete||!1,J.config.deny_purge=J.config.deny_purge||!1,J.config.allow_rollup_hdrs=J.config.allow_rollup_hdrs||!1});let G="";if(Y.length)G=this.js.nc.info?.cluster??"";return Y.map((J)=>{return new W90(J,G)})},Z=`${this.js.prefix}.STREAM.LIST`;return new X5.ListerImpl(Z,$,this.js)}}Vr1.Kvm=qr1;class vx{js;jsm;stream;bucket;direct;codec;prefix;editPrefix;useJsPrefix;_prefixLen;constructor($,Z,X){J90($),this.js=Z,this.jsm=X,this.bucket=$,this.prefix=Pr1,this.editPrefix="",this.useJsPrefix=!1,this._prefixLen=0}static async create($,Z,X={}){J90(Z);let Q=await $.jetstreamManager(),Y=new vx(Z,$,Q);return await Y.init(X),Y}static async bind($,Z,X={}){let Q=$.getOptions()?.checkAPI||X.bindOnly===!1,Y=await $.jetstreamManager(Q),G={config:{allow_direct:X.allow_direct}};J90(Z);let J=new vx(Z,$,Y);return G.config.name=X.streamName??J.bucketName(),Object.assign(J,G),J.stream=G.config.name,J.codec=X.codec||Vc0(),J.direct=G.config.allow_direct??!1,J.initializePrefixes(G),J}async init($={}){let Z=Object.assign(Ar1(),$);this.codec=Z.codec;let X={};if(this.stream=X.name=$.streamName??this.bucketName(),X.retention=X5.RetentionPolicy.Limits,X.max_msgs_per_subject=Z.history,Z.max_bytes)X.max_bytes=Z.max_bytes;if(X.max_msg_size=Z.maxValueSize,X.storage=Z.storage,$.placement)X.placement=$.placement;if($.republish)X.republish=$.republish;if($.description)X.description=$.description;if($.markerTTL)X.allow_msg_ttl=!0,X.subject_delete_marker_ttl=(0,x5.nanos)(Z.markerTTL);if($.mirror){let H=Object.assign({},$.mirror);if(!H.name.startsWith(b5.kvPrefix))H.name=`${b5.kvPrefix}${H.name}`;X.mirror=H,X.mirror_direct=!0}else if($.sources){let H=$.sources.map((F)=>{let N=Object.assign({},F),U=N.name.startsWith(b5.kvPrefix)?N.name.substring(b5.kvPrefix.length):N.name;if(!N.name.startsWith(b5.kvPrefix))N.name=`${b5.kvPrefix}${N.name}`;if(!F.external&&U!==this.bucket)N.subject_transforms=[{src:`$KV.${U}.>`,dest:`$KV.${this.bucket}.>`}];return N});X.sources=H,X.subjects=[this.subjectForBucket()]}else X.subjects=[this.subjectForBucket()];if($.metadata)X.metadata=$.metadata;if(typeof $.compression==="boolean")X.compression=$.compression?X5.StoreCompression.S2:X5.StoreCompression.None;let Q=this.js.nc,Y=Q.getServerVersion(),G=Y?(0,x5.compare)(Y,(0,x5.parseSemVer)("2.7.2"))>=0:!1;X.discard=G?X5.DiscardPolicy.New:X5.DiscardPolicy.Old;let{ok:J,min:W}=Q.features.get(x5.Feature.JS_ALLOW_DIRECT);if(!J&&$.allow_direct===!0){let H=Y?`${Y.major}.${Y.minor}.${Y.micro}`:"unknown";return Promise.reject(Error(`allow_direct is not available on server version ${H} - requires ${W}`))}if($.allow_direct=typeof $.allow_direct==="boolean"?$.allow_direct:J,X.allow_direct=$.allow_direct,this.direct=X.allow_direct,X.num_replicas=Z.replicas,Z.ttl)X.max_age=(0,x5.nanos)(Z.ttl);X.allow_rollup_hdrs=!0;let K;try{if(K=await this.jsm.streams.info(X.name),!K.config.allow_direct&&this.direct===!0)this.direct=!1}catch(H){if(H.message==="stream not found")K=await this.jsm.streams.add(X);else throw H}this.initializePrefixes(K)}initializePrefixes($){this._prefixLen=0,this.prefix=`$KV.${this.bucket}`,this.useJsPrefix=this.js.apiPrefix!=="$JS.API";let{mirror:Z}=$.config;if(Z){let X=Z.name;if(X.startsWith(b5.kvPrefix))X=X.substring(b5.kvPrefix.length);if(Z.external&&Z.external.api!==""){let Q=Z.name.substring(b5.kvPrefix.length);this.useJsPrefix=!1,this.prefix=`$KV.${Q}`,this.editPrefix=`${Z.external.api}.$KV.${X}`}else this.editPrefix=this.prefix}}bucketName(){return this.stream??`${b5.kvPrefix}${this.bucket}`}subjectForBucket(){return`${this.prefix}.${this.bucket}.>`}subjectForKey($,Z=!1){let X=[];if(Z){if(this.useJsPrefix)X.push(this.js.apiPrefix);if(this.editPrefix!=="")X.push(this.editPrefix);else X.push(this.prefix)}else if(this.prefix)X.push(this.prefix);return X.push($),X.join(".")}fullKeyName($){if(this.prefix!=="")return`${this.prefix}.${$}`;return`${Pr1}.${this.bucket}.${$}`}get prefixLen(){if(this._prefixLen===0)this._prefixLen=this.prefix.length+1;return this._prefixLen}encodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.encode(X));break}return Z.join(".")}decodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.decode(X));break}return Z.join(".")}validateKey=Tr1;validateSearchKey=Rr1;hasWildcards=Ir1;close(){return Promise.resolve()}dataLen($,Z){let X=Z?Z.get(X5.JsHeaders.MessageSizeHdr)||"":"";if(X!=="")return parseInt(X,10);return $.length}smToEntry($){return new Mr1(this.bucket,this.prefixLen,$,this.codec)}jmToWatchEntry($,Z){return new kr1(this.bucket,this.prefixLen,$,Z,this.codec)}async create($,Z,X){let Q;try{let G={previousSeq:0},J=await this._put($,Z,G,X);return Promise.resolve(J)}catch(G){if(Q=G,G instanceof X5.JetStreamApiError){let J=G;if(J.code!==X5.JetStreamApiCodes.StreamWrongLastSequence&&J.code!==X5.JetStreamApiCodes.StreamWrongLastSequenceUnknown)return Promise.reject(G)}}let Y=0;try{let G=await this.get($);if(G?.operation==="DEL"||G?.operation==="PURGE")return Y=G!==null?G.revision:0,this._put($,Z,{previousSeq:Y},X);else return Promise.reject(Q)}catch(G){return Promise.reject(G)}}update($,Z,X,Q){if(X<=0)throw Error("version must be greater than 0");return this.put($,Z,{previousSeq:X,timeout:Q})}async _put($,Z,X={},Q){let Y=this.encodeKey($);this.validateKey(Y),Z=this.codec.value.encode(Z);let G={timeout:X?.timeout};if(X.previousSeq!==void 0){let J=(0,x5.headers)();G.headers=J,J.set(X5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`)}if(Q)(G.headers||(0,x5.headers)()).set(X5.PubHeaders.MessageTTL,Q);try{return(await this.js.publish(this.subjectForKey(Y,!0),Z,G)).seq}catch(J){return Promise.reject(J)}}put($,Z,X={}){return this._put($,Z,X)}async get($,Z){let X=this.encodeKey($);this.validateKey(X);let Q={last_by_subj:this.subjectForKey(X)};if(Z&&Z.revision>0)Q={seq:Z.revision};let Y=null;try{if(this.direct)Y=await this.jsm.direct.getMessage(this.bucketName(),Q);else Y=await this.jsm.streams.getMessage(this.bucketName(),Q);if(Y===null)return null;let G=this.smToEntry(Y);if(G.rawKey!==X)return null;return G}catch(G){throw G}}purge($,Z){return this._deleteOrPurge($,"PURGE",Z)}delete($,Z){return this._deleteOrPurge($,"DEL",Z)}async purgeDeletes($=1800000){let Z=[],X=await this.history({key:">"});await(async()=>{for await(let J of X)if(J.operation==="DEL"||J.operation==="PURGE")Z.push(J)})().then(),X.stop();let Q=Date.now()-$,Y=Z.map((J)=>{let W=this.subjectForKey(J.key);if(J.created.getTime()>=Q)return this.jsm.streams.purge(this.stream,{filter:W,keep:1});else return this.jsm.streams.purge(this.stream,{filter:W,keep:0})}),G=await Promise.all(Y);return G.unshift({success:!0,purged:0}),G.reduce((J,W)=>{return J.purged+=W.purged,J})}async _deleteOrPurge($,Z,X){if(!this.hasWildcards($))return this._doDeleteOrPurge($,Z,X);let Q=await this.keys($),Y=[];for await(let G of Q)if(Y.push(this._doDeleteOrPurge(G,Z)),Y.length===100)await Promise.all(Y),Y.length=0;if(Y.length>0)await Promise.all(Y)}async _doDeleteOrPurge($,Z,X){let Q=this.encodeKey($);this.validateKey(Q);let Y=(0,x5.headers)();if(Y.set(Vr1.kvOperationHdr,Z),Z==="PURGE"){let G=X;if(Y.set(X5.JsHeaders.RollupHdr,X5.JsHeaders.RollupValueSubject),typeof G?.ttl==="string"&&G.ttl!=="")Y.set(X5.PubHeaders.MessageTTL,`${G.ttl}`)}if(X?.previousSeq)Y.set(X5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`);await this.js.publish(this.subjectForKey(Q,!0),x5.Empty,{headers:Y})}_buildCC($,Z,X={}){let Y=(!Array.isArray($)?[$]:$).map((W)=>{let K=this.encodeKey(W);return this.validateSearchKey(W),this.fullKeyName(K)}),G=X5.DeliverPolicy.LastPerSubject;if(Z===b5.KvWatchInclude.AllHistory)G=X5.DeliverPolicy.All;if(Z===b5.KvWatchInclude.UpdatesOnly)G=X5.DeliverPolicy.New;let J=void 0;if(Y.length===1)J=Y[0],Y=void 0;return Object.assign({deliver_policy:G,ack_policy:X5.AckPolicy.None,filter_subjects:Y,filter_subject:J,flow_control:!0,idle_heartbeat:(0,x5.nanos)(5000)},X)}remove($){return this.purge($)}async history($={}){let Z=$.key??">",X={};X.headers_only=$.headers_only||!1;let Q=new x5.QueuedIteratorImpl,Y=()=>{Q.stop()},G=this._buildCC(Z,b5.KvWatchInclude.AllHistory,X),J=await this.js.consumers.getPushConsumer(this.stream,G);if(Q._data=J,(await J.info(!0)).num_pending===0)return Q.push(Y),Q;let K=await J.consume({callback:(H)=>{let F=this.jmToWatchEntry(H,!1);if(Q.push(F),Q.received++,H.info.pending===0)Q.push(Y)}});return K.closed().then(()=>{Q.push(Y)}),(async()=>{for await(let H of K.status())switch(H.type){case"heartbeat":Q.push(()=>{Q.stop()});break}})().then(),Q.iterClosed.then(()=>{K.stop()}),Q}canSetWatcherName(){let $=this.js.nc,{ok:Z}=$.features.get(x5.Feature.JS_NEW_CONSUMER_CREATE_API);return Z}async watch($={}){let Z=$.key??">",X=new x5.QueuedIteratorImpl,Q={};Q.headers_only=$.headers_only||!1;let Y=b5.KvWatchInclude.LastValue;if($.include===b5.KvWatchInclude.AllHistory)Y=b5.KvWatchInclude.AllHistory;else if($.include===b5.KvWatchInclude.UpdatesOnly)Y=b5.KvWatchInclude.UpdatesOnly;let G=$.ignoreDeletes===!0,J=this._buildCC(Z,Y,Q);if(J.name=`KV_WATCHER_${x5.nuid.next()}`,$.resumeFromRevision&&$.resumeFromRevision>0)J.deliver_policy=X5.DeliverPolicy.StartSequence,J.opt_start_seq=$.resumeFromRevision;let W=await this.js.consumers.getPushConsumer(this.stream,J),H=(await W.info(!0)).num_pending,F=Y===b5.KvWatchInclude.UpdatesOnly||H===0;X._data=W;let N=0,U=await W.consume({callback:(O)=>{if(!F)N++,F=N>=H;let B=this.jmToWatchEntry(O,F);if(G&&B.operation==="DEL")return;X.push(B),X.received++}});return X.iterClosed.then(()=>{U.stop()}),U.closed().then(()=>{X.push(()=>{X.stop()})}),X}async keys($=">"){let Z=new x5.QueuedIteratorImpl,X=this._buildCC($,b5.KvWatchInclude.LastValue,{headers_only:!0}),Q=await this.js.consumers.getPushConsumer(this.stream,X);if((await Q.info()).num_pending===0)return Z.stop(),Z;Z._data=Q;let G=await Q.consume({callback:(J)=>{let W=J.headers?.get(Vr1.kvOperationHdr);if(W!=="DEL"&&W!=="PURGE"){let K=this.decodeKey(J.subject.substring(this.prefixLen));Z.push(K)}if(J.info.pending===0)G.stop()}});return(async()=>{for await(let J of G.status())switch(J.type){case"heartbeat":Z.push(()=>{Z.stop()});break}})().then(),G.closed().then(()=>{Z.push(()=>{Z.stop()})}),Z.iterClosed.then(()=>{G.stop()}),Z}purgeBucket($){return this.jsm.streams.purge(this.bucketName(),$)}destroy(){return this.jsm.streams.delete(this.bucketName())}async status(){let Z=this.js.nc.info?.cluster??"",X=this.bucketName(),Q=await this.jsm.streams.info(X);return new W90(Q,Z)}}Vr1.Bucket=vx;class W90{si;cluster;constructor($,Z=""){this.si=$,this.cluster=Z}get bucket(){return this.si.config.name.startsWith(b5.kvPrefix)?this.si.config.name.substring(b5.kvPrefix.length):this.si.config.name}get values(){return this.si.state.messages}get history(){return this.si.config.max_msgs_per_subject}get ttl(){return(0,x5.millis)(this.si.config.max_age)}get markerTTL(){if(typeof this.si.config.subject_delete_marker_ttl==="number")return(0,x5.millis)(this.si.config.subject_delete_marker_ttl);return 0}get bucket_location(){return this.cluster}get backingStore(){return this.si.config.storage}get storage(){return this.si.config.storage}get replicas(){return this.si.config.num_replicas}get description(){return this.si.config.description??""}get maxBucketSize(){return this.si.config.max_bytes}get maxValueSize(){return this.si.config.max_msg_size}get max_bytes(){return this.si.config.max_bytes}get placement(){return this.si.config.placement||{cluster:"",tags:[]}}get placementCluster(){return this.si.config.placement?.cluster??""}get republish(){return this.si.config.republish??{src:"",dest:""}}get streamInfo(){return this.si}get size(){return this.si.state.bytes}get metadata(){return this.si.config.metadata??{}}get compression(){if(this.si.config.compression)return this.si.config.compression!==X5.StoreCompression.None;return!1}}Vr1.KvStatusImpl=W90;class Mr1{bucket;sm;prefixLen;codec;constructor($,Z,X,Q){this.bucket=$,this.prefixLen=Z,this.sm=X,this.codec=Q}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get delta(){return 0}get created(){return this.sm.time}get revision(){return this.sm.seq}get operation(){if(this.sm.header?.has("Nats-Marker-Reason")){if(this.sm.header?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.header?.get(Vr1.kvOperationHdr)||"PUT"}get length(){let $=this.sm.header.get(X5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}json($){return JSON.parse(x5.TD.decode(this.value),$)}string(){return x5.TD.decode(this.value)}}class kr1{bucket;sm;prefixLen;update;codec;constructor($,Z,X,Q,Y){this.bucket=$,this.prefixLen=Z,this.sm=X,this.update=Q,this.codec=Y}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get created(){return new Date((0,x5.millis)(this.sm.info.timestampNanos))}get revision(){return this.sm.seq}get operation(){if(this.sm.headers?.has("Nats-Marker-Reason")){if(this.sm.headers?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.headers?.get(Vr1.kvOperationHdr)||"PUT"}get delta(){return this.sm.info.pending}get length(){let $=this.sm.headers?.get(X5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}get isUpdate(){return this.update}json($){return JSON.parse(x5.TD.decode(this.value),$)}string(){return x5.TD.decode(this.value)}}});var Sc0=_((j3)=>{Object.defineProperty(j3,"__esModule",{value:!0});j3.validateKey=j3.validateBucket=j3.NoopKvCodecs=j3.Kvm=j3.defaultBucketOpts=j3.Bucket=j3.Base64KeyCodec=j3.KvWatchInclude=j3.kvPrefix=void 0;var _r1=kc0();Object.defineProperty(j3,"kvPrefix",{enumerable:!0,get:function(){return _r1.kvPrefix}});Object.defineProperty(j3,"KvWatchInclude",{enumerable:!0,get:function(){return _r1.KvWatchInclude}});var iw=Cr1();Object.defineProperty(j3,"Base64KeyCodec",{enumerable:!0,get:function(){return iw.Base64KeyCodec}});Object.defineProperty(j3,"Bucket",{enumerable:!0,get:function(){return iw.Bucket}});Object.defineProperty(j3,"defaultBucketOpts",{enumerable:!0,get:function(){return iw.defaultBucketOpts}});Object.defineProperty(j3,"Kvm",{enumerable:!0,get:function(){return iw.Kvm}});Object.defineProperty(j3,"NoopKvCodecs",{enumerable:!0,get:function(){return iw.NoopKvCodecs}});Object.defineProperty(j3,"validateBucket",{enumerable:!0,get:function(){return iw.validateBucket}});Object.defineProperty(j3,"validateKey",{enumerable:!0,get:function(){return iw.validateKey}})});var Cc0=_((CO)=>{Object.defineProperty(CO,"__esModule",{value:!0});CO.NoopKvCodecs=CO.Kvm=CO.defaultBucketOpts=CO.Bucket=CO.Base64KeyCodec=CO.KvWatchInclude=void 0;var xo8=Sc0();Object.defineProperty(CO,"KvWatchInclude",{enumerable:!0,get:function(){return xo8.KvWatchInclude}});var fi=Sc0();Object.defineProperty(CO,"Base64KeyCodec",{enumerable:!0,get:function(){return fi.Base64KeyCodec}});Object.defineProperty(CO,"Bucket",{enumerable:!0,get:function(){return fi.Bucket}});Object.defineProperty(CO,"defaultBucketOpts",{enumerable:!0,get:function(){return fi.defaultBucketOpts}});Object.defineProperty(CO,"Kvm",{enumerable:!0,get:function(){return fi.Kvm}});Object.defineProperty(CO,"NoopKvCodecs",{enumerable:!0,get:function(){return fi.NoopKvCodecs}})});function K90(){let $=new TextEncoder,Z=new TextDecoder;return{encode:(X)=>$.encode(JSON.stringify(X)),decode:(X)=>JSON.parse(Z.decode(X))}}class vc0{options;kv=null;codec=K90();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new fr1.Kvm($).create(go8,{storage:vr1.StorageType.Memory})}async get($,Z){if(!this.kv)return null;try{let X=await this.kv.get(`${$}.${Z}`);if(!X?.value?.length)return null;if(X.operation==="DEL"||X.operation==="PURGE")return null;return this.codec.decode(X.value)}catch{return null}}async set($,Z,X){if(!this.kv)return;try{await this.kv.put(`${$}.${Z}`,this.codec.encode(X))}catch{}}async invalidate($){if(!this.kv)return;await Promise.all(["tools","resources","prompts"].map(async(X)=>{try{await this.kv.delete(`${X}.${$}`)}catch{}}))}teardown(){this.kv=null}}function ho8($,Z,X){if(X<=0)return!0;if($===void 0)return!0;return Z-$>=X}function H90($){return $ instanceof L1&&$.code===q1.MethodNotFound}function uo8($){return $ instanceof L1&&$.code===-32000&&/connection closed/i.test($.message)}async function vO($,Z,X,Q,Y,G=0){if(!Q)try{return await X()}catch(H){if(H90(H))return[];return bi.add(1,{type:$,outcome:"error",stage:"no_cache"}),null}let J=`${$}:${Z}`,W=await Q.get($,Z);if(W===null)try{let H=await X();return Q.set($,Z,H).catch(()=>{}),_c0.set(J,Date.now()),bi.add(1,{type:$,outcome:"miss",stage:"miss"}),H}catch(H){if(H90(H))return Q.set($,Z,[]).catch(()=>{}),[];return bi.add(1,{type:$,outcome:"error",stage:"miss"}),null}if(bi.add(1,{type:$,outcome:"hit",stage:"hit"}),ho8(_c0.get(J),Date.now(),G)&&!F90.has(J)){F90.add(J),_c0.set(J,Date.now());let H=X().then((F)=>Q.set($,Z,F)).catch((F)=>{if(H90(F)||uo8(F)){if(H90(F))Q.set($,Z,[]).catch(()=>{});return}bi.add(1,{type:$,outcome:"error",stage:"revalidation"})}).finally(()=>F90.delete(J));Y?.(H)}return W}function fc0($){br1=$}function Z9(){return br1}var vr1,fr1,bi,go8="DECOCMS_MCP_LISTS",F90,_c0,_O=30000,br1=null;var xY=D(()=>{e5();I6();vr1=V(pD(),1),fr1=V(Cc0(),1),bi=L$.createCounter("mcp_list_cache.fetches",{description:"MCP list cache fetch outcomes (hit, miss, error)",unit:"{fetches}"});F90=new Set;L$.createObservableGauge("mcp_list_cache.pending_revalidations",{description:"In-flight background MCP list revalidations on this pod",unit:"{revalidations}"}).addCallback(($)=>$.observe(F90.size));_c0=new Map});async function bc0($,Z,X){let Q=new AbortController,Y,G=new Promise((W,K)=>{Y=setTimeout(()=>{Q.abort(),K(new xr1($.id,X))},X)}),J=(async()=>{let W=await N5($,Z,!0);try{return(await W.listTools(void 0,{timeout:X,signal:Q.signal})).tools}finally{await W.close().catch(()=>{})}})();J.catch(()=>{});try{return await Promise.race([J,G])}finally{if(Y)clearTimeout(Y)}}var xr1;var yr1=D(()=>{xi();xr1=class xr1 extends Error{constructor($,Z){super(`listTools timed out after ${Z}ms for connection ${$}`);this.name="ListToolsTimeoutError"}}});function N90($){return(Z)=>{if(Z instanceof L1&&Z.code===q1.MethodNotFound)return $;throw Z}}var gr1=D(()=>{e5()});function U90($,Z,X){let Q=fO($,Z,X,Z9()??void 0),Y=tL(Q,{name:"studio-mcp-server",version:"1.0.0"},{capabilities:co8,toolCallTimeoutMs:Nb});Y.server.setRequestHandler(IU,async()=>{return await Q.listResources().catch(N90({resources:[]}))}),Y.server.setRequestHandler(qU,async()=>{return await Q.listResourceTemplates().catch(N90({resourceTemplates:[]}))}),Y.server.setRequestHandler(MU,async()=>{return await Q.listPrompts().catch(N90({prompts:[]}))});let G=Y.close.bind(Y);return Y.close=async()=>{await G(),await Q.close().catch(()=>{})},Y}var co8;var hr1=D(()=>{yX();e5();yi();xY();gr1();co8={tools:{},resources:{},prompts:{}}});var DF=D(()=>{xi();yr1();hr1()});function gi($,Z,X){if(Z.some((Q)=>Q!=="*"&&Q.startsWith("SELF::"))&&$.SELF===void 0)$.SELF={value:`${X}_self`}}function hi($,Z){let X=new Map;for(let Q of Z){if(Q==="*")continue;let[Y,G]=Q50(Q);if(!lo8.has(G))continue;let J=pm(Y,$);if(typeof J!=="object"||J===null||!("value"in J))continue;let W=J.value;if(typeof W!=="string")continue;X.set(`${W}:${G}`,{targetConnectionId:W,scope:G})}return[...X.values()]}async function ui($,Z,X,Q){for(let J of Z){if(J==="*")continue;let[W]=Q50(J),K=pm(W,$);if(K===void 0||K===null)throw Error(`Scope references key "${W}" but it's not present in state`)}let Y=ud1($,Z),G=`${X}_self`;for(let J of Y){if(J===G)continue;let W=await Q.storage.connections.findById(J);if(!W||W.organization_id!==X)throw Error(`Referenced connection not found: ${J}`);try{await Q.access.check(J)}catch(K){throw Error(`Access denied to referenced connection: ${J}. ${K.message}`)}}}var lo8;var xc0=D(()=>{yh0();g40();lo8=new Set([x40,y40])});import{z as ur1}from"zod";var do8,mo8,yc0;var cr1=D(()=>{C4();S0();q$();xY();DF();xc0();ki();yW();do8=ur1.object({data:$80.describe("Data for the new connection (id is auto-generated if not provided)")}),mo8=ur1.object({item:g7.describe("The created connection entity")}),yc0=c({name:"COLLECTION_CONNECTIONS_CREATE",description:"Create a new MCP connection. Auto-fetches and caches the server's tool list.",annotations:{title:"Create Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:do8,outputSchema:mo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create connection");let Y={...$.data,organization_id:X.id,created_by:Q};if(Y.id){if((await Z.storage.connections.findById(Y.id))?.organization_id===X.id)throw Error("Connection already exists in organization")}if(Y.connection_type==="VIRTUAL"){let N=kf(Y.connection_url);if(!N)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let U=await Z.storage.virtualMcps.findById(N);if(!U)throw Error(`Virtual MCP not found: ${N}`);if(U.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");Y.connection_url=Vf(N)}if(Y.connection_type==="STDIO"&&!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let G=await kO({id:`pending-${Date.now()}`,title:Y.title,connection_type:Y.connection_type,connection_url:Y.connection_url,connection_token:Y.connection_token,connection_headers:Y.connection_headers}).catch(()=>null),J=G?.tools?.length?G.tools:null,W=G?.scopes?.length?G.scopes:Y.configuration_scopes??null,K=Y.configuration_state??null;if(K&&W?.length)gi(K,W,X.id),await ui(K,W,X.id,Z);let H=await Z.storage.connections.createNew({...Y,tools:null,configuration_state:K,configuration_scopes:W}),F=K&&W?.length?hi(K,W):[];if(F.length>0){let N;try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:H.id,createdBy:Q,grants:F});let{plaintextToken:U,record:O}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:H.id});N=O.id,await(await N5(H,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:K,scopes:W,firstRun:!0,vault:{baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:H.id,token:U}}})}catch(U){if(N)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:H.id,tokenId:N});throw await Z.storage.connections.delete(H.id),U}}if(J)Z9()?.set("tools",H.id,J).catch(()=>{});return y1.capture({distinctId:Q,event:"connection_created",groups:{organization:X.id},properties:{connection_id:H.id,connection_type:H.connection_type,app_name:H.app_name??null,organization_id:X.id,tools_count:J?.length??0}}),{item:H}}})});import{z as uG}from"zod/v4";import{z as lr1}from"zod/v4";import{z as O90}from"zod/v4";import{z as JK}from"zod/v4";import{z as to8}from"zod/v4";import{z as pw}from"zod/v4";import{z as WK}from"zod/v4";import{z as _Z}from"zod/v4";import{z as dr1}from"zod/v4";import{z as L90}from"zod/v4";import{z as wr8}from"zod/v4";import{z as mr1}from"zod/v4";import{z as B90}from"zod/v4";import{z as qr8}from"zod/v4";function ci($,Z){if($===Z)return!0;if($==null||Z==null)return $===Z;if(typeof $!==typeof Z)return!1;if(Array.isArray($)&&Array.isArray(Z)){if($.length!==Z.length)return!1;return $.every((X,Q)=>ci(X,Z[Q]))}if(typeof $==="object"&&typeof Z==="object"){let X=Object.keys($),Q=Object.keys(Z);if(X.length!==Q.length)return!1;return X.every((Y)=>Q.includes(Y)&&ci($[Y],Z[Y]))}return!1}function Br8(){return($)=>{if(!Array.isArray($))return!0;let Z=[];return $.every((X)=>{if(Z.some((Y)=>ci(X,Y)))return!1;return Z.push(X),!0})}}function D90($,Z){return $.safeParse(Z).success}function U7($){if(typeof $==="boolean")return $?uG.any():uG.never();let Z={};for(let Y of Sr8)Y.apply(Z,$);let X=[];if(Z.string!==!1)X.push(Z.string||uG.string());if(Z.number!==!1)X.push(Z.number||uG.number());if(Z.boolean!==!1)X.push(Z.boolean||uG.boolean());if(Z.null!==!1)X.push(Z.null||uG.null());if(Z.array!==!1)X.push(Z.array||uG.array(uG.any()));if(Z.tuple!==!1&&Z.tuple!==void 0)X.push(Z.tuple);if(Z.object!==!1)if(Z.object)X.push(Z.object);else{let Y=uG.custom((G)=>{return typeof G==="object"&&G!==null&&!Array.isArray(G)},"Must be an object, not an array");X.push(Y)}if(Z.file!==!1&&Z.file!==void 0)X.push(Z.file);let Q;if(X.length===0)Q=uG.never();else if(X.length===1)Q=X[0];else if(!Object.keys($).some((G)=>G!=="$schema"&&G!=="title"&&G!=="description"))Q=uG.any();else Q=uG.union(X);for(let Y of Cr8)Q=Y.apply(Q,$);return Q}var io8=class{apply($,Z){if(!Z.type)return;let X=Array.isArray(Z.type)?Z.type:[Z.type],Q=new Set(X);if(!Q.has("string"))$.string=!1;if(!Q.has("number")&&!Q.has("integer"))$.number=!1;if(!Q.has("boolean"))$.boolean=!1;if(!Q.has("null"))$.null=!1;if(!Q.has("array"))$.array=!1;if(!Q.has("object"))$.object=!1;if(Q.has("integer")&&$.number!==!1){let Y=$.number||lr1.number();if(Y instanceof lr1.ZodNumber)$.number=Y.int()}}},po8=class{apply($,Z){if(Z.const===void 0)return;let X=Z.const;if($.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1,typeof X==="string")$.string=O90.literal(X);else if(typeof X==="number")$.number=O90.literal(X);else if(typeof X==="boolean")$.boolean=O90.literal(X);else if(X===null)$.null=O90.null();else if(Array.isArray(X))$.array=void 0;else if(typeof X==="object")$.object=void 0}},no8=class{apply($,Z){if(!Z.enum)return;if(Z.enum.length===0){if(!Z.type)$.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1;return}let X={string:Z.enum.filter((Q)=>typeof Q==="string"),number:Z.enum.filter((Q)=>typeof Q==="number"),boolean:Z.enum.filter((Q)=>typeof Q==="boolean"),null:Z.enum.filter((Q)=>Q===null),array:Z.enum.filter((Q)=>Array.isArray(Q)),object:Z.enum.filter((Q)=>typeof Q==="object"&&Q!==null&&!Array.isArray(Q))};$.string=this.createTypeSchema(X.string,"string"),$.number=this.createTypeSchema(X.number,"number"),$.boolean=this.createTypeSchema(X.boolean,"boolean"),$.null=X.null.length>0?JK.null():!1,$.array=X.array.length>0?void 0:!1,$.object=X.object.length>0?void 0:!1}createTypeSchema($,Z){if($.length===0)return!1;if($.length===1)return JK.literal($[0]);if(Z==="string")return JK.enum($);if(Z==="number"){let[X,Q,...Y]=$;return JK.union([JK.literal(X),JK.literal(Q),...Y.map((G)=>JK.literal(G))])}if(Z==="boolean")return JK.union([JK.literal(!0),JK.literal(!1)]);return!1}},oo8=class{apply($,Z){let X=Z;if(X.type==="string"&&X.format==="binary"&&X.contentEncoding==="binary"){let Q=to8.file();if(X.minLength!==void 0)Q=Q.min(X.minLength);if(X.maxLength!==void 0)Q=Q.max(X.maxLength);if(X.contentMediaType!==void 0)Q=Q.mime(X.contentMediaType);$.file=Q,$.string=!1}}},ro8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minLength!==void 0||X.maxLength!==void 0||X.pattern!==void 0)){if($.string===void 0)$.string=pw.string()}}},ao8=class{apply($,Z){let X=Z;if(X.minLength===void 0)return;if($.string!==!1){let Q=$.string||pw.string();if(Q instanceof pw.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length>=X.minLength},{message:`String must be at least ${X.minLength} characters long`})}}},so8=class{apply($,Z){let X=Z;if(X.maxLength===void 0)return;if($.string!==!1){let Q=$.string||pw.string();if(Q instanceof pw.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length<=X.maxLength},{message:`String must be at most ${X.maxLength} characters long`})}}},eo8=class{apply($,Z){let X=Z;if(!X.pattern)return;if($.string!==!1){let Q=$.string||pw.string();if(Q instanceof pw.ZodString){let Y=new RegExp(X.pattern);$.string=Q.regex(Y)}}}},$r8=class{apply($,Z){let X=Z;if(X.minimum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.min(X.minimum)}}},Zr8=class{apply($,Z){let X=Z;if(X.maximum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.max(X.maximum)}}},Xr8=class{apply($,Z){let X=Z;if(X.exclusiveMinimum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)if(typeof X.exclusiveMinimum==="number")$.number=Q.gt(X.exclusiveMinimum);else $.number=!1}}},Qr8=class{apply($,Z){let X=Z;if(X.exclusiveMaximum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)if(typeof X.exclusiveMaximum==="number")$.number=Q.lt(X.exclusiveMaximum);else $.number=!1}}},Yr8=class{apply($,Z){let X=Z;if(X.multipleOf===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.refine((Y)=>{if(X.multipleOf===0)return!1;let G=Y/X.multipleOf,J=Math.round(G),W=Math.min(Math.abs(Y)*Number.EPSILON*10,Math.abs(X.multipleOf)*Number.EPSILON*10);return Math.abs(G-J)<=W/Math.abs(X.multipleOf)},{message:`Must be a multiple of ${X.multipleOf}`})}}},Gr8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minItems!==void 0||X.maxItems!==void 0||X.items!==void 0||X.prefixItems!==void 0)){if($.array===void 0)$.array=_Z.array(_Z.any())}}},Jr8=class{apply($,Z){let X=Z;if(X.minItems===void 0)return;if($.array!==!1)$.array=($.array||_Z.array(_Z.any())).min(X.minItems)}},Wr8=class{apply($,Z){let X=Z;if(X.maxItems===void 0)return;if($.array!==!1)$.array=($.array||_Z.array(_Z.any())).max(X.maxItems)}},Kr8=class{apply($,Z){let X=Z;if($.array===!1)return;if(Array.isArray(X.items))$.array=$.array||_Z.array(_Z.any());else if(X.items&&typeof X.items!=="boolean"&&!X.prefixItems){let Q=U7(X.items),Y=_Z.array(Q);if($.array&&$.array instanceof _Z.ZodArray){let G=$.array._def;if(G.checks)G.checks.forEach((J)=>{if(J._zod&&J._zod.def){let W=J._zod.def;if(W.check==="min_length"&&W.minimum!==void 0)Y=Y.min(W.minimum);else if(W.check==="max_length"&&W.maximum!==void 0)Y=Y.max(W.maximum)}})}$.array=Y}else if(typeof X.items==="boolean"&&X.items===!1)if(!X.prefixItems)$.array=_Z.array(_Z.any()).max(0);else $.array=$.array||_Z.array(_Z.any());else if(typeof X.items==="boolean"&&X.items===!0)$.array=$.array||_Z.array(_Z.any());else if(X.prefixItems)$.array=$.array||_Z.array(_Z.any())}},Hr8=class{apply($,Z){if(Z.type!=="array")return;let X=Z;if(!Array.isArray(X.items))return;if($.array===!1)return;let Q=X.items.map((G)=>U7(G)),Y;if(Q.length===0)Y=dr1.tuple([]);else Y=dr1.tuple(Q);if(X.minItems!==void 0&&X.minItems>Q.length)Y=!1;if(X.maxItems!==void 0&&X.maxItems<Q.length)Y=!1;$.tuple=Y,$.array=!1}},Fr8=class{apply($,Z){let X=Z;if($.object===!1)return;if(X.properties||X.required||X.additionalProperties!==void 0)$.object=$.object||L90.object({}).passthrough()}},Nr8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.maxProperties!==void 0||X.minProperties!==void 0)){if($.object===void 0)$.object=L90.object({}).passthrough()}}},Ur8=class{apply($,Z){let X=Z;if(X.maxProperties===void 0)return;if($.object!==!1){let Q=$.object||L90.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length<=X.maxProperties,{message:`Object must have at most ${X.maxProperties} properties`})}}},Or8=class{apply($,Z){let X=Z;if(X.minProperties===void 0)return;if($.object!==!1){let Q=$.object||L90.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length>=X.minProperties,{message:`Object must have at least ${X.minProperties} properties`})}}},Dr8=class{apply($,Z){if(!Z.not)return $;let X=U7(Z.not);return $.refine((Q)=>!D90(X,Q),{message:"Value must not match the 'not' schema"})}},Lr8=class{apply($,Z){if(Z.uniqueItems!==!0)return $;return $.refine(Br8(),{message:"Array items must be unique"})}},Er8=class{apply($,Z){if(!Z.allOf||Z.allOf.length===0)return $;return Z.allOf.map((Q)=>U7(Q)).reduce((Q,Y)=>wr8.intersection(Q,Y),$)}},jr8=class{apply($,Z){if(!Z.anyOf||Z.anyOf.length===0)return $;let X=Z.anyOf.length===1?U7(Z.anyOf[0]):mr1.union([U7(Z.anyOf[0]),U7(Z.anyOf[1]),...Z.anyOf.slice(2).map((Q)=>U7(Q))]);return mr1.intersection($,X)}},zr8=class{apply($,Z){if(!Z.oneOf||Z.oneOf.length===0)return $;let X=Z.oneOf.map((Q)=>U7(Q));return $.refine((Q)=>{let Y=0;for(let G of X)if(G.safeParse(Q).success){if(Y++,Y>1)return!1}return Y===1},{message:"Value must match exactly one of the oneOf schemas"})}},Pr8=class{apply($,Z){let X=Z;if(X.prefixItems&&Array.isArray(X.prefixItems)){let Y=X.prefixItems.map((G)=>U7(G));return $.refine((G)=>{if(!Array.isArray(G))return!0;for(let J=0;J<Math.min(G.length,Y.length);J++)if(!D90(Y[J],G[J]))return!1;if(G.length>Y.length){if(typeof X.items==="boolean"&&X.items===!1)return!1;else if(X.items&&typeof X.items==="object"&&!Array.isArray(X.items)){let J=U7(X.items);for(let W=Y.length;W<G.length;W++)if(!D90(J,G[W]))return!1}}return!0},{message:"Array does not match prefixItems schema"})}return $}},Ar8=class{apply($,Z){let X=Z;if(!X.properties&&!X.required&&X.additionalProperties!==!1)return $;if($ instanceof B90.ZodObject||$ instanceof B90.ZodRecord){let Q={};if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0)Q[Y]=U7(G)}if(X.required&&Array.isArray(X.required)){let Y=new Set(X.required);for(let G of Object.keys(Q))if(!Y.has(G))Q[G]=Q[G].optional()}else for(let Y of Object.keys(Q))Q[Y]=Q[Y].optional();if(X.additionalProperties===!1)return B90.object(Q);else return B90.object(Q).passthrough()}return $.refine((Q)=>{if(typeof Q!=="object"||Q===null||Array.isArray(Q))return!0;if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0){if(Object.getOwnPropertyDescriptor(Q,Y)!==void 0){if(!U7(G).safeParse(Q[Y]).success)return!1}}}if(X.required&&Array.isArray(X.required)){for(let Y of X.required)if(Object.getOwnPropertyDescriptor(Q,Y)===void 0)return!1}if(X.additionalProperties===!1&&X.properties){let Y=new Set(Object.keys(X.properties));for(let G in Q)if(!Y.has(G))return!1}return!0},{message:"Object constraints validation failed"})}},Tr8=class{apply($,Z){if(!Z.enum||Z.enum.length===0)return $;let X=Z.enum.filter((Q)=>Array.isArray(Q)||typeof Q==="object"&&Q!==null);if(X.length===0)return $;return $.refine((Q)=>{if(typeof Q!=="object"||Q===null)return!0;return X.some((Y)=>ci(Q,Y))},{message:"Value must match one of the enum values"})}},Rr8=class{apply($,Z){if(Z.const===void 0)return $;let X=Z.const;if(typeof X!=="object"||X===null)return $;return $.refine((Q)=>ci(Q,X),{message:"Value must equal the const value"})}},Ir8=class{apply($,Z){if(Z.description)$=$.describe(Z.description);return $}},Mr8=class{apply($,Z){var X;let Q=Z;if(!((X=Q.required)==null?void 0:X.includes("__proto__"))||Z.type!==void 0)return $;return qr8.any().refine((Y)=>this.validateRequired(Y,Q.required),{message:"Missing required properties"})}validateRequired($,Z){if(typeof $!=="object"||$===null||Array.isArray($))return!0;return Z.every((X)=>Object.prototype.hasOwnProperty.call($,X))}},kr8=class{apply($,Z){var X;let Q=Z;if(Q.contains===void 0)return $;let Y=U7(Q.contains),G=(X=Q.minContains)!=null?X:1,J=Q.maxContains;return $.refine((W)=>{if(!Array.isArray(W))return!0;let K=0;for(let H of W)if(D90(Y,H))K++;if(K<G)return!1;if(J!==void 0&&K>J)return!1;return!0},{message:"Array must contain required items matching the schema"})}},Vr8=class{apply($,Z){let{default:X}=Z;if(X===void 0)return $;if(!$.safeParse(X).success)return $;return $.default(X)}},Sr8,Cr8;var ir1=D(()=>{Sr8=[new po8,new no8,new io8,new oo8,new ro8,new Gr8,new Nr8,new ao8,new so8,new eo8,new $r8,new Zr8,new Xr8,new Qr8,new Yr8,new Hr8,new Jr8,new Wr8,new Kr8,new Ur8,new Or8,new Fr8],Cr8=[new Mr8,new Tr8,new Rr8,new Er8,new jr8,new zr8,new Pr8,new Ar8,new kr8,new Dr8,new Lr8,new Vr8,new Ir8]});class gc0{constructor($){this._url=$}start(){if(this._socket)throw Error("WebSocketClientTransport already started! If using Client class, note that connect() calls start() automatically.");return new Promise(($,Z)=>{this._socket=new WebSocket(this._url,_r8),this._socket.onerror=(X)=>{let Q="error"in X?X.error:Error(`WebSocket error: ${JSON.stringify(X)}`);Z(Q),this.onerror?.(Q)},this._socket.onopen=()=>{$()},this._socket.onclose=()=>{this.onclose?.()},this._socket.onmessage=(X)=>{let Q;try{Q=VY.parse(JSON.parse(X.data))}catch(Y){this.onerror?.(Y);return}this.onmessage?.(Q)}})}async close(){this._socket?.close()}send($){return new Promise((Z,X)=>{if(!this._socket){X(Error("Not connected"));return}this._socket?.send(JSON.stringify($)),Z()})}}var _r8="mcp";var pr1=D(()=>{e5()});function vr8($){let Z=$;if(!Z||typeof Z!=="object"||!("method"in Z))return null;switch(Z.method){case"initialize":{let X=Z?.params?.protocolVersion;if(!X)return null;return{type:"emit",message:{result:{protocolVersion:X,capabilities:{tools:{}},serverInfo:{name:"deco-chat-server",version:"1.0.0"}},jsonrpc:Z.jsonrpc??"2.0",id:Z.id}}}case"notifications/roots/list_changed":case"notifications/initialized":case"notifications/cancelled":case"notifications/progress":return{type:"suppress"};default:return null}}var w90;var hc0=D(()=>{ef();w90=class w90 extends mW{constructor($,Z){super($,Z)}send($,Z){let X=vr8($);if(X?.type==="emit")return this.onmessage?.(X.message),Promise.resolve();if(X?.type==="suppress")return Promise.resolve();return super.send($,Z)}}});var nr1,tr1=async($,Z,X)=>{let Q=fr8($.connection,Z,X);if(!Q)throw Error("Unknown MCP connection type");let Y=new nr1({name:$?.name??"MCP Client",version:"1.0.0"});return await Y.connect(Q),{client:Y}},fr8=($,Z,X)=>{if($.type==="Websocket")return new gc0(new URL($.url));if($.type!=="SSE"&&$.type!=="HTTP")return null;let Y={...$.token?{authorization:`Bearer ${$.token}`}:{},...X??{},..."headers"in $?$.headers||{}:{}};if($.type==="SSE"){let G={requestInit:{headers:Y,signal:Z}};if($.token)G.eventSourceInit={fetch:(J,W)=>{return fetch(J,{...W,headers:{...Y,Accept:"text/event-stream"},signal:Z})}};return new QF(new URL($.url),G)}return new w90(new URL($.url),{requestInit:{headers:Y,signal:Z,credentials:"include"}})};var or1=D(()=>{lW();Ad();pr1();e5();yX();hc0();nr1=class nr1 extends y9{constructor($,Z){super($,{jsonSchemaValidator:F5,...Z})}async listTools($,Z){return await this.request({method:"tools/list",params:$},yl,Z)}}});function xr8($,Z){if(nw.set($,Z),nw.size>br8){let X=nw.keys().next().value;if(X!==void 0)nw.delete(X)}}function sr1($){let Z=(X)=>{if("connection"in $)return tr1({connection:$.connection},void 0,X);return $.client};return new Proxy({},{get(X,Q){if(Q==="toJSON")return null;if(typeof Q!=="string")throw Error("Name must be a string");if(Q==="listTools")return W;async function Y(K,H=Q){let F=$?.debugId?.(),N=F?{"x-trace-debug-id":F}:void 0,{client:U}=await Z(N),{structuredContent:O,isError:B,content:L}=await U.callTool({name:String(H),arguments:K});if(B){let E=L?.[0]?.text,j=typeof E==="string"?rr1(E):null,z=j?.code&&typeof $?.getErrorByStatusCode==="function"?$.getErrorByStatusCode(j.code,j.message,j.traceId):null;if(z)throw z;throw Error(`Tool ${String(H)} returned an error: ${JSON.stringify(O??L)}`)}if(O!==void 0)return O;let w=L?.[0]?.text;return typeof w==="string"?rr1(w):void 0}async function G(){let{client:K}=await Z(),{tools:H}=await K.listTools();return H}async function J(){if(!("connection"in $))return G();let K=$.connection,H=JSON.stringify(K);try{if(!nw.has(H))xr8(H,G());return await nw.get(H)}catch(F){console.error("Failed to list tools",F),nw.delete(H);return}}async function W(){return(await J()??[]).map((H)=>ar1(H,Y))}return Y.asTool=async()=>{let H=(await J()??[]).find((F)=>F.name===Q);if(!H)throw Error(`Tool ${Q} not found`);return ar1(H,Y)},Y}})}var rr1=($)=>{try{return JSON.parse($)}catch{return $}},br8=500,nw,ar1=($,Z)=>{return{...$,id:$.name,inputSchema:$.inputSchema?U7($.inputSchema):void 0,outputSchema:$.outputSchema?U7($.outputSchema):void 0,execute:(X)=>{return Z(X.context,$.name)}}};var er1=D(()=>{ir1();or1();nw=new Map});function bO($){return sr1($)}var fx;var uc0=D(()=>{er1();fx=new Proxy({},{get($,Z){if(Z==="toJSON")return null;if(Z==="forConnection")return(X)=>bO({connection:X});if(Z==="forClient")return(X)=>bO({client:X});return globalThis[Z]}})});function E90($){return{isImplementedBy:(Z)=>{for(let X of $){let Q=typeof X.name==="string"?new RegExp(`^${X.name}$`):X.name,Y=Z.find((G)=>Q.test(G.name));if(!Y&&X.opt)continue;if(!Y)return!1}return!0}}}var KK=($)=>{return{...E90($),forClient:(Z)=>{return bO({client:Z})},forConnection:(Z)=>{return bO({connection:Z})}}};var tw=D(()=>{uc0()});import{z as y5}from"zod";var $a1,j90,Za1,z90,Xa1,yr8;var Qa1=D(()=>{tw();$a1=y5.object({specversion:y5.literal("1.0").describe("CloudEvents specification version"),id:y5.string().describe("Unique identifier for this event (UUID recommended)"),source:y5.string().describe("Connection ID of the event publisher"),type:y5.string().describe("Event type (e.g., 'order.created', 'user.signup')"),time:y5.string().datetime().optional().describe("Timestamp of when the event occurred (ISO 8601)"),subject:y5.string().optional().describe("Subject/resource identifier (e.g., order ID, user ID)"),datacontenttype:y5.string().optional().default("application/json").describe("Content type of the data attribute"),dataschema:y5.string().url().optional().describe("URI to the schema for the data attribute"),data:y5.unknown().optional().describe("Event payload (any JSON value)")}),j90=y5.object({events:y5.array($a1).min(1).describe("Batch of CloudEvents to process")}),Za1=y5.object({success:y5.boolean().optional().describe("Whether this event was processed successfully"),error:y5.string().optional().describe("Error message for this event"),retryAfter:y5.number().int().positive().optional().describe("Re-deliver this event after this many ms")}),z90=y5.object({success:y5.boolean().optional().describe("Batch success - applies to events not in results"),error:y5.string().optional().describe("Batch error message - applies to events not in results"),processedCount:y5.number().int().min(0).optional().describe("Number of events successfully processed"),retryAfter:y5.number().int().positive().optional().describe("Batch retryAfter - applies to events not in results"),results:y5.record(y5.string(),Za1).optional().describe("Per-event results keyed by event ID")}),Xa1=[{name:"ON_EVENTS",inputSchema:j90,outputSchema:z90}],yr8=KK(Xa1)});import{z as g5}from"zod";var Ya1,Ga1,Ja1,Wa1,Ka1,Ha1,P90,cc0;var lc0=D(()=>{tw();Ya1=g5.object({type:g5.literal("string"),enum:g5.array(g5.string()).optional(),description:g5.string().optional()}),Ga1=g5.object({type:g5.string(),description:g5.string(),paramsSchema:g5.record(g5.string(),Ya1)}),Ja1=g5.object({}),Wa1=g5.object({triggers:g5.array(Ga1)}),Ka1=g5.object({type:g5.string(),params:g5.record(g5.string(),g5.string()),enabled:g5.boolean(),callbackUrl:g5.url().optional(),callbackToken:g5.string().min(1).optional()}),Ha1=g5.object({success:g5.boolean()}),P90=[{name:"TRIGGER_LIST",inputSchema:Ja1,outputSchema:Wa1},{name:"TRIGGER_CONFIGURE",inputSchema:Ka1,outputSchema:Ha1}],cc0=KK(P90)});import{z as k$}from"zod";var gr8,hr8,ur8,cr8,lr8,dr8,mr8,ir8,pr8,nr8,tr8,or8,ow;var li=D(()=>{gr8=k$.object({prefix:k$.string().optional().describe("Filter objects by prefix (e.g., 'folder/' for folder contents)"),maxKeys:k$.number().optional().default(1000).describe("Maximum number of keys to return (default: 1000)"),continuationToken:k$.string().optional().describe("Token for pagination from previous response"),delimiter:k$.string().optional().describe("Delimiter for grouping keys (typically '/'). When set, commonPrefixes returns folder paths.")}),hr8=k$.object({objects:k$.array(k$.object({key:k$.string().describe("Object key/path"),size:k$.number().describe("Object size in bytes"),lastModified:k$.string().describe("Last modified timestamp"),etag:k$.string().describe("Entity tag for the object")})),nextContinuationToken:k$.string().optional().describe("Token for fetching next page of results"),isTruncated:k$.boolean().describe("Whether there are more results available"),commonPrefixes:k$.array(k$.string()).optional().describe("Folder paths when delimiter is used (e.g., ['photos/2024/', 'photos/2025/'])")}),ur8=k$.object({key:k$.string().describe("Object key/path to get metadata for")}),cr8=k$.object({contentType:k$.string().optional().describe("MIME type of the object"),contentLength:k$.number().describe("Size of the object in bytes"),lastModified:k$.string().describe("Last modified timestamp"),etag:k$.string().describe("Entity tag for the object"),metadata:k$.record(k$.string(),k$.string()).optional().describe("Custom metadata key-value pairs")}),lr8=k$.object({key:k$.string().describe("Object key/path to generate URL for"),expiresIn:k$.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)")}),dr8=k$.object({url:k$.string().describe("Presigned URL for downloading the object"),expiresIn:k$.number().describe("Expiration time in seconds that was used")}),mr8=k$.object({key:k$.string().describe("Object key/path for the upload"),expiresIn:k$.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)"),contentType:k$.string().optional().describe("MIME type for the object being uploaded")}),ir8=k$.object({url:k$.string().describe("Presigned URL for uploading the object"),expiresIn:k$.number().describe("Expiration time in seconds that was used")}),pr8=k$.object({key:k$.string().describe("Object key/path to delete")}),nr8=k$.object({success:k$.boolean().describe("Whether the deletion was successful"),key:k$.string().describe("The key that was deleted")}),tr8=k$.object({keys:k$.array(k$.string()).max(1000).describe("Array of object keys/paths to delete (max 1000)")}),or8=k$.object({deleted:k$.array(k$.string()).describe("Array of successfully deleted keys"),errors:k$.array(k$.object({key:k$.string(),message:k$.string()})).describe("Array of errors for failed deletions")}),ow=[{name:"LIST_OBJECTS",inputSchema:gr8,outputSchema:hr8},{name:"GET_OBJECT_METADATA",inputSchema:ur8,outputSchema:cr8},{name:"GET_PRESIGNED_URL",inputSchema:lr8,outputSchema:dr8},{name:"PUT_PRESIGNED_URL",inputSchema:mr8,outputSchema:ir8},{name:"DELETE_OBJECT",inputSchema:pr8,outputSchema:nr8},{name:"DELETE_OBJECTS",inputSchema:tr8,outputSchema:or8}]});import{z as E6}from"zod";var Fa1,Na1,Ua1,di,A90,T90,R90,I90,rr8;var dc0=D(()=>{tw();Fa1=E6.object({primary:E6.string().optional().describe("Primary brand color (hex)"),secondary:E6.string().optional().describe("Secondary brand color (hex)"),accent:E6.string().optional().describe("Accent / highlight color (hex)"),background:E6.string().optional().describe("Background color (hex)"),foreground:E6.string().optional().describe("Foreground / text color (hex)")}),Na1=E6.object({heading:E6.string().optional().describe("Font family for headings"),body:E6.string().optional().describe("Font family for body text"),code:E6.string().optional().describe("Font family for code / monospace")}),Ua1=E6.object({logo:E6.string().optional().describe("Logo URL"),favicon:E6.string().optional().describe("Favicon URL"),ogImage:E6.string().optional().describe("Open Graph image URL")}),di=E6.object({id:E6.string(),name:E6.string().describe("Brand / company name"),domain:E6.string().optional().describe("Company domain (e.g. example.com)"),colors:Fa1.optional().describe("Semantic color palette"),fonts:Na1.optional().describe("Font families by role"),assets:Ua1.optional().describe("Visual identity assets"),overview:E6.string().optional().describe("Company overview / description"),tagline:E6.string().optional().describe("Brand tagline"),tone:E6.string().optional().describe("Tone of voice description"),metadata:E6.record(E6.string(),E6.unknown()).optional().describe("Extra design tokens and metadata")}),A90=E6.object({id:E6.string().optional().describe("Brand ID. Omit to get the default brand.")}),T90=E6.object({}),R90=E6.object({items:E6.array(di)}),I90=[{name:"BRAND_GET",inputSchema:A90,outputSchema:di},{name:"BRAND_LIST",inputSchema:T90,outputSchema:R90,opt:!0}],rr8=KK(I90)});var mc0=D(()=>{tw();Qa1();lc0();li();dc0()});import{z as L8}from"zod";function LF($){return L8.object({items:L8.array($).describe("Array of collection items"),totalCount:L8.number().int().min(0).optional().describe("Total number of matching items (if available)"),hasMore:L8.boolean().optional().describe("Whether there are more items available")})}function ii($){return L8.object({item:$.nullable().describe("The retrieved item, or null if not found")})}function er8($){return L8.object({data:$.partial().describe("Data for the new entity (id may be auto-generated)")})}function $a8($){return L8.object({item:$.describe("The created entity with generated id")})}function Za8($){return L8.object({id:L8.string().describe("ID of the entity to update"),data:$.partial().describe("Partial entity data to update")})}function Xa8($){return L8.object({item:$.describe("The updated entity")})}function ni($){return L8.object({item:$.describe("The deleted entity")})}function M90($,Z,X){let Q=$.toUpperCase(),Y=X?.readOnly??!1,G=[{name:`COLLECTION_${Q}_LIST`,inputSchema:z3,outputSchema:LF(Z)},{name:`COLLECTION_${Q}_GET`,inputSchema:mi,outputSchema:ii(Z)}];if(!Y)G.push({name:`COLLECTION_${Q}_CREATE`,inputSchema:er8(Z),outputSchema:$a8(Z),opt:!0},{name:`COLLECTION_${Q}_UPDATE`,inputSchema:Za8(Z),outputSchema:Xa8(Z),opt:!0},{name:`COLLECTION_${Q}_DELETE`,inputSchema:pi,outputSchema:ni(Z),opt:!0});return G}var q90,ar8,Oa1,sr8,z3,mi,pi;var cG=D(()=>{q90=L8.object({id:L8.string().describe("Unique identifier for the entity"),title:L8.string().describe("Human-readable title for the entity"),description:L8.string().nullish().describe("Description of the entity"),created_at:L8.string().datetime(),updated_at:L8.string().datetime(),created_by:L8.string().optional(),updated_by:L8.string().optional()}),ar8=L8.object({field:L8.array(L8.string()),operator:L8.enum(["eq","gt","gte","lt","lte","in","like","contains"]),value:L8.unknown()}),Oa1=L8.lazy(()=>L8.union([ar8,L8.object({operator:L8.enum(["and","or","not"]),conditions:L8.array(Oa1)})])),sr8=L8.object({field:L8.array(L8.string()),direction:L8.enum(["asc","desc"]),nulls:L8.enum(["first","last"]).optional()}),z3=L8.object({where:Oa1.optional().describe("Filter expression"),orderBy:L8.array(sr8).optional().describe("Sort expressions"),limit:L8.number().int().min(1).max(1000).optional().describe("Maximum number of items to return"),offset:L8.number().int().min(0).optional().describe("Number of items to skip")});mi=L8.object({id:L8.string().describe("ID of the entity to retrieve")});pi=L8.object({id:L8.string().describe("ID of the entity to delete")})});import{z as bx}from"zod";var Qa8,Ya8,Ba1;var Da1=D(()=>{cG();Qa8=q90.extend({avatar:bx.string().describe("URL or data URI to the assistant's avatar image"),system_prompt:bx.string().describe("System prompt that defines the assistant's behavior"),virtual_mcp_id:bx.string().describe("Virtual MCP ID to use for this assistant"),model:bx.object({id:bx.string().describe("Model ID"),connectionId:bx.string().describe("Connection ID that provides the model")}).describe("Selected model reference for this assistant")}),Ya8=M90("assistant",Qa8),Ba1=[...Ya8]});import{z as H0}from"zod";var ti,wF,wa1,Ga8,Ja8,Ea1,Wa8,Ka8,Ha8,Fa8,Na8,Ua8,ja1,Oa8,Ba8,Da8,La8,wa8,Ea8,ja8,za8,Pa8,Aa8,EZ5,Ta8,jZ5,La1,Ra8,Ia8,k90,zZ5;var za1=D(()=>{tw();cG();ti=H0.lazy(()=>H0.union([H0.null(),H0.string(),H0.number(),H0.boolean(),H0.record(H0.string(),ti),H0.array(ti)])),wF=H0.record(H0.string(),H0.record(H0.string(),ti)).optional().describe("Additional provider-specific options. Outer record keyed by provider name, inner by option key"),wa1=H0.object({type:H0.literal("text"),text:H0.string().describe("The text content"),providerOptions:wF}),Ga8=H0.object({type:H0.literal("text"),text:H0.string().describe("The text content"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Ja8=H0.string().describe("File data as URL string"),Ea1=H0.object({type:H0.literal("file"),filename:H0.string().optional().describe("Optional filename of the file"),data:Ja8,mediaType:H0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),providerOptions:wF}),Wa8=H0.object({type:H0.literal("file"),mediaType:H0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),data:H0.string().describe("Generated file data as base64 encoded string")}),Ka8=H0.object({type:H0.literal("reasoning"),text:H0.string().describe("The reasoning text"),providerOptions:wF}),Ha8=H0.object({type:H0.literal("reasoning"),text:H0.string().describe("The reasoning text"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Fa8=H0.object({type:H0.literal("tool-call"),toolCallId:H0.string().describe("ID of the tool call, used to match with tool result"),toolName:H0.string().describe("Name of the tool being called"),input:H0.string().describe("Arguments of the tool call (JSON-serializable object matching tool input schema)"),providerExecuted:H0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerOptions:wF}),Na8=H0.object({type:H0.literal("tool-call"),toolCallId:H0.string().describe("ID of the tool call"),toolName:H0.string().describe("Name of the tool being called"),input:H0.string().describe("Stringified JSON object with the tool call arguments"),providerExecuted:H0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Ua8=H0.union([H0.object({type:H0.literal("text"),value:H0.string()}),H0.object({type:H0.literal("json"),value:ti}),H0.object({type:H0.literal("error-text"),value:H0.string()}),H0.object({type:H0.literal("error-json"),value:ti}),H0.object({type:H0.literal("content"),value:H0.array(H0.union([H0.object({type:H0.literal("text"),text:H0.string().describe("Text content")}),H0.object({type:H0.literal("media"),data:H0.string().describe("Base-64 encoded media data"),mediaType:H0.string().describe("IANA media type")})]))}),H0.object({type:H0.literal("execution-denied"),reason:H0.string().optional()}),H0.string().describe("Raw or JSON-serialized output (e.g. from AI SDK mapToolResultOutput)")]),ja1=H0.object({type:H0.literal("tool-result"),toolCallId:H0.string().describe("ID of the tool call that this result is associated with"),toolName:H0.string().describe("Name of the tool that generated this result"),output:Ua8.describe("Result of the tool call"),result:H0.unknown().describe("Unknown result of the tool call"),providerOptions:wF}),Oa8=H0.object({type:H0.literal("tool-result"),toolCallId:H0.string().describe("ID of the tool call that this result is associated with"),toolName:H0.string().describe("Name of the tool that generated this result"),result:H0.any().describe("Result of the tool call (JSON-serializable)"),isError:H0.boolean().optional().describe("Whether the result is an error or error message"),providerExecuted:H0.boolean().optional().describe("Whether the tool result was generated by the provider"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Ba8=H0.union([H0.object({type:H0.literal("source"),sourceType:H0.literal("url"),id:H0.string().describe("The ID of the source"),url:H0.string().describe("The URL of the source"),title:H0.string().optional().describe("The title of the source"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),H0.object({type:H0.literal("source"),sourceType:H0.literal("document"),id:H0.string().describe("The ID of the source"),mediaType:H0.string().describe("IANA media type of the document (e.g., application/pdf)"),title:H0.string().describe("The title of the document"),filename:H0.string().optional().describe("Optional filename of the document"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")})]),Da8=H0.object({role:H0.literal("system"),content:H0.string().describe("System message content"),providerOptions:wF}),La8=H0.object({role:H0.literal("user"),content:H0.array(H0.union([wa1,Ea1])).describe("User message content parts (text or file)"),providerOptions:wF}),wa8=H0.object({role:H0.literal("assistant"),content:H0.array(H0.union([wa1,Ea1,Ka8,Fa8,ja1])).describe("Assistant message content parts (text, file, reasoning, tool-call, or tool-result)"),providerOptions:wF}),Ea8=H0.object({role:H0.literal("tool"),content:H0.array(ja1).describe("Tool message content (tool results)"),providerOptions:wF}),ja8=H0.union([Da8,La8,wa8,Ea8]),za8=H0.array(ja8).describe("A list of messages forming the prompt"),Pa8=H0.object({prompt:za8.describe("A language model prompt is a standardized prompt type (array of messages with roles: system, user, assistant, tool)"),maxOutputTokens:H0.number().optional().describe("Maximum number of tokens to generate"),temperature:H0.number().optional().describe("Temperature setting. The range depends on the provider and model"),topP:H0.number().optional().describe("Nucleus sampling parameter"),topK:H0.number().optional().describe("Only sample from the top K options for each subsequent token. Used to remove long tail low probability responses"),presencePenalty:H0.number().optional().describe("Presence penalty setting. It affects the likelihood of the model to repeat information that is already in the prompt"),frequencyPenalty:H0.number().optional().describe("Frequency penalty setting. It affects the likelihood of the model to repeatedly use the same words or phrases"),seed:H0.number().optional().describe("The seed (integer) to use for random sampling. If set and supported by the model, calls will generate deterministic results"),stopSequences:H0.array(H0.string()).optional().describe("Stop sequences. If set, the model will stop generating text when one of the stop sequences is generated"),responseFormat:H0.union([H0.object({type:H0.literal("text")}),H0.object({type:H0.literal("json"),schema:H0.any().optional().describe("JSON schema that the generated output should conform to"),name:H0.string().optional().describe("Name of output that should be generated"),description:H0.string().optional().describe("Description of the output that should be generated")})]).optional().describe("Response format. The output can either be text or JSON. Default is text"),tools:H0.array(H0.any()).optional().describe("The tools that are available for the model"),toolChoice:H0.any().optional().describe("Specifies how the tool should be selected. Defaults to 'auto'"),includeRawChunks:H0.boolean().optional().describe("Include raw chunks in the stream. Only applicable for streaming calls"),abortSignal:H0.any().optional().describe("Abort signal for cancelling the operation"),providerOptions:H0.any().optional().describe("Additional provider-specific options")}),Aa8=H0.object({content:H0.array(H0.union([Ga8,Wa8,Ha8,Na8,Oa8,Ba8])).describe("Ordered content that the model has generated (text, tool-calls, reasoning, files, sources)"),finishReason:H0.enum(["stop","length","content-filter","tool-calls","error","other","unknown"]).describe("Reason why generation stopped"),usage:H0.looseObject({inputTokens:H0.number().optional(),outputTokens:H0.number().optional(),totalTokens:H0.number().optional(),reasoningTokens:H0.number().optional()}).describe("Usage information for the language model call"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata"),request:H0.object({body:H0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:H0.object({id:H0.string().optional().describe("ID for the generated response"),timestamp:H0.iso.datetime().optional().describe("Timestamp for the start of the generated response"),modelId:H0.string().optional().describe("The ID of the response model that was used"),headers:H0.record(H0.string(),H0.string()).optional().describe("Response headers"),body:H0.any().optional().describe("Response HTTP body")}).optional().describe("Optional response information for telemetry and debugging"),warnings:H0.array(H0.any()).describe("Warnings for the call, e.g. unsupported settings")}),EZ5=H0.object({stream:H0.any().describe("ReadableStream of LanguageModelV2StreamPart"),request:H0.object({body:H0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:H0.object({headers:H0.record(H0.string(),H0.string()).optional().describe("Response headers")}).optional().describe("Optional response data")}),Ta8=H0.object({supportedUrls:H0.record(H0.string(),H0.array(H0.string())).describe("Supported URL patterns by media type for the provider")}),jZ5=H0.object({modelId:H0.string().describe("The ID of the model"),logo:H0.string().nullable(),description:H0.string().nullable(),capabilities:H0.array(H0.string()),limits:H0.object({contextWindow:H0.number(),maxOutputTokens:H0.number()}).nullable(),costs:H0.object({input:H0.number(),output:H0.number()}).nullable(),provider:H0.enum(["openai","anthropic","google","x-ai","deepseek","openai-compatible","openrouter"]).nullable()}),La1=H0.object({modelId:H0.string().describe("The ID of the model"),callOptions:Pa8}),Ra8=q90.extend({logo:H0.string().nullable(),description:H0.string().nullable(),capabilities:H0.array(H0.string()),limits:H0.object({contextWindow:H0.number(),maxOutputTokens:H0.number()}).nullable(),costs:H0.object({input:H0.number(),output:H0.number()}).nullable(),provider:H0.enum(["openai","anthropic","google","xai","deepseek","openai-compatible","openrouter"]).nullable()}),Ia8=M90("llm",Ra8,{readOnly:!0}),k90=[{name:"LLM_METADATA",inputSchema:H0.object({modelId:H0.string().describe("The ID of the model")}),outputSchema:Ta8},{name:"LLM_DO_STREAM",inputSchema:La1},{name:"LLM_DO_GENERATE",inputSchema:La1,outputSchema:Aa8},...Ia8],zZ5=KK(k90)});import{z as rw}from"zod";var qa8,Pa1;var Aa1=D(()=>{qa8=rw.object({scopes:rw.array(rw.string()).describe("List of scopes available"),stateSchema:rw.record(rw.string(),rw.unknown()).describe("JSON Schema (draft-07) defining the state structure")}),Pa1=[{name:"MCP_CONFIGURATION",inputSchema:rw.object({}),outputSchema:qa8}]});import{z as h5}from"zod";var Ma8,ka8,Ta1;var Ra1=D(()=>{Ma8=h5.object({}).strict(),ka8=h5.object({billing:h5.object({mode:h5.enum(["prepaid","postpaid"]),limitPeriod:h5.enum(["daily","weekly","monthly"]).nullable()}),limit:h5.object({total:h5.number().nullable(),remaining:h5.number().nullable(),reset:h5.string().nullable()}),usage:h5.object({total:h5.number(),daily:h5.number(),weekly:h5.number(),monthly:h5.number()}),alert:h5.object({enabled:h5.boolean(),threshold_usd:h5.number(),email:h5.string().nullable()}),connectionId:h5.string()}),Ta1=[{name:"GATEWAY_USAGE",inputSchema:Ma8,outputSchema:ka8},{name:"GATEWAY_SET_LIMIT",inputSchema:h5.object({}),outputSchema:h5.object({}),opt:!0},{name:"GATEWAY_SET_ALERT",inputSchema:h5.object({}),outputSchema:h5.object({}),opt:!0}]});import{z as Ia1}from"zod";function lG(){return qY()===null}function V90($,Z){return $===S8.DEV_ASSETS(Z)}function xx($,Z){let X=oy1(Z,$),Q=new Date().toISOString();return{id:X.id??S8.DEV_ASSETS($),title:X.title,description:X.description??null,icon:X.icon??null,app_name:X.app_name??null,app_id:X.app_id??null,organization_id:$,created_by:"system",created_at:Q,updated_at:Q,connection_type:X.connection_type,connection_url:X.connection_url??null,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:X.metadata??null,tools:Va8,bindings:["OBJECT_STORAGE"],status:"active"}}var Va8;var yx=D(()=>{fL();li();P8();Va8=ow.map(($)=>({name:$.name,description:`${$.name} operation for local file storage`,inputSchema:Ia1.toJSONSchema($.inputSchema),outputSchema:Ia1.toJSONSchema($.outputSchema)}))});function qa1($,Z){return $||Z===0}function Ma1($,Z,X,Q,Y){let G=Z?Y+1:Y,J=$.slice(0,X),W=Q+X<G;return{items:J,totalCount:G,hasMore:W}}function ka1($,Z,X){if(!X)return{sqlOffset:$,sqlLimit:Z};if($===0)return{sqlOffset:0,sqlLimit:Math.max(Z-1,0)};return{sqlOffset:$-1,sqlLimit:Z}}function Sa8($,Z){if(Z.length===0)return;let[X,...Q]=Z,Y=X==="slug"?lU($):$[X];for(let G of Q){if(Y===null||typeof Y!=="object")return;Y=Y[G]}return Y}function Ca8($){let X=$.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/%/g,".*").replace(/_/g,".");return new RegExp(`^${X}$`,"i")}function _a8($,Z,X){if($===void 0)return!0;switch(Z){case"eq":return X===null?$===null:$===X;case"gt":return $>X;case"gte":return $>=X;case"lt":return $<X;case"lte":return $<=X;case"in":return Array.isArray(X)&&X.includes($);case"like":return typeof $==="string"&&Ca8(String(X)).test($);case"contains":return String($).toLowerCase().includes(String(X).toLowerCase());default:return!0}}function oi($,Z){if(!Z)return!0;if("conditions"in Z){let{operator:Q,conditions:Y}=Z;if(Y.length===0)return!0;switch(Q){case"and":return Y.every((G)=>oi($,G));case"or":return Y.some((G)=>oi($,G));case"not":return!Y.every((G)=>oi($,G));default:return!0}}let X=Sa8($,Z.field);return _a8(X,Z.operator,Z.value)}var Va1=D(()=>{v40()});import{z as xO}from"zod";var va8=8,fa8,ba8,xa8,ya8,ic0;var Sa1=D(()=>{mc0();Da1();cG();za1();Aa1();li();Ra1();P8();S0();L9();xY();DF();yx();yW();v40();Va1();fa8=[{name:/^(COLLECTION_REGISTRY_APP_LIST|REGISTRY_ITEM_LIST)$/,inputSchema:xO.object({})}],ba8={LLM:k90,LLMS:k90,ASSISTANTS:Ba1,MCP:Pa1,OBJECT_STORAGE:ow,AI_GATEWAY_BILLING:Ta1,TRIGGER:P90,REGISTRY:fa8,BRAND:I90},xa8=z3.extend({binding:xO.union([xO.array(xO.object({}).passthrough()),xO.object({}).passthrough(),xO.string()]).optional(),include_virtual:xO.boolean().optional().describe("Whether to include VIRTUAL connections in the results. Defaults to false."),slug:xO.string().optional().describe("Filter by connection slug. Matches against app_name, or a slug derived from connection_url or title.")}),ya8=LF(g7),ic0=c({name:"COLLECTION_CONNECTIONS_LIST",description:"List all connections in the organization with filtering, sorting, and pagination",annotations:{title:"List Connections",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xa8,outputSchema:ya8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.binding?typeof $.binding==="string"?(()=>{let E=ba8[$.binding.toUpperCase()];if(!E)throw Error(`Unknown binding: ${$.binding}`);return E})():$.binding:void 0,Y=Q?E90(Q):void 0,G=!!Y,J=$.limit??100,W=$.offset??0,K=f9(),H=S8.DEV_ASSETS(X.id),F=xx(X.id,K),N=(!$.slug||lU(F)===$.slug)&&oi(F,$.where),U=lG()&&!G&&N,{sqlOffset:O,sqlLimit:B}=ka1(W,J,U),{items:L,totalCount:w}=await Z.storage.connections.list(X.id,{includeVirtual:$.include_virtual??!1,slug:$.slug,where:$.where,orderBy:$.orderBy,limit:G?void 0:B,offset:G?void 0:O});if(Y){let E=Z9(),j=S8.SELF(X.id);await e50(L,va8,async(z)=>{if(z.tools!==null)return;let A=z.id===j?async()=>{let{listManagementTools:I}=await Promise.resolve().then(() => (yO(),S90));return I(Z)}:()=>bc0(z,Z,f40),P=await vO("tools",z.id,A,E,(I)=>Z.pendingRevalidations.push(I),_O);if(P!==null)z.tools=P})}if(lG()&&qa1(G,W)&&N&&!L.some((E)=>E.id===H))L.unshift(F);if(G){let E=(await Promise.all(L.map(async(P)=>{if(!P.tools||P.tools.length===0)return null;return Y.isImplementedBy(P.tools.map((q)=>({name:q.name,inputSchema:q.inputSchema,outputSchema:q.outputSchema})))?P:null}))).filter((P)=>P!==null),j=E.length,z=E.slice(W,W+J),A=W+J<j;return{items:z,totalCount:j,hasMore:A}}return Ma1(L,U,J,W,w)}})});var ga8,pc0;var Ca1=D(()=>{cG();P8();S0();L9();xY();DF();yx();yW();ga8=ii(g7),pc0=c({name:"COLLECTION_CONNECTIONS_GET",description:"Get a connection's configuration, tools list, and status by ID.",annotations:{title:"Get Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:["app"]}},inputSchema:mi,outputSchema:ga8,handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),lG()&&V90($.id,X.id))return{item:xx(X.id,f9())};let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)return{item:null};if(Q.tools===null){let Y=S8.SELF(X.id),G=Q.id===Y?async()=>{let{listManagementTools:W}=await Promise.resolve().then(() => (yO(),S90));return W(Z)}:async()=>{let W=await N5(Q,Z,!0);try{return(await W.listTools()).tools}finally{await W.close().catch(()=>{})}},J=await vO("tools",Q.id,G,Z9(),(W)=>Z.pendingRevalidations.push(W),_O);if(J!==null)Q.tools=J}return{item:Q}}})});class l6{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("downstream_tokens").selectAll().where("connectionId","=",$).executeTakeFirst();if(!Z)return null;return this.decryptToken(Z)}async upsert($){let Z=new Date().toISOString(),X=await this.vault.encrypt($.accessToken),Q=$.refreshToken?await this.vault.encrypt($.refreshToken):null,Y=$.clientSecret?await this.vault.encrypt($.clientSecret):null,G=$.expiresAt?.toISOString()??null,J=await this.db.insertInto("downstream_tokens").values({id:t8("dtok"),connectionId:$.connectionId,accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,createdAt:Z,updatedAt:Z}).onConflict((W)=>W.column("connectionId").doUpdateSet({accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,updatedAt:Z})).returning(["id","createdAt"]).executeTakeFirstOrThrow();return{id:J.id,connectionId:$.connectionId,accessToken:$.accessToken,refreshToken:$.refreshToken,scope:$.scope,expiresAt:$.expiresAt,createdAt:J.createdAt,updatedAt:Z,clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint}}async delete($){await this.db.deleteFrom("downstream_tokens").where("connectionId","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Q=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Q))return!0;return Q-Z<Date.now()}async decryptToken($){let Z=await this.vault.decrypt($.accessToken),X=$.refreshToken?await this.vault.decrypt($.refreshToken):null,Q=$.clientSecret?await this.vault.decrypt($.clientSecret):null;return{id:$.id,connectionId:$.connectionId,accessToken:Z,refreshToken:X,scope:$.scope,expiresAt:$.expiresAt,createdAt:$.createdAt,updatedAt:$.updatedAt,clientId:$.clientId,clientSecret:Q,tokenEndpoint:$.tokenEndpoint}}}var dG=D(()=>{gX()});function gx(...$){if(la8)console.log("[mcp-read-cache]",...$)}function da8($){return $.kind==="org"?"org":`u:${$.userId}`}function nc0($){if($===null||typeof $!=="object")return JSON.stringify($)??"null";if(Array.isArray($))return`[${$.map(nc0).join(",")}]`;return`{${Object.keys($).sort().map((X)=>`${JSON.stringify(X)}:${nc0($[X])}`).join(",")}}`}class v90{config;maxEntries;now;maxTotalBytes;store=new Map;revalidating=new Set;totalBytes=0;constructor($=ha8,Z=ua8,X=()=>Date.now(),Q=ca8){this.config=$;this.maxEntries=Z;this.now=X;this.maxTotalBytes=Q}stats(){return{entries:this.store.size,bytes:this.totalBytes}}deleteKey($){let Z=this.store.get($);if(Z)this.store.delete($),this.totalBytes-=Z.bytes}key($,Z,X,Q){return`${Z}:${da8(X)}:${$}:${nc0(Q)}`}storeSet($,Z,X,Q){let Y;try{Y=JSON.stringify(Z).length}catch{gx("SKIP non-serializable",$);return}if(Y>Q){gx("SKIP oversize",$,`${Y}b > cap ${Q}b`);return}this.deleteKey($);while(this.store.size>0&&(this.store.size>=this.maxEntries||this.totalBytes+Y>this.maxTotalBytes)){let G=this.store.keys().next().value;if(G===void 0)break;this.deleteKey(G)}this.store.set($,{value:Z,storedAt:X,bytes:Y}),this.totalBytes+=Y}async fetch($){let{type:Z,connectionId:X,scope:Q,params:Y,fetchLive:G,shouldCache:J,onRevalidation:W}=$,K=this.config[Z],H=this.key(Z,X,Q,Y),F=this.now(),N=this.store.get(H),U=N?F-N.storedAt:1/0;if(!N||U>K.maxStaleMs){C90.add(1,{type:Z,outcome:"miss"}),gx(N?"EXPIRED":"MISS",H);let O=await G();if(J?.(O)??!0)this.storeSet(H,O,this.now(),K.maxValueBytes);else gx("NOT-CACHED (shouldCache=false)",H);return O}if(this.store.delete(H),this.store.set(H,N),U>K.revalidateAfterMs&&!this.revalidating.has(H)){C90.add(1,{type:Z,outcome:"stale"}),gx("STALE \u2192 serve + revalidate",H,`age=${U}ms`),this.revalidating.add(H);let O=G().then((B)=>{if(J?.(B)??!0)this.storeSet(H,B,this.now(),K.maxValueBytes)}).catch(()=>{C90.add(1,{type:Z,outcome:"error"})}).finally(()=>this.revalidating.delete(H));W?.(O)}else C90.add(1,{type:Z,outcome:"hit"}),gx("HIT",H,`age=${U}ms`);return N.value}invalidate($){let Z=`${$}:`;for(let X of[...this.store.keys()])if(X.startsWith(Z))this.deleteKey(X)}}function oc0(){return b0().mcpCacheEnabled}function f90(){return oc0()?tc0:null}var C90,_90=1024,_a1,ha8,ua8=2000,ca8,la8,tc0;var ri=D(()=>{I6();q$();C90=L$.createCounter("mcp_read_cache.fetches",{description:"MCP read cache outcomes (hit, stale, miss, error)",unit:"{fetches}"}),_a1=_90*_90,ha8={"tools/call":{revalidateAfterMs:30000,maxStaleMs:300000,maxValueBytes:512*_90},"resources/read":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:4*_a1},"prompts/get":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:512*_90}},ca8=256*_a1,la8=typeof process<"u"&&!!process.env?.MCP_CACHE_DEBUG;tc0=new v90;L$.createObservableGauge("mcp_read_cache.entries",{description:"Current entry count in the per-pod MCP read cache",unit:"{entries}"}).addCallback(($)=>$.observe(tc0.stats().entries));L$.createObservableGauge("mcp_read_cache.bytes",{description:"Approximate total bytes held in the per-pod MCP read cache",unit:"By"}).addCallback(($)=>$.observe(tc0.stats().bytes))});function ba1($){f90()?.invalidate($)}function hx($){ba1($);let Z=rc0?.();if(!Z)return;try{Z.publish(va1,ma8.encode(JSON.stringify({connectionId:$,originId:fa1})))}catch(X){console.warn("[McpCacheInvalidation] publish failed (non-critical):",X)}}function xa1($){if(rc0=$,ai)return;let Z=$();if(!Z)return;ai=Z.subscribe(va1),(async()=>{for await(let X of ai)try{let Q=JSON.parse(ia8.decode(X.data));if(Q.originId===fa1)continue;ba1(Q.connectionId)}catch{}})().catch(console.error)}function ya1(){ai?.unsubscribe(),ai=null,rc0=void 0}var va1="studio.mcp-cache.invalidate",fa1,ma8,ia8,rc0,ai=null;var si=D(()=>{ri();fa1=crypto.randomUUID(),ma8=new TextEncoder,ia8=new TextDecoder});import{z as ac0}from"zod";function na8($){let Z={...$};for(let X of pa8)delete Z[X];return Z}function ta8($,Z){return $.connection_url!==void 0?$.connection_url:Z}function aa8($,Z){return $.length===Z.length&&$.every((X,Q)=>X===Z[Q])}var pa8,oa8,ra8,sc0;var ga1=D(()=>{DF();dG();S0();q$();xY();si();xc0();ki();yW();pa8=["id","organization_id","created_by","created_at"];oa8=ac0.object({id:ac0.string().describe("ID of the connection to update"),data:Z80.describe("Partial connection data to update")}),ra8=ac0.object({item:g7.describe("The updated connection entity")});sc0=c({name:"COLLECTION_CONNECTIONS_UPDATE",description:"Update a connection's configuration. Re-fetches tools from the server on URL change.",annotations:{title:"Update Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:oa8,outputSchema:ra8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update connection");let{id:Y}=$,G=na8($.data),J=G.configuration_state!==void 0||G.configuration_scopes!==void 0,W=await Z.storage.connections.findById(Y);if(!W||W.organization_id!==X.id)throw Error("Connection not found in organization");let K=G.connection_type??W.connection_type,H=ta8(G,W.connection_url);if(K==="VIRTUAL"){let f=kf(H);if(!f)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let x=await Z.storage.virtualMcps.findById(f);if(!x)throw Error(`Virtual MCP not found: ${f}`);if(x.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");H=Vf(f)}let F=G.configuration_state??W.configuration_state??{},N=G.configuration_scopes??W.configuration_scopes??[];if(J){if(G.configuration_state!==void 0)F=G.configuration_state??{};else if(F===null||F===void 0)F={};if(G.configuration_scopes!==void 0)N=G.configuration_scopes??[];if(N.length>0){let f=F;gi(f,N,X.id),await ui(f,N,X.id,Z)}}if(K==="STDIO"&&!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let U=G.connection_token??W.connection_token;if(!U)try{let x=await new l6(Z.db,Z.vault).get(Y);if(x?.accessToken)U=x.accessToken}catch{}let O=await kO({id:W.id,title:G.title??W.title,connection_type:K,connection_url:H,connection_token:U,connection_headers:G.connection_headers??W.connection_headers}).catch(()=>null),B=O?.tools?.length?O.tools:null,L=!1;if(G.configuration_scopes===void 0&&O?.scopes?.length)L=!aa8(N,O.scopes),N=O.scopes;if(gi(F,N,X.id),L&&N.length>0)await ui(F,N,X.id,Z);let w=J||L,E=w?hi(F,N):[],j=w?hi(W.configuration_state??{},W.configuration_scopes??[]):[],z=W.configuration_state,A=z==null||Object.keys(z).length===0,P,I,q=async()=>{try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:j})}catch(f){console.error("Failed to restore credential grants after credential vault mutation failed",f)}},M={...G,connection_url:H,tools:null,configuration_state:F,configuration_scopes:N,updated_by:Q},C={...W,...M};if(w)try{if(await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:E}),E.length>0){if(!await Z.storage.connectionCredentialVault.findActiveWorkloadToken({organizationId:X.id,subjectConnectionId:Y})){let{plaintextToken:x,record:n}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:Y});I=n.id,P={baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:Y,token:x}}}}catch(f){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});throw await q(),f}if(w&&F&&N)try{await(await N5(C,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:F,scopes:N,firstRun:A,...P?{vault:P}:{}}})}catch(f){if(console.error("Failed to invoke ON_MCP_CONFIGURATION callback",f),I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});if(E.length>0)throw await q(),f}let l;try{l=await Z.storage.connections.update(Y,M)}catch(f){if(w){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});await q()}throw f}if(B)Z9()?.set("tools",Y,B).catch(()=>{});return hx(Y),{item:l}}})});import{z as sa8}from"zod";var ea8,ec0;var ha1=D(()=>{cG();C4();S0();xY();si();yW();ea8=pi.extend({force:sa8.boolean().optional().describe("If true, removes this connection from all agents that reference it before deleting")}),ec0=c({name:"COLLECTION_CONNECTIONS_DELETE",description:"Permanently delete a connection. Set force=true to auto-remove from referencing Virtual MCPs.",annotations:{title:"Delete Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ea8,outputSchema:ni(g7),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q)throw Error(`Connection not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error("Connection not found in organization");if(Q.metadata?.isFixed===!0)throw Error("This connection is a fixed system connection and cannot be deleted");let G=await Z.storage.virtualMcps.listByConnectionId(X.id,$.id);if(G.length>0)if($.force)await Z.storage.virtualMcps.removeConnectionReferences($.id);else throw Error(JSON.stringify({code:"CONNECTION_IN_USE",agentNames:G.map((K)=>K.title)}));await Z.storage.connections.delete($.id);let J=await Z.storage.organizationSettings.get(X.id);if(J?.registry_config){let{registries:K,blockedMcps:H}=J.registry_config;if($.id in K){let{[$.id]:F,...N}=K;await Z.storage.organizationSettings.upsert(X.id,{registry_config:{registries:N,blockedMcps:H}})}}Z9()?.invalidate($.id).catch(()=>{}),hx($.id);let W=Y1(Z);if(W)y1.capture({distinctId:W,event:"connection_deleted",groups:{organization:X.id},properties:{connection_id:Q.id,connection_type:Q.connection_type,app_name:Q.app_name??null,organization_id:X.id,forced:$.force??!1}});return{item:Q}}})});import{z as ux}from"zod";var $l0;var ua1=D(()=>{S0();$l0=c({name:"CONNECTION_TEST",description:"Test connection health and latency",annotations:{title:"Test Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:ux.object({id:ux.string()}),outputSchema:ux.object({id:ux.string(),healthy:ux.boolean(),latencyMs:ux.number()}),handler:async($,Z)=>{let X=t(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)throw Error("Connection not found");let Y=await Z.storage.connections.testConnection($.id);return{id:$.id,...Y}}})});var ca1=D(()=>{cr1();Sa1();Ca1();ga1();ha1();ua1()});import{sql as _4}from"kysely";import{z as HK}from"zod";function la1($){if($===null||$===void 0)return"NULL";if(typeof $==="number")return String($);if(typeof $==="boolean")return $?"TRUE":"FALSE";if(typeof $==="string")return`'${$.replace(/'/g,"''")}'`;if($ instanceof Date)return`'${$.toISOString()}'`;return`'${JSON.stringify($).replace(/'/g,"''")}'`}function Xs8($,Z){let X=$;for(let Y=Z.length;Y>=1;Y--){let G=`$${Y}`;if(X.includes(G))X=X.replaceAll(G,la1(Z[Y-1]))}let Q=[];for(let Y=0;Y<X.length;Y++)if(X[Y]==="?")Q.push(Y);for(let Y=Math.min(Q.length,Z.length)-1;Y>=0;Y--){let G=Q[Y],J=la1(Z[Y]);X=X.slice(0,G)+J+X.slice(G+1)}return X}function da1($){return $.replace(/-/g,"_")}function Ys8($){return`app_${da1($)}`}function Gs8($){return`app_role_${da1($)}`}function Js8($){if($ instanceof Error){let Z=$.message.toLowerCase(),X=$.code;return X==="3F000"||X==="42704"||X==="22023"||Z.includes("schema")&&Z.includes("does not exist")||Z.includes("role")&&Z.includes("does not exist")}return!1}async function Ws8($,Z,X){if(await _4`CREATE SCHEMA IF NOT EXISTS ${_4.id(Z)}`.execute($),!(await _4`
     SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${X}) as exists
-  `.execute($)).rows[0]?.exists)await _4`CREATE ROLE ${_4.id(X)} NOLOGIN`.execute($);await _4`GRANT ${_4.id(X)} TO CURRENT_USER`.execute($),await _4`GRANT USAGE, CREATE ON SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL TABLES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON TABLES TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON SEQUENCES TO ${_4.id(X)}`.execute($),await _4`REVOKE ALL ON SCHEMA public FROM ${_4.id(X)}`.execute($)}async function Ks8($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(Y),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(Y),await _4.raw(Q).execute(Y)})}catch(Y){if(Js8(Y))return await Ws8($,Z,X),await $.transaction().execute(async(G)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(G),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(G),await _4.raw(Q).execute(G)});throw Y}}var Zs8,Qs8,ma1;var ia1=D(()=>{S0();Zs8=HK.object({results:HK.array(HK.unknown()).optional(),success:HK.boolean().optional()});Qs8=HK.object({sql:HK.string().describe("The SQL query to run"),params:HK.array(HK.any()).describe("The parameters to pass to the SQL query").optional()});ma1=c({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Qs8,outputSchema:HK.object({result:HK.array(Zs8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Xs8($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=Ys8(Z.connectionId),Y=Gs8(Z.connectionId);return{result:[{results:(await Ks8(Z.db,Q,Y,X)).rows,success:!0}]}}})});function b90($){let Z=$.access.getRole();if(!i7(Z))throw new KF("Only organization owners and admins can change org-wide pin status")}var Zl0=D(()=>{MQ();Mw()});async function x90($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,W)=>!Y[W]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function EF($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function y90($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function ei($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function $p($,Z){if(!Z)return $;let X=`${y90(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function Fs8($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var cx;var pa1=D(()=>{lW();cx=class cx extends y9{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=y90(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${y90($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=ei(Q._meta);if(!Y)continue;if($p(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=ei(Q._meta);if(!Y)continue;if($p(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<cx.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${cx.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(K)=>this.fetchAllResources(K,Q),"resources"),J=Y.resources,W=J?new Set(J):null;for(let K of G){if(W&&!W.has(K.uri)&&!(K.name&&W.has(K.name)))continue;if($.has(K.uri)){console.warn(`GatewayClient: duplicate resource "${K.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(K.uri),X.set(K.uri,Q),Z.push({...K,_meta:{...K._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??Fs8(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var g90=D(()=>{pa1()});function Ql0($){return EF($)}function Us8($,Z){let X=EF(Z)||"prompt";return`${String($).padStart(Ns8,"0")}-${X}`}async function Yl0($,Z,X){try{await $.delete(h90,Ql0(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function u90($,Z,X,Q){let Y=Ql0(Z);await Yl0($,Z,X),await Promise.all(Q.slice(0,Xl0).map(async(G,J)=>{let W=Us8(J,G.title),K={name:W,title:G.title,description:G.description,text:G.text};try{await $.write(h90,`${Y}/${W}.json`,JSON.stringify(K),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function na1($,Z){let X=Ql0(Z),Q;try{Q=await $.listDir(h90,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,Xl0),G=[];for(let J of Y)try{let W=await $.read(h90,J.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")G.push(K)}catch{}return G}var h90="agent-prompts",Xl0=20,Ns8;var Zp=D(()=>{g90();Ns8=String(Xl0-1).length});import{z as ra1}from"zod";function Os8(){let $=ta1[Math.floor(Math.random()*ta1.length)];return`icon://${oa1[Math.floor(Math.random()*oa1.length)]}?color=${$}`}var ta1,oa1,Bs8,Ds8,Gl0;var aa1=D(()=>{S0();SO();Zl0();Zp();ta1=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],oa1=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];Bs8=ra1.object({data:Y80.describe("Data for the new virtual MCP")}),Ds8=ra1.object({item:h7.describe("The created virtual MCP entity")}),Gl0=c({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Bs8,outputSchema:Ds8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)b90(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await x90(Z,X.id,G.connections.map((K)=>K.connection_id));let J={...G,icon:G.icon??Os8()},W=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&W.id)await u90(Z.orgFs,W.id,Q,Y);return{item:W}}})});function Ls8($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function gO($){return typeof $==="string"||typeof $==="number"}function Jl0($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function ws8($,Z){return $.connections.some((X)=>X.connection_id===Z)}function c90($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;switch(W){case"and":return K.every((H)=>c90($,H));case"or":return K.some((H)=>c90($,H));case"not":return!K.every((H)=>c90($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return ws8($,Y)}let J=Jl0($,G);switch(Q){case"eq":return J===Y;case"gt":return gO(J)&&gO(Y)&&J>Y;case"gte":return gO(J)&&gO(Y)&&J>=Y;case"lt":return gO(J)&&gO(Y)&&J<Y;case"lte":return gO(J)&&gO(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let W=Ls8(Y);return new RegExp(`^${W}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function Es8($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=Jl0(X,G),W=Jl0(Q,G),K=0;if(J==null&&W==null)continue;if(J==null)K=Y.nulls==="first"?-1:1;else if(W==null)K=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof W==="string")K=J.localeCompare(W);else if(typeof J==="number"&&typeof W==="number")K=J-W;else K=String(J).localeCompare(String(W));if(K!==0)return Y.direction==="desc"?-K:K}return 0})}var js8,zs8,Wl0;var sa1=D(()=>{cG();S0();SO();js8=z3,zs8=LF(h7),Wl0=c({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:js8,outputSchema:zs8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((U)=>c90(U,$.where));if($.orderBy&&$.orderBy.length>0)J=Es8(J,$.orderBy);let W=J.length,K=$.offset??0,H=$.limit??100,F=J.slice(K,K+H),N=K+H<W;return{items:F,totalCount:W,hasMore:N}}})});import{z as Kl0}from"zod";var Ps8,As8,Hl0;var ea1=D(()=>{S0();SO();Ps8=Kl0.object({id:Kl0.string().describe("ID of the virtual MCP to retrieve")}),As8=Kl0.object({item:h7.nullable().describe("The retrieved virtual MCP, or null if not found")}),Hl0=c({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ps8,outputSchema:As8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function mG($){return Fl0.test($)}function $s1($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var Fl0;var hO=D(()=>{Fl0=/^[a-z0-9][a-z0-9-]{0,59}$/});function Zs1($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return mG(Y)?Y:null}var Xs1=D(()=>{hO()});import{z as Nl0}from"zod";var Ts8,Rs8,Ul0;var Qs1=D(()=>{S0();Zp();SO();Zl0();Xs1();Ts8=Nl0.object({id:Nl0.string().describe("ID of the virtual MCP to update"),data:G80.describe("Partial virtual MCP data to update")}),Rs8=Nl0.object({item:h7.describe("The updated virtual MCP entity")}),Ul0=c({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ts8,outputSchema:Rs8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let W=Zs1({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(W)J.metadata={...Y.metadata,...J.metadata,siteSlug:W};if(J.pinned!==void 0&&J.pinned!==Y.pinned)b90(Z);if(J.connections?.length)await x90(Z,X.id,J.connections.map((H)=>H.connection_id));let K=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await u90(Z.orgFs,$.id,Q,G);return{item:K}}})});function Is8($){if(!$)return!1;let Z=Bl0.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function Gs1($){let Z={...$};for(let X of Bl0)Z[X]="read";return Z}async function Js1($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((K)=>K.type==="text")?.text,G=Bl0.find((K)=>(K in X));if(!G||!Is8(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...W}=X;X=W}}function qs8($){if(!$||typeof $!=="object"||Array.isArray($))return Ys1;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return Ys1;return Z}function Ms8($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function q5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=Ms8(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:qs8(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function aw($){return $.metadata?.orgShared===!0}function Ws1($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=q5(Q);if(Y===null)continue;let G=Ol0(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function l90($,Z,X){let Q=Ol0(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=q5(G);return J!==null&&Ol0(J.owner,J.repo)===Q});return Y.find(aw)??Y[0]??null}var Ys1,Bl0,Ol0=($,Z)=>`${$}/${Z}`.toLowerCase();var VQ=D(()=>{Ys1={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},Bl0=["deployments","checks"]});function Ks1($){return CG($)!==null||V40($)!==null}var Hs1=D(()=>{P8()});import{z as Dl0}from"zod";var ks8,Vs8,Ll0;var Fs1=D(()=>{VQ();dG();S0();Zp();SO();Hs1();ks8=Dl0.object({id:Dl0.string().describe("ID of the virtual MCP to delete")}),Vs8=Dl0.object({item:h7.describe("The deleted virtual MCP entity")}),Ll0=c({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ks8,outputSchema:Vs8,handler:async($,Z)=>{r(Z);let X=t(Z);if(await Z.access.check(),Ks1($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await Yl0(Z.orgFs,$.id,Y1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(aw(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&q5(G)&&!J){let K=await new l6(Z.db,Z.vault).get(Y);if(K?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${K.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as SQ}from"zod";var Ss8,wl0;var Ns1=D(()=>{S0();Ss8=SQ.object({id:SQ.string(),virtualMcpId:SQ.string(),pluginId:SQ.string(),connectionId:SQ.string().nullable(),settings:SQ.record(SQ.string(),SQ.unknown()).nullable(),createdAt:SQ.string(),updatedAt:SQ.string()}),wl0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SQ.object({virtualMcpId:SQ.string().describe("Virtual MCP ID"),pluginId:SQ.string().describe("Plugin ID")}),outputSchema:SQ.object({config:Ss8.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as vZ}from"zod";var Cs8,El0;var Us1=D(()=>{S0();yx();L9();Cs8=vZ.object({id:vZ.string(),virtualMcpId:vZ.string(),pluginId:vZ.string(),connectionId:vZ.string().nullable(),settings:vZ.record(vZ.string(),vZ.unknown()).nullable(),createdAt:vZ.string(),updatedAt:vZ.string()}),El0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:vZ.object({virtualMcpId:vZ.string().describe("Virtual MCP ID"),pluginId:vZ.string().describe("Plugin ID"),connectionId:vZ.string().nullable().optional().describe("MCP connection to bind"),settings:vZ.record(vZ.string(),vZ.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:vZ.object({config:Cs8}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,W=Y1(Z),K=await Z.storage.connections.findById(Q);if(!K)throw Error(`Connection not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(K.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&K.organization_id&&!H&&lG()&&V90(G,K.organization_id)){if(!W)throw Error("User ID required to create dev-assets connection");let N=xx(K.organization_id,f9());await Z.storage.connections.create({...N,organization_id:K.organization_id,created_by:W})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as iX}from"zod";var _s8,jl0;var Os1=D(()=>{S0();SO();_s8=iX.object({connectionId:iX.string(),toolName:iX.string(),label:iX.string(),icon:iX.string().nullable().optional()}),jl0=c({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:iX.object({virtualMcpId:iX.string().describe("Virtual MCP ID"),pinnedViews:iX.array(_s8).describe("Pinned views to set for the virtual MCP sidebar"),layout:iX.object({defaultMainView:iX.object({type:iX.string(),id:iX.string().optional(),toolName:iX.string().optional()}).nullable().optional(),chatDefaultOpen:iX.boolean().nullable().optional()}).optional()}),outputSchema:iX.object({item:h7.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=Y1(Z),W=await Z.storage.virtualMcps.findById(Q);if(!W)throw Error(`Virtual MCP not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let K=W.metadata?.ui??{},H={...K,pinnedViews:Y.length>0?Y:null,layout:G??K.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...W.metadata,ui:H}})}}})});import{z as jF}from"zod";var vs8,fs8,zl0;var Bs1=D(()=>{S0();vs8=jF.object({ids:jF.array(jF.string()).describe("Virtual MCP ids to look up")}),fs8=jF.object({items:jF.array(jF.object({id:jF.string(),last_used_at:jF.string().optional(),last_used_by:jF.string().optional()}))}),zl0=c({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:vs8,outputSchema:fs8,handler:async($,Z)=>{r(Z),t(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var Ds1=D(()=>{aa1();sa1();ea1();Qs1();Fs1();Ns1();Us1();Os1();Bs1()});import{z as o7}from"zod";var Pl0;var Ls1=D(()=>{I6();S0();Pl0=c({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:o7.object({startDate:o7.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:o7.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:o7.array(o7.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:o7.array(o7.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:o7.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:o7.object({cells:o7.array(o7.object({virtualMcpId:o7.string().nullable(),toolName:o7.string(),calls:o7.number(),errors:o7.number(),outputSize:o7.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as U5}from"zod";var Al0;var ws1=D(()=>{I6();S0();Al0=c({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U5.object({id:U5.string().describe("Log ID to fetch")}),outputSchema:U5.object({log:U5.object({id:U5.string().optional(),organizationId:U5.string(),connectionId:U5.string(),toolName:U5.string(),input:U5.record(U5.string(),U5.unknown()),output:U5.record(U5.string(),U5.unknown()),isError:U5.boolean(),errorMessage:U5.string().nullish(),durationMs:U5.number(),timestamp:U5.string(),userId:U5.string().nullish(),requestId:U5.string(),userAgent:U5.string().nullish(),virtualMcpId:U5.string().nullish(),properties:U5.record(U5.string(),U5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as K8}from"zod";var xs8,Tl0;var Es1=D(()=>{I6();S0();xs8=K8.object({id:K8.string().optional().describe("Unique log identifier"),organizationId:K8.string().describe("Organization ID"),connectionId:K8.string().describe("Connection ID"),toolName:K8.string().describe("Name of the tool that was called"),isError:K8.boolean().describe("Whether the call resulted in an error"),errorMessage:K8.string().nullish().describe("Error message if applicable"),durationMs:K8.number().describe("Call duration in milliseconds"),timestamp:K8.string().describe("ISO 8601 timestamp of the call"),userId:K8.string().nullish().describe("User who triggered the call"),requestId:K8.string().describe("Unique request identifier"),userAgent:K8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:K8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:K8.record(K8.string(),K8.string()).nullish().describe("Custom key-value metadata attached to the log")}),Tl0=c({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K8.object({connectionId:K8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:K8.array(K8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:K8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:K8.string().optional().describe("Filter by tool name"),isError:K8.boolean().optional().describe("Filter by error status"),startDate:K8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:K8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:K8.number().default(20).describe("Maximum number of results"),offset:K8.number().default(0).describe("Offset for pagination"),properties:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:K8.array(K8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:K8.record(K8.string(),K8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:K8.object({logs:K8.array(xs8).describe("Array of monitoring logs"),total:K8.number().describe("Total number of logs matching filters"),offset:K8.number().describe("Current offset for pagination"),limit:K8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as J$}from"zod";var Rl0;var js1=D(()=>{I6();S0();Rl0=c({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:J$.object({startDate:J$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:J$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:J$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:J$.array(J$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:J$.array(J$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:J$.array(J$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:J$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:J$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:J$.array(J$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:J$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:J$.object({totalCalls:J$.number().describe("Total number of tool calls"),errorRate:J$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:J$.number().describe("Average call duration in milliseconds"),errorRatePercent:J$.string().optional().describe("Error rate as a percentage string"),totalErrors:J$.number().optional().describe("Total number of errors"),p50DurationMs:J$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:J$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:J$.array(J$.object({connectionId:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avgDurationMs:J$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:J$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:J$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:J$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:J$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:J$.array(J$.object({toolName:J$.string(),connectionId:J$.string().nullable(),calls:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:J$.array(J$.object({timestamp:J$.string(),toolName:J$.string(),calls:J$.number(),errors:J$.number(),avg:J$.number(),p95:J$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:J$.array(J$.object({timestamp:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avg:J$.number(),p50:J$.number(),p95:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),totalTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),await WQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as pX}from"zod";var Il0;var zs1=D(()=>{I6();S0();Il0=c({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX.object({threadIds:pX.array(pX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:pX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:pX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:pX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:pX.object({items:pX.array(pX.object({threadId:pX.string(),calls:pX.number(),inputTokens:pX.number(),outputTokens:pX.number(),totalTokens:pX.number(),costUsd:pX.number()}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var Ps1=D(()=>{Ls1();ws1();Es1();js1();zs1()});function d90($){return typeof $==="string"&&gs8.has($.trim().toLowerCase())}var gs8;var ql0=D(()=>{gs8=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as yY}from"zod";var Ml0;var As1=D(()=>{S0();ql0();Ml0=c({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:yY.object({slug:yY.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!d90($),"Slug is reserved by Studio"),name:yY.string().min(1).max(255),description:yY.string().optional()}),outputSchema:yY.object({id:yY.string(),name:yY.string(),slug:yY.string(),logo:yY.string().nullable().optional(),metadata:yY.any().optional(),createdAt:yY.string().datetime().describe("ISO 8601 timestamp"),members:yY.array(yY.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as FK}from"zod";var kl0;var Ts1=D(()=>{S0();kl0=c({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:FK.object({}),outputSchema:FK.object({organizations:FK.array(FK.object({id:FK.string(),name:FK.string(),slug:FK.string(),logo:FK.string().nullable().optional(),metadata:FK.any().optional(),createdAt:FK.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as iG}from"zod";var Vl0;var Rs1=D(()=>{S0();Vl0=c({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iG.object({}),outputSchema:iG.object({id:iG.string(),name:iG.string(),slug:iG.string(),logo:iG.string().nullable().optional(),metadata:iG.any().optional(),createdAt:iG.string().datetime().describe("ISO 8601 timestamp"),members:iG.array(iG.any()).optional(),invitations:iG.array(iG.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as P3}from"zod";var Sl0;var Is1=D(()=>{S0();Sl0=c({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P3.object({id:P3.string(),name:P3.string().min(1).max(255).optional(),description:P3.string().optional()}),outputSchema:P3.object({id:P3.string(),name:P3.string(),slug:P3.string(),logo:P3.string().nullable().optional(),metadata:P3.any().optional(),createdAt:P3.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as Xp}from"zod";var Cl0;var qs1=D(()=>{S0();Cl0=c({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Xp.object({id:Xp.string()}),outputSchema:Xp.object({success:Xp.boolean(),id:Xp.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.organization.get($.id);return await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...X?.metadata,archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as zF}from"zod";var _l0;var Ms1=D(()=>{S0();n7();_l0=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zF.object({}),outputSchema:zF.object({organizationId:zF.string(),sidebar_items:zF.array(Oi).nullable().optional(),enabled_plugins:zF.array(zF.string()).nullable().optional(),registry_config:Bi.nullable().optional(),simple_mode:Di.nullable().optional(),default_home_agents:wi.nullable().optional(),flags:ji.nullable().optional(),main_agent_id:zF.string().nullable().optional(),sprint_config:Ei.nullable().optional(),createdAt:zF.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:zF.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as CQ}from"zod";var vl0;var ks1=D(()=>{S0();n7();vl0=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Oi).optional(),enabled_plugins:CQ.array(CQ.string()).optional(),registry_config:Bi.optional(),simple_mode:Di.optional(),default_home_agents:wi.optional(),flags:ji.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:CQ.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Ei.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Oi).nullable().optional(),enabled_plugins:CQ.array(CQ.string()).nullable().optional(),registry_config:Bi.nullable().optional(),simple_mode:Di.nullable().optional(),default_home_agents:wi.nullable().optional(),flags:ji.nullable().optional(),main_agent_id:CQ.string().nullable().optional(),sprint_config:Ei.nullable().optional(),createdAt:CQ.string().datetime().describe("ISO 8601 timestamp"),updatedAt:CQ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),t(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as A3}from"zod";var Vs1,fl0,bl0;var Ss1=D(()=>{S0();n7();Vs1=AO.extend({organizationId:A3.string(),archivedAt:A3.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:A3.string().describe("ISO 8601 timestamp"),updatedAt:A3.string().describe("ISO 8601 timestamp")}),fl0=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({includeArchived:A3.boolean().optional().describe("Include archived brands in the list")}),outputSchema:A3.object({items:A3.array(Vs1)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),bl0=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({id:A3.string().describe("Brand context ID")}),outputSchema:Vs1.extend({organizationId:A3.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as sw}from"zod";var Cs1,xl0,yl0,gl0;var _s1=D(()=>{S0();n7();Cs1=AO.extend({organizationId:sw.string(),createdAt:sw.string().describe("ISO 8601 timestamp"),updatedAt:sw.string().describe("ISO 8601 timestamp")}),xl0=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:AO.omit({id:!0}),outputSchema:Cs1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),yl0=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:AO.partial().required({id:!0}),outputSchema:Cs1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),gl0=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:sw.object({id:sw.string().describe("Brand context ID")}),outputSchema:sw.object({success:sw.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function m90($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let U=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${U.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,W=G.data.metadata??{},K=cs8(J,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((U)=>U.trim()).filter(Boolean)?.slice().sort((U,O)=>U.length-O.length)[0]??W.ogSiteName??X??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function cs8($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,N]of Object.entries(Q))if(typeof N==="string"&&N&&hs8.has(F))Y[F]=N;let G={},W=($.typography??{}).fontFamilies??{};for(let[F,N]of Object.entries(W))if(typeof N==="string"&&N){let U=us8[F.toLowerCase()];if(U&&!G[U])G[U]=N}let K=$.fonts;if(Array.isArray(K))for(let F of K){let N=F.family;if(typeof N==="string"&&N&&!G.body)G.body=N}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var hs8,us8;var hl0=D(()=>{hs8=new Set(["primary","secondary","accent","background","foreground"]),us8={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as i90}from"zod";var ls8,ul0;var vs1=D(()=>{S0();hl0();n7();ls8=AO.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:i90.boolean()}),ul0=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:i90.object({domain:i90.string().describe("Website domain to extract brand from"),brandId:i90.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:ls8,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await m90($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function fs1($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var cl0,ll0;var bs1=D(()=>{dc0();S0();cl0=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A90,outputSchema:di,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return fs1(Q)}}),ll0=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:T90,outputSchema:R90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(fs1)}}})});import{resolveTxt as ds8}from"dns/promises";function dl0($){return`${ms8}.${$.toLowerCase()}`}function xs1(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function ys1($,Z,X=ds8){if(!Z)return!1;try{return(await X(dl0($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var ms8="_deco-verify";var gs1=()=>{};import{z as M5}from"zod";function uO($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?dl0($.domain):null,recordValue:Z?$.verificationToken:null}}function ps8($){let Z=$.toLowerCase().trim();if(!is8.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(T3.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var is8,ml0,p90,il0,pl0,nl0,tl0,ol0;var hs1=D(()=>{gY();gs1();S0();is8=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,ml0=M5.enum(["off","auto","request"]),p90=M5.object({id:M5.string(),domain:M5.string(),joinMode:ml0,verificationStatus:M5.enum(["pending","verified"]),verificationMethod:M5.enum(["email","dns"]).nullable(),verifiedAt:M5.string().nullable(),recordName:M5.string().nullable(),recordValue:M5.string().nullable()});il0=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({}),outputSchema:M5.object({domains:M5.array(p90)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(uO)}}}),pl0=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({domain:M5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:ml0.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:p90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=ps8($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,W=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(W){if(W.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(W.id,"email");return uO(H)}return uO(W)}let K=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:xs1()});return uO(K)}}),nl0=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string(),joinMode:ml0}),outputSchema:p90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return uO(Y)}}),tl0=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({verified:M5.boolean(),domain:p90}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:uO(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await ys1(Q.domain,Q.verificationToken))return{verified:!1,domain:uO(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:uO(G)}}}),ol0=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({success:M5.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function cO($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as z9}from"zod";var ns8,rl0,al0,sl0;var us1=D(()=>{S0();C4();ns8=z9.object({id:z9.string(),userId:z9.string(),status:z9.enum(["pending","approved","denied"]),createdAt:z9.string(),user:z9.object({id:z9.string(),name:z9.string(),email:z9.string(),image:z9.string().nullable()}).nullable()}),rl0=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({}),outputSchema:z9.object({requests:z9.array(ns8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),al0=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!cO(J))throw J}if(Y)y1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),sl0=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)y1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as _Q}from"zod";var el0;var cs1=D(()=>{C4();S0();MQ();el0=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_Q.object({organizationId:_Q.string().optional(),userId:_Q.string(),role:_Q.array(_Q.string())}),outputSchema:_Q.object({id:_Q.string(),organizationId:_Q.string(),userId:_Q.string(),role:_Q.union([_Q.string(),_Q.array(_Q.string())]),createdAt:_Q.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!s60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as lx}from"zod";var $d0;var ls1=D(()=>{C4();S0();$d0=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lx.object({organizationId:lx.string().optional(),memberIdOrEmail:lx.string()}),outputSchema:lx.object({success:lx.boolean(),memberIdOrEmail:lx.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=Y1(Z);if(Y)y1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as r7}from"zod";var Zd0;var ds1=D(()=>{S0();Zd0=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:r7.object({limit:r7.number().int().min(1).max(1000).optional(),offset:r7.number().int().min(0).optional()}),outputSchema:r7.object({members:r7.array(r7.object({id:r7.string(),organizationId:r7.string(),userId:r7.string(),role:r7.string(),createdAt:r7.string().datetime().describe("ISO 8601 timestamp"),user:r7.object({id:r7.string(),name:r7.string(),email:r7.string(),image:r7.string().optional()}).optional()}))}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as fZ}from"zod";var Xd0;var ms1=D(()=>{C4();S0();MQ();Xd0=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fZ.object({organizationId:fZ.string().optional(),memberId:fZ.string(),role:fZ.array(fZ.string())}),outputSchema:fZ.object({id:fZ.string(),organizationId:fZ.string(),userId:fZ.string(),role:fZ.union([fZ.string(),fZ.array(fZ.string())]),createdAt:fZ.string().datetime().describe("ISO 8601 timestamp"),user:fZ.object({email:fZ.string(),name:fZ.string(),image:fZ.string().optional()})}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!s60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function is1(){if(Qp&&Date.now()-Qp.fetchedAt<600000)return Qp.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Qp={rate:X,fetchedAt:Date.now()},X}catch{return Qp?.rate??5.5}}function ps1($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Qp=null;function Qd0($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,W)=>{if(typeof J==="object"&&J!==null)Qd0(J,`${G}[${W}]`,X);else X.append(`${G}[${W}]`,String(J))});else if(typeof Y==="object")Qd0(Y,G,X);else X.append(G,String(Y))}return X}async function Yp($,Z){let X=b0().stripeSecretKey;if(!X)throw new hY(503,"billing is not configured");let Q=Z?.params?Qd0(Z.params).toString():void 0,Y=await fetch(`${ts8}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(os8)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new hY(Y.status,J)}return G}function ns1($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function ts1($){let Z=b0().stripeOrgPriceId;if(!Z)throw new hY(503,"billing is not configured");let X=await Yp("/checkout/sessions",{params:{mode:"subscription",...ns1(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new hY(500,"checkout session lacks url");return{url:X.url}}function rs8($,Z){return Math.round($*(1+Z/100))}async function os1($){let Z=rs8($.amountCents,$.feePercent),X=ps1($.amountCents,$.currency,await is1()),Q=b0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Yp("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...ns1($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new hY(500,"checkout session lacks url");return{url:J.url}}async function n90($){let Z=await Yp("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new hY(500,"portal session lacks url");return{url:Z.url}}async function t90($){return Yp(`/subscriptions/${encodeURIComponent($)}`)}async function rs1($){await Yp(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var ts8="https://api.stripe.com/v1",hY,os8=15000;var ew=D(()=>{q$();hY=class hY extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as Yd0}from"zod";var Gd0;var as1=D(()=>{ew();L9();S0();C4();Gd0=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Yd0.object({}),outputSchema:Yd0.object({url:Yd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${b9()}/${encodeURIComponent(Q)}/members`,{url:J}=await ts1({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return vY({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as Jd0}from"zod";var Wd0;var ss1=D(()=>{ew();L9();S0();Wd0=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Jd0.object({}),outputSchema:Jd0.object({url:Jd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await n90({customerId:Q.stripeCustomerId,returnUrl:`${b9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof hY)throw Error(Y.message);throw Y}}})});function o90($){return Kd0[$%Kd0.length]??as8}function vQ($){return $.createdBy==="system"}function PF($){return r90.filter((Z)=>qx($,ss8[Z]))}function mx($,Z){return $?.startsWith(`${dx[Z]}:`)??!1}function AF($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Hd0($,Z){let X=AF($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function lO($,Z,X){if(Z.length===0)return!1;let Q=Hd0($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function $e1($,Z){return lO($,Z)&&!lO($,Z,{verifiedOnly:!0})}function Ze1($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function es8($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==T8)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Xe1($,Z=Fd0){let X=es8($),Q=new Set,Y=0;for(let G of[...$].sort((J,W)=>J.occurredAt.localeCompare(W.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var T8="super-agent",Kd0,as8,Gp='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',es1,r90,dx,ss8,Fd0=5,Qe1="task-board.item.updated",Ye1="task-board.item.deleted";var X9=D(()=>{n7();Kd0=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],as8=Kd0[0];es1="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",r90=["qa","code_review"],dx={qa:"QA Agent",code_review:"Code Reviewer"},ss8={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function Nd0($){return $==="trial"?"trial":"subscription"}function Jp($,Z,X,Q={}){vY({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function Ud0($){return $?.status==="active"||$?.status==="past_due"}function a90($,Z){if(Ud0($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Wp(){let $=b0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function dO(){return{...Wp(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function ix($,Z,X=Wp()){if(!X.enforced||!vQ(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Jp($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new a7("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=a90(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Jp($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:Nd0(G.periodKey),limit:G.limit}),new a7(G.exhaustedReason)}async function Ge1($,Z,X=Wp()){if(!X.enforced||!vQ(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=a90(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Jp($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:Nd0(Y.periodKey),limit:Y.limit}),new a7(Y.exhaustedReason);if(G==="runs_exhausted")throw Jp($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new a7("runs_exhausted");if(G==="claimed")Jp($,"task_quota_claimed",Z,{billing_mode:Nd0(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function Je1($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function We1($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function Ke1($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))vY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var $e8="[SUBSCRIPTION_REQUIRED]",Ze8,a7;var pG=D(()=>{X9();C4();q$();Ze8={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};a7=class a7 extends Error{reason;constructor($){super(`${$e8} ${Ze8[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as TF}from"zod";var Od0;var He1=D(()=>{S0();pG();Od0=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TF.object({}),outputSchema:TF.object({enforced:TF.boolean(),billingStatus:TF.string(),subscribed:TF.boolean(),hasBillingAccount:TF.boolean(),used:TF.number(),limit:TF.number(),currentPeriodEnd:TF.string().datetime().nullable()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=Wp(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=a90(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:Ud0(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var Fe1=D(()=>{As1();Ts1();Rs1();Is1();qs1();Ms1();ks1();Ss1();_s1();vs1();bs1();hs1();us1();cs1();ls1();ds1();ms1();as1();ss1();He1()});function NK($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function s90($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(s90);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||s90(X)));return!1}function Bd0($){return Array.isArray($)&&$.every(s90)}function Kp($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||s90(X)))}var he1="vercel.ai.error",Qe8,Ne1,Ue1,J1,ue1="AI_APICallError",ce1,Ye8,Oe1,Be1,Q4,le1="AI_EmptyResponseBodyError",de1,Ge8,De1,Le1,e90,me1="AI_InvalidArgumentError",ie1,Je8,we1,Ee1,mO,pe1="AI_InvalidPromptError",ne1,We8,je1,ze1,nG,te1="AI_InvalidResponseDataError",oe1,Ke8,Pe1,Ae1,px,re1="AI_JSONParseError",ae1,He8,Te1,Re1,RF,se1="AI_LoadAPIKeyError",ee1,Fe8,Ie1,qe1,$E,$0$="AI_LoadSettingError",Z0$,Ne8,Me1,ke1,X0$,Q0$="AI_NoContentGeneratedError",Y0$,Ue8,Ve1,Se1,G0$,J0$="AI_NoSuchModelError",W0$,Oe8,Ce1,_e1,u5,K0$="AI_TooManyEmbeddingValuesForCallError",H0$,Be8,ve1,fe1,nx,F0$="AI_TypeValidationError",N0$,De8,be1,xe1,O5,U0$="AI_UnsupportedFunctionalityError",O0$,Le8,ye1,ge1,v4;var a1=D(()=>{Qe8=Symbol.for(he1),J1=class $ extends(Ue1=Error,Ne1=Qe8,Ue1){constructor({name:Z,message:X,cause:Q}){super(X);this[Ne1]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,he1)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},ce1=`vercel.ai.error.${ue1}`,Ye8=Symbol.for(ce1),Q4=class extends(Be1=J1,Oe1=Ye8,Be1){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:W=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:K}){super({name:ue1,message:$,cause:J});this[Oe1]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=W,this.data=K}static isInstance($){return J1.hasMarker($,ce1)}},de1=`vercel.ai.error.${le1}`,Ge8=Symbol.for(de1),e90=class extends(Le1=J1,De1=Ge8,Le1){constructor({message:$="Empty response body"}={}){super({name:le1,message:$});this[De1]=!0}static isInstance($){return J1.hasMarker($,de1)}};ie1=`vercel.ai.error.${me1}`,Je8=Symbol.for(ie1),mO=class extends(Ee1=J1,we1=Je8,Ee1){constructor({message:$,cause:Z,argument:X}){super({name:me1,message:$,cause:Z});this[we1]=!0,this.argument=X}static isInstance($){return J1.hasMarker($,ie1)}},ne1=`vercel.ai.error.${pe1}`,We8=Symbol.for(ne1),nG=class extends(ze1=J1,je1=We8,ze1){constructor({prompt:$,message:Z,cause:X}){super({name:pe1,message:`Invalid prompt: ${Z}`,cause:X});this[je1]=!0,this.prompt=$}static isInstance($){return J1.hasMarker($,ne1)}},oe1=`vercel.ai.error.${te1}`,Ke8=Symbol.for(oe1),px=class extends(Ae1=J1,Pe1=Ke8,Ae1){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:te1,message:Z});this[Pe1]=!0,this.data=$}static isInstance($){return J1.hasMarker($,oe1)}},ae1=`vercel.ai.error.${re1}`,He8=Symbol.for(ae1),RF=class extends(Re1=J1,Te1=He8,Re1){constructor({text:$,cause:Z}){super({name:re1,message:`JSON parsing failed: Text: ${$}.
+  `.execute($)).rows[0]?.exists)await _4`CREATE ROLE ${_4.id(X)} NOLOGIN`.execute($);await _4`GRANT ${_4.id(X)} TO CURRENT_USER`.execute($),await _4`GRANT USAGE, CREATE ON SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL TABLES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON TABLES TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON SEQUENCES TO ${_4.id(X)}`.execute($),await _4`REVOKE ALL ON SCHEMA public FROM ${_4.id(X)}`.execute($)}async function Ks8($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(Y),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(Y),await _4.raw(Q).execute(Y)})}catch(Y){if(Js8(Y))return await Ws8($,Z,X),await $.transaction().execute(async(G)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(G),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(G),await _4.raw(Q).execute(G)});throw Y}}var Zs8,Qs8,ma1;var ia1=D(()=>{S0();Zs8=HK.object({results:HK.array(HK.unknown()).optional(),success:HK.boolean().optional()});Qs8=HK.object({sql:HK.string().describe("The SQL query to run"),params:HK.array(HK.any()).describe("The parameters to pass to the SQL query").optional()});ma1=c({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Qs8,outputSchema:HK.object({result:HK.array(Zs8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Xs8($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=Ys8(Z.connectionId),Y=Gs8(Z.connectionId);return{result:[{results:(await Ks8(Z.db,Q,Y,X)).rows,success:!0}]}}})});function b90($){let Z=$.access.getRole();if(!i7(Z))throw new KF("Only organization owners and admins can change org-wide pin status")}var Zl0=D(()=>{MQ();Mw()});async function x90($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,W)=>!Y[W]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function EF($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function y90($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function ei($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function $p($,Z){if(!Z)return $;let X=`${y90(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function Fs8($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var cx;var pa1=D(()=>{lW();cx=class cx extends y9{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=y90(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${y90($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=ei(Q._meta);if(!Y)continue;if($p(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=ei(Q._meta);if(!Y)continue;if($p(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<cx.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${cx.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(K)=>this.fetchAllResources(K,Q),"resources"),J=Y.resources,W=J?new Set(J):null;for(let K of G){if(W&&!W.has(K.uri)&&!(K.name&&W.has(K.name)))continue;if($.has(K.uri)){console.warn(`GatewayClient: duplicate resource "${K.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(K.uri),X.set(K.uri,Q),Z.push({...K,_meta:{...K._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??Fs8(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var g90=D(()=>{pa1()});function Ql0($){return EF($)}function Us8($,Z){let X=EF(Z)||"prompt";return`${String($).padStart(Ns8,"0")}-${X}`}async function Yl0($,Z,X){try{await $.delete(h90,Ql0(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function u90($,Z,X,Q){let Y=Ql0(Z);await Yl0($,Z,X),await Promise.all(Q.slice(0,Xl0).map(async(G,J)=>{let W=Us8(J,G.title),K={name:W,title:G.title,description:G.description,text:G.text};try{await $.write(h90,`${Y}/${W}.json`,JSON.stringify(K),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function na1($,Z){let X=Ql0(Z),Q;try{Q=await $.listDir(h90,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,Xl0),G=[];for(let J of Y)try{let W=await $.read(h90,J.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")G.push(K)}catch{}return G}var h90="agent-prompts",Xl0=20,Ns8;var Zp=D(()=>{g90();Ns8=String(Xl0-1).length});import{z as ra1}from"zod";function Os8(){let $=ta1[Math.floor(Math.random()*ta1.length)];return`icon://${oa1[Math.floor(Math.random()*oa1.length)]}?color=${$}`}var ta1,oa1,Bs8,Ds8,Gl0;var aa1=D(()=>{S0();SO();Zl0();Zp();ta1=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],oa1=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];Bs8=ra1.object({data:Y80.describe("Data for the new virtual MCP")}),Ds8=ra1.object({item:h7.describe("The created virtual MCP entity")}),Gl0=c({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Bs8,outputSchema:Ds8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)b90(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await x90(Z,X.id,G.connections.map((K)=>K.connection_id));let J={...G,icon:G.icon??Os8()},W=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&W.id)await u90(Z.orgFs,W.id,Q,Y);return{item:W}}})});function Ls8($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function gO($){return typeof $==="string"||typeof $==="number"}function Jl0($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function ws8($,Z){return $.connections.some((X)=>X.connection_id===Z)}function c90($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;switch(W){case"and":return K.every((H)=>c90($,H));case"or":return K.some((H)=>c90($,H));case"not":return!K.every((H)=>c90($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return ws8($,Y)}let J=Jl0($,G);switch(Q){case"eq":return J===Y;case"gt":return gO(J)&&gO(Y)&&J>Y;case"gte":return gO(J)&&gO(Y)&&J>=Y;case"lt":return gO(J)&&gO(Y)&&J<Y;case"lte":return gO(J)&&gO(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let W=Ls8(Y);return new RegExp(`^${W}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function Es8($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=Jl0(X,G),W=Jl0(Q,G),K=0;if(J==null&&W==null)continue;if(J==null)K=Y.nulls==="first"?-1:1;else if(W==null)K=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof W==="string")K=J.localeCompare(W);else if(typeof J==="number"&&typeof W==="number")K=J-W;else K=String(J).localeCompare(String(W));if(K!==0)return Y.direction==="desc"?-K:K}return 0})}var js8,zs8,Wl0;var sa1=D(()=>{cG();S0();SO();js8=z3,zs8=LF(h7),Wl0=c({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:js8,outputSchema:zs8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((U)=>c90(U,$.where));if($.orderBy&&$.orderBy.length>0)J=Es8(J,$.orderBy);let W=J.length,K=$.offset??0,H=$.limit??100,F=J.slice(K,K+H),N=K+H<W;return{items:F,totalCount:W,hasMore:N}}})});import{z as Kl0}from"zod";var Ps8,As8,Hl0;var ea1=D(()=>{S0();SO();Ps8=Kl0.object({id:Kl0.string().describe("ID of the virtual MCP to retrieve")}),As8=Kl0.object({item:h7.nullable().describe("The retrieved virtual MCP, or null if not found")}),Hl0=c({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ps8,outputSchema:As8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function mG($){return Fl0.test($)}function $s1($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var Fl0;var hO=D(()=>{Fl0=/^[a-z0-9][a-z0-9-]{0,59}$/});function Zs1($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return mG(Y)?Y:null}var Xs1=D(()=>{hO()});import{z as Nl0}from"zod";var Ts8,Rs8,Ul0;var Qs1=D(()=>{S0();Zp();SO();Zl0();Xs1();Ts8=Nl0.object({id:Nl0.string().describe("ID of the virtual MCP to update"),data:G80.describe("Partial virtual MCP data to update")}),Rs8=Nl0.object({item:h7.describe("The updated virtual MCP entity")}),Ul0=c({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ts8,outputSchema:Rs8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let W=Zs1({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(W)J.metadata={...Y.metadata,...J.metadata,siteSlug:W};if(J.pinned!==void 0&&J.pinned!==Y.pinned)b90(Z);if(J.connections?.length)await x90(Z,X.id,J.connections.map((H)=>H.connection_id));let K=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await u90(Z.orgFs,$.id,Q,G);return{item:K}}})});function Is8($){if(!$)return!1;let Z=Bl0.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function Gs1($){let Z={...$};for(let X of Bl0)Z[X]="read";return Z}async function Js1($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((K)=>K.type==="text")?.text,G=Bl0.find((K)=>(K in X));if(!G||!Is8(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...W}=X;X=W}}function qs8($){if(!$||typeof $!=="object"||Array.isArray($))return Ys1;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return Ys1;return Z}function Ms8($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function q5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=Ms8(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:qs8(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function aw($){return $.metadata?.orgShared===!0}function Ws1($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=q5(Q);if(Y===null)continue;let G=Ol0(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function l90($,Z,X){let Q=Ol0(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=q5(G);return J!==null&&Ol0(J.owner,J.repo)===Q});return Y.find(aw)??Y[0]??null}var Ys1,Bl0,Ol0=($,Z)=>`${$}/${Z}`.toLowerCase();var VQ=D(()=>{Ys1={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},Bl0=["deployments","checks"]});function Ks1($){return CG($)!==null||V40($)!==null}var Hs1=D(()=>{P8()});import{z as Dl0}from"zod";var ks8,Vs8,Ll0;var Fs1=D(()=>{VQ();dG();S0();Zp();SO();Hs1();ks8=Dl0.object({id:Dl0.string().describe("ID of the virtual MCP to delete")}),Vs8=Dl0.object({item:h7.describe("The deleted virtual MCP entity")}),Ll0=c({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ks8,outputSchema:Vs8,handler:async($,Z)=>{r(Z);let X=t(Z);if(await Z.access.check(),Ks1($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await Yl0(Z.orgFs,$.id,Y1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(aw(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&q5(G)&&!J){let K=await new l6(Z.db,Z.vault).get(Y);if(K?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${K.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as SQ}from"zod";var Ss8,wl0;var Ns1=D(()=>{S0();Ss8=SQ.object({id:SQ.string(),virtualMcpId:SQ.string(),pluginId:SQ.string(),connectionId:SQ.string().nullable(),settings:SQ.record(SQ.string(),SQ.unknown()).nullable(),createdAt:SQ.string(),updatedAt:SQ.string()}),wl0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SQ.object({virtualMcpId:SQ.string().describe("Virtual MCP ID"),pluginId:SQ.string().describe("Plugin ID")}),outputSchema:SQ.object({config:Ss8.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as vZ}from"zod";var Cs8,El0;var Us1=D(()=>{S0();yx();L9();Cs8=vZ.object({id:vZ.string(),virtualMcpId:vZ.string(),pluginId:vZ.string(),connectionId:vZ.string().nullable(),settings:vZ.record(vZ.string(),vZ.unknown()).nullable(),createdAt:vZ.string(),updatedAt:vZ.string()}),El0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:vZ.object({virtualMcpId:vZ.string().describe("Virtual MCP ID"),pluginId:vZ.string().describe("Plugin ID"),connectionId:vZ.string().nullable().optional().describe("MCP connection to bind"),settings:vZ.record(vZ.string(),vZ.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:vZ.object({config:Cs8}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,W=Y1(Z),K=await Z.storage.connections.findById(Q);if(!K)throw Error(`Connection not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(K.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&K.organization_id&&!H&&lG()&&V90(G,K.organization_id)){if(!W)throw Error("User ID required to create dev-assets connection");let N=xx(K.organization_id,f9());await Z.storage.connections.create({...N,organization_id:K.organization_id,created_by:W})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as iX}from"zod";var _s8,jl0;var Os1=D(()=>{S0();SO();_s8=iX.object({connectionId:iX.string(),toolName:iX.string(),label:iX.string(),icon:iX.string().nullable().optional()}),jl0=c({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:iX.object({virtualMcpId:iX.string().describe("Virtual MCP ID"),pinnedViews:iX.array(_s8).describe("Pinned views to set for the virtual MCP sidebar"),layout:iX.object({defaultMainView:iX.object({type:iX.string(),id:iX.string().optional(),toolName:iX.string().optional()}).nullable().optional(),chatDefaultOpen:iX.boolean().nullable().optional()}).optional()}),outputSchema:iX.object({item:h7.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=Y1(Z),W=await Z.storage.virtualMcps.findById(Q);if(!W)throw Error(`Virtual MCP not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let K=W.metadata?.ui??{},H={...K,pinnedViews:Y.length>0?Y:null,layout:G??K.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...W.metadata,ui:H}})}}})});import{z as jF}from"zod";var vs8,fs8,zl0;var Bs1=D(()=>{S0();vs8=jF.object({ids:jF.array(jF.string()).describe("Virtual MCP ids to look up")}),fs8=jF.object({items:jF.array(jF.object({id:jF.string(),last_used_at:jF.string().optional(),last_used_by:jF.string().optional()}))}),zl0=c({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:vs8,outputSchema:fs8,handler:async($,Z)=>{r(Z),t(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var Ds1=D(()=>{aa1();sa1();ea1();Qs1();Fs1();Ns1();Us1();Os1();Bs1()});import{z as o7}from"zod";var Pl0;var Ls1=D(()=>{I6();S0();Pl0=c({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:o7.object({startDate:o7.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:o7.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:o7.array(o7.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:o7.array(o7.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:o7.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:o7.object({cells:o7.array(o7.object({virtualMcpId:o7.string().nullable(),toolName:o7.string(),calls:o7.number(),errors:o7.number(),outputSize:o7.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as U5}from"zod";var Al0;var ws1=D(()=>{I6();S0();Al0=c({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U5.object({id:U5.string().describe("Log ID to fetch")}),outputSchema:U5.object({log:U5.object({id:U5.string().optional(),organizationId:U5.string(),connectionId:U5.string(),toolName:U5.string(),input:U5.record(U5.string(),U5.unknown()),output:U5.record(U5.string(),U5.unknown()),isError:U5.boolean(),errorMessage:U5.string().nullish(),durationMs:U5.number(),timestamp:U5.string(),userId:U5.string().nullish(),requestId:U5.string(),userAgent:U5.string().nullish(),virtualMcpId:U5.string().nullish(),properties:U5.record(U5.string(),U5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as K8}from"zod";var xs8,Tl0;var Es1=D(()=>{I6();S0();xs8=K8.object({id:K8.string().optional().describe("Unique log identifier"),organizationId:K8.string().describe("Organization ID"),connectionId:K8.string().describe("Connection ID"),toolName:K8.string().describe("Name of the tool that was called"),isError:K8.boolean().describe("Whether the call resulted in an error"),errorMessage:K8.string().nullish().describe("Error message if applicable"),durationMs:K8.number().describe("Call duration in milliseconds"),timestamp:K8.string().describe("ISO 8601 timestamp of the call"),userId:K8.string().nullish().describe("User who triggered the call"),requestId:K8.string().describe("Unique request identifier"),userAgent:K8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:K8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:K8.record(K8.string(),K8.string()).nullish().describe("Custom key-value metadata attached to the log")}),Tl0=c({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K8.object({connectionId:K8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:K8.array(K8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:K8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:K8.string().optional().describe("Filter by tool name"),isError:K8.boolean().optional().describe("Filter by error status"),startDate:K8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:K8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:K8.number().default(20).describe("Maximum number of results"),offset:K8.number().default(0).describe("Offset for pagination"),properties:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:K8.array(K8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:K8.record(K8.string(),K8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:K8.object({logs:K8.array(xs8).describe("Array of monitoring logs"),total:K8.number().describe("Total number of logs matching filters"),offset:K8.number().describe("Current offset for pagination"),limit:K8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as J$}from"zod";var Rl0;var js1=D(()=>{I6();S0();Rl0=c({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:J$.object({startDate:J$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:J$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:J$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:J$.array(J$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:J$.array(J$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:J$.array(J$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:J$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:J$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:J$.array(J$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:J$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:J$.object({totalCalls:J$.number().describe("Total number of tool calls"),errorRate:J$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:J$.number().describe("Average call duration in milliseconds"),errorRatePercent:J$.string().optional().describe("Error rate as a percentage string"),totalErrors:J$.number().optional().describe("Total number of errors"),p50DurationMs:J$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:J$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:J$.array(J$.object({connectionId:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avgDurationMs:J$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:J$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:J$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:J$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:J$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:J$.array(J$.object({toolName:J$.string(),connectionId:J$.string().nullable(),calls:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:J$.array(J$.object({timestamp:J$.string(),toolName:J$.string(),calls:J$.number(),errors:J$.number(),avg:J$.number(),p95:J$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:J$.array(J$.object({timestamp:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avg:J$.number(),p50:J$.number(),p95:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),totalTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),await WQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as pX}from"zod";var Il0;var zs1=D(()=>{I6();S0();Il0=c({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX.object({threadIds:pX.array(pX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:pX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:pX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:pX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:pX.object({items:pX.array(pX.object({threadId:pX.string(),calls:pX.number(),inputTokens:pX.number(),outputTokens:pX.number(),totalTokens:pX.number(),costUsd:pX.number()}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var Ps1=D(()=>{Ls1();ws1();Es1();js1();zs1()});function d90($){return typeof $==="string"&&gs8.has($.trim().toLowerCase())}var gs8;var ql0=D(()=>{gs8=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as yY}from"zod";var Ml0;var As1=D(()=>{S0();ql0();Ml0=c({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:yY.object({slug:yY.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!d90($),"Slug is reserved by Studio"),name:yY.string().min(1).max(255),description:yY.string().optional()}),outputSchema:yY.object({id:yY.string(),name:yY.string(),slug:yY.string(),logo:yY.string().nullable().optional(),metadata:yY.any().optional(),createdAt:yY.string().datetime().describe("ISO 8601 timestamp"),members:yY.array(yY.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as FK}from"zod";var kl0;var Ts1=D(()=>{S0();kl0=c({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:FK.object({}),outputSchema:FK.object({organizations:FK.array(FK.object({id:FK.string(),name:FK.string(),slug:FK.string(),logo:FK.string().nullable().optional(),metadata:FK.any().optional(),createdAt:FK.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as iG}from"zod";var Vl0;var Rs1=D(()=>{S0();Vl0=c({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iG.object({}),outputSchema:iG.object({id:iG.string(),name:iG.string(),slug:iG.string(),logo:iG.string().nullable().optional(),metadata:iG.any().optional(),createdAt:iG.string().datetime().describe("ISO 8601 timestamp"),members:iG.array(iG.any()).optional(),invitations:iG.array(iG.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as P3}from"zod";var Sl0;var Is1=D(()=>{S0();Sl0=c({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P3.object({id:P3.string(),name:P3.string().min(1).max(255).optional(),description:P3.string().optional()}),outputSchema:P3.object({id:P3.string(),name:P3.string(),slug:P3.string(),logo:P3.string().nullable().optional(),metadata:P3.any().optional(),createdAt:P3.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as Xp}from"zod";var Cl0;var qs1=D(()=>{S0();Cl0=c({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Xp.object({id:Xp.string()}),outputSchema:Xp.object({success:Xp.boolean(),id:Xp.string()}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),$.id!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let X=await Z.boundAuth.organization.get($.id);return await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...X?.metadata,archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as zF}from"zod";var _l0;var Ms1=D(()=>{S0();n7();_l0=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zF.object({}),outputSchema:zF.object({organizationId:zF.string(),sidebar_items:zF.array(Oi).nullable().optional(),enabled_plugins:zF.array(zF.string()).nullable().optional(),registry_config:Bi.nullable().optional(),simple_mode:Di.nullable().optional(),default_home_agents:wi.nullable().optional(),flags:ji.nullable().optional(),main_agent_id:zF.string().nullable().optional(),sprint_config:Ei.nullable().optional(),createdAt:zF.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:zF.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as CQ}from"zod";var vl0;var ks1=D(()=>{S0();n7();vl0=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Oi).optional(),enabled_plugins:CQ.array(CQ.string()).optional(),registry_config:Bi.optional(),simple_mode:Di.optional(),default_home_agents:wi.optional(),flags:ji.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:CQ.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Ei.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Oi).nullable().optional(),enabled_plugins:CQ.array(CQ.string()).nullable().optional(),registry_config:Bi.nullable().optional(),simple_mode:Di.nullable().optional(),default_home_agents:wi.nullable().optional(),flags:ji.nullable().optional(),main_agent_id:CQ.string().nullable().optional(),sprint_config:Ei.nullable().optional(),createdAt:CQ.string().datetime().describe("ISO 8601 timestamp"),updatedAt:CQ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),t(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as A3}from"zod";var Vs1,fl0,bl0;var Ss1=D(()=>{S0();n7();Vs1=AO.extend({organizationId:A3.string(),archivedAt:A3.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:A3.string().describe("ISO 8601 timestamp"),updatedAt:A3.string().describe("ISO 8601 timestamp")}),fl0=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({includeArchived:A3.boolean().optional().describe("Include archived brands in the list")}),outputSchema:A3.object({items:A3.array(Vs1)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),bl0=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({id:A3.string().describe("Brand context ID")}),outputSchema:Vs1.extend({organizationId:A3.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as sw}from"zod";var Cs1,xl0,yl0,gl0;var _s1=D(()=>{S0();n7();Cs1=AO.extend({organizationId:sw.string(),createdAt:sw.string().describe("ISO 8601 timestamp"),updatedAt:sw.string().describe("ISO 8601 timestamp")}),xl0=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:AO.omit({id:!0}),outputSchema:Cs1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),yl0=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:AO.partial().required({id:!0}),outputSchema:Cs1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),gl0=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:sw.object({id:sw.string().describe("Brand context ID")}),outputSchema:sw.object({success:sw.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function m90($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let U=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${U.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,W=G.data.metadata??{},K=cs8(J,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((U)=>U.trim()).filter(Boolean)?.slice().sort((U,O)=>U.length-O.length)[0]??W.ogSiteName??X??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function cs8($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,N]of Object.entries(Q))if(typeof N==="string"&&N&&hs8.has(F))Y[F]=N;let G={},W=($.typography??{}).fontFamilies??{};for(let[F,N]of Object.entries(W))if(typeof N==="string"&&N){let U=us8[F.toLowerCase()];if(U&&!G[U])G[U]=N}let K=$.fonts;if(Array.isArray(K))for(let F of K){let N=F.family;if(typeof N==="string"&&N&&!G.body)G.body=N}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var hs8,us8;var hl0=D(()=>{hs8=new Set(["primary","secondary","accent","background","foreground"]),us8={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as i90}from"zod";var ls8,ul0;var vs1=D(()=>{S0();hl0();n7();ls8=AO.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:i90.boolean()}),ul0=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:i90.object({domain:i90.string().describe("Website domain to extract brand from"),brandId:i90.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:ls8,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await m90($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function fs1($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var cl0,ll0;var bs1=D(()=>{dc0();S0();cl0=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A90,outputSchema:di,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return fs1(Q)}}),ll0=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:T90,outputSchema:R90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(fs1)}}})});import{resolveTxt as ds8}from"dns/promises";function dl0($){return`${ms8}.${$.toLowerCase()}`}function xs1(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function ys1($,Z,X=ds8){if(!Z)return!1;try{return(await X(dl0($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var ms8="_deco-verify";var gs1=()=>{};import{z as M5}from"zod";function uO($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?dl0($.domain):null,recordValue:Z?$.verificationToken:null}}function ps8($){let Z=$.toLowerCase().trim();if(!is8.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(T3.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var is8,ml0,p90,il0,pl0,nl0,tl0,ol0;var hs1=D(()=>{gY();gs1();S0();is8=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,ml0=M5.enum(["off","auto","request"]),p90=M5.object({id:M5.string(),domain:M5.string(),joinMode:ml0,verificationStatus:M5.enum(["pending","verified"]),verificationMethod:M5.enum(["email","dns"]).nullable(),verifiedAt:M5.string().nullable(),recordName:M5.string().nullable(),recordValue:M5.string().nullable()});il0=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({}),outputSchema:M5.object({domains:M5.array(p90)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(uO)}}}),pl0=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({domain:M5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:ml0.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:p90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=ps8($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,W=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(W){if(W.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(W.id,"email");return uO(H)}return uO(W)}let K=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:xs1()});return uO(K)}}),nl0=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string(),joinMode:ml0}),outputSchema:p90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return uO(Y)}}),tl0=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({verified:M5.boolean(),domain:p90}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:uO(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await ys1(Q.domain,Q.verificationToken))return{verified:!1,domain:uO(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:uO(G)}}}),ol0=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({success:M5.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function cO($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as z9}from"zod";var ns8,rl0,al0,sl0;var us1=D(()=>{S0();C4();ns8=z9.object({id:z9.string(),userId:z9.string(),status:z9.enum(["pending","approved","denied"]),createdAt:z9.string(),user:z9.object({id:z9.string(),name:z9.string(),email:z9.string(),image:z9.string().nullable()}).nullable()}),rl0=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({}),outputSchema:z9.object({requests:z9.array(ns8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),al0=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!cO(J))throw J}if(Y)y1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),sl0=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)y1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as _Q}from"zod";var el0;var cs1=D(()=>{C4();S0();MQ();el0=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_Q.object({organizationId:_Q.string().optional(),userId:_Q.string(),role:_Q.array(_Q.string())}),outputSchema:_Q.object({id:_Q.string(),organizationId:_Q.string(),userId:_Q.string(),role:_Q.union([_Q.string(),_Q.array(_Q.string())]),createdAt:_Q.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!s60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as lx}from"zod";var $d0;var ls1=D(()=>{C4();S0();$d0=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lx.object({organizationId:lx.string().optional(),memberIdOrEmail:lx.string()}),outputSchema:lx.object({success:lx.boolean(),memberIdOrEmail:lx.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=Y1(Z);if(Y)y1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as r7}from"zod";var Zd0;var ds1=D(()=>{S0();Zd0=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:r7.object({limit:r7.number().int().min(1).max(1000).optional(),offset:r7.number().int().min(0).optional()}),outputSchema:r7.object({members:r7.array(r7.object({id:r7.string(),organizationId:r7.string(),userId:r7.string(),role:r7.string(),createdAt:r7.string().datetime().describe("ISO 8601 timestamp"),user:r7.object({id:r7.string(),name:r7.string(),email:r7.string(),image:r7.string().optional()}).optional()}))}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as fZ}from"zod";var Xd0;var ms1=D(()=>{C4();S0();MQ();Xd0=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fZ.object({organizationId:fZ.string().optional(),memberId:fZ.string(),role:fZ.array(fZ.string())}),outputSchema:fZ.object({id:fZ.string(),organizationId:fZ.string(),userId:fZ.string(),role:fZ.union([fZ.string(),fZ.array(fZ.string())]),createdAt:fZ.string().datetime().describe("ISO 8601 timestamp"),user:fZ.object({email:fZ.string(),name:fZ.string(),image:fZ.string().optional()})}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!s60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function is1(){if(Qp&&Date.now()-Qp.fetchedAt<600000)return Qp.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Qp={rate:X,fetchedAt:Date.now()},X}catch{return Qp?.rate??5.5}}function ps1($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Qp=null;function Qd0($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,W)=>{if(typeof J==="object"&&J!==null)Qd0(J,`${G}[${W}]`,X);else X.append(`${G}[${W}]`,String(J))});else if(typeof Y==="object")Qd0(Y,G,X);else X.append(G,String(Y))}return X}async function Yp($,Z){let X=b0().stripeSecretKey;if(!X)throw new hY(503,"billing is not configured");let Q=Z?.params?Qd0(Z.params).toString():void 0,Y=await fetch(`${ts8}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(os8)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new hY(Y.status,J)}return G}function ns1($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function ts1($){let Z=b0().stripeOrgPriceId;if(!Z)throw new hY(503,"billing is not configured");let X=await Yp("/checkout/sessions",{params:{mode:"subscription",...ns1(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new hY(500,"checkout session lacks url");return{url:X.url}}function rs8($,Z){return Math.round($*(1+Z/100))}async function os1($){let Z=rs8($.amountCents,$.feePercent),X=ps1($.amountCents,$.currency,await is1()),Q=b0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Yp("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...ns1($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new hY(500,"checkout session lacks url");return{url:J.url}}async function n90($){let Z=await Yp("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new hY(500,"portal session lacks url");return{url:Z.url}}async function t90($){return Yp(`/subscriptions/${encodeURIComponent($)}`)}async function rs1($){await Yp(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var ts8="https://api.stripe.com/v1",hY,os8=15000;var ew=D(()=>{q$();hY=class hY extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as Yd0}from"zod";var Gd0;var as1=D(()=>{ew();L9();S0();C4();Gd0=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Yd0.object({}),outputSchema:Yd0.object({url:Yd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${b9()}/${encodeURIComponent(Q)}/members`,{url:J}=await ts1({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return vY({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as Jd0}from"zod";var Wd0;var ss1=D(()=>{ew();L9();S0();Wd0=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Jd0.object({}),outputSchema:Jd0.object({url:Jd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await n90({customerId:Q.stripeCustomerId,returnUrl:`${b9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof hY)throw Error(Y.message);throw Y}}})});function o90($){return Kd0[$%Kd0.length]??as8}function vQ($){return $.createdBy==="system"}function PF($){return r90.filter((Z)=>qx($,ss8[Z]))}function mx($,Z){return $?.startsWith(`${dx[Z]}:`)??!1}function AF($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Hd0($,Z){let X=AF($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function lO($,Z,X){if(Z.length===0)return!1;let Q=Hd0($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function $e1($,Z){return lO($,Z)&&!lO($,Z,{verifiedOnly:!0})}function Ze1($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function es8($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==T8)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Xe1($,Z=Fd0){let X=es8($),Q=new Set,Y=0;for(let G of[...$].sort((J,W)=>J.occurredAt.localeCompare(W.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var T8="super-agent",Kd0,as8,Gp='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',es1,r90,dx,ss8,Fd0=5,Qe1="task-board.item.updated",Ye1="task-board.item.deleted";var X9=D(()=>{n7();Kd0=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],as8=Kd0[0];es1="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",r90=["qa","code_review"],dx={qa:"QA Agent",code_review:"Code Reviewer"},ss8={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function Nd0($){return $==="trial"?"trial":"subscription"}function Jp($,Z,X,Q={}){vY({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function Ud0($){return $?.status==="active"||$?.status==="past_due"}function a90($,Z){if(Ud0($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Wp(){let $=b0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function dO(){return{...Wp(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function ix($,Z,X=Wp()){if(!X.enforced||!vQ(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Jp($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new a7("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=a90(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Jp($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:Nd0(G.periodKey),limit:G.limit}),new a7(G.exhaustedReason)}async function Ge1($,Z,X=Wp()){if(!X.enforced||!vQ(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=a90(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Jp($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:Nd0(Y.periodKey),limit:Y.limit}),new a7(Y.exhaustedReason);if(G==="runs_exhausted")throw Jp($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new a7("runs_exhausted");if(G==="claimed")Jp($,"task_quota_claimed",Z,{billing_mode:Nd0(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function Je1($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function We1($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function Ke1($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))vY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var $e8="[SUBSCRIPTION_REQUIRED]",Ze8,a7;var pG=D(()=>{X9();C4();q$();Ze8={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};a7=class a7 extends Error{reason;constructor($){super(`${$e8} ${Ze8[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as TF}from"zod";var Od0;var He1=D(()=>{S0();pG();Od0=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TF.object({}),outputSchema:TF.object({enforced:TF.boolean(),billingStatus:TF.string(),subscribed:TF.boolean(),hasBillingAccount:TF.boolean(),used:TF.number(),limit:TF.number(),currentPeriodEnd:TF.string().datetime().nullable()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=Wp(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=a90(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:Ud0(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var Fe1=D(()=>{As1();Ts1();Rs1();Is1();qs1();Ms1();ks1();Ss1();_s1();vs1();bs1();hs1();us1();cs1();ls1();ds1();ms1();as1();ss1();He1()});function NK($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function s90($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(s90);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||s90(X)));return!1}function Bd0($){return Array.isArray($)&&$.every(s90)}function Kp($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||s90(X)))}var he1="vercel.ai.error",Qe8,Ne1,Ue1,J1,ue1="AI_APICallError",ce1,Ye8,Oe1,Be1,Q4,le1="AI_EmptyResponseBodyError",de1,Ge8,De1,Le1,e90,me1="AI_InvalidArgumentError",ie1,Je8,we1,Ee1,mO,pe1="AI_InvalidPromptError",ne1,We8,je1,ze1,nG,te1="AI_InvalidResponseDataError",oe1,Ke8,Pe1,Ae1,px,re1="AI_JSONParseError",ae1,He8,Te1,Re1,RF,se1="AI_LoadAPIKeyError",ee1,Fe8,Ie1,qe1,$E,$0$="AI_LoadSettingError",Z0$,Ne8,Me1,ke1,X0$,Q0$="AI_NoContentGeneratedError",Y0$,Ue8,Ve1,Se1,G0$,J0$="AI_NoSuchModelError",W0$,Oe8,Ce1,_e1,u5,K0$="AI_TooManyEmbeddingValuesForCallError",H0$,Be8,ve1,fe1,nx,F0$="AI_TypeValidationError",N0$,De8,be1,xe1,O5,U0$="AI_UnsupportedFunctionalityError",O0$,Le8,ye1,ge1,v4;var a1=D(()=>{Qe8=Symbol.for(he1),J1=class $ extends(Ue1=Error,Ne1=Qe8,Ue1){constructor({name:Z,message:X,cause:Q}){super(X);this[Ne1]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,he1)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},ce1=`vercel.ai.error.${ue1}`,Ye8=Symbol.for(ce1),Q4=class extends(Be1=J1,Oe1=Ye8,Be1){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:W=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:K}){super({name:ue1,message:$,cause:J});this[Oe1]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=W,this.data=K}static isInstance($){return J1.hasMarker($,ce1)}},de1=`vercel.ai.error.${le1}`,Ge8=Symbol.for(de1),e90=class extends(Le1=J1,De1=Ge8,Le1){constructor({message:$="Empty response body"}={}){super({name:le1,message:$});this[De1]=!0}static isInstance($){return J1.hasMarker($,de1)}};ie1=`vercel.ai.error.${me1}`,Je8=Symbol.for(ie1),mO=class extends(Ee1=J1,we1=Je8,Ee1){constructor({message:$,cause:Z,argument:X}){super({name:me1,message:$,cause:Z});this[we1]=!0,this.argument=X}static isInstance($){return J1.hasMarker($,ie1)}},ne1=`vercel.ai.error.${pe1}`,We8=Symbol.for(ne1),nG=class extends(ze1=J1,je1=We8,ze1){constructor({prompt:$,message:Z,cause:X}){super({name:pe1,message:`Invalid prompt: ${Z}`,cause:X});this[je1]=!0,this.prompt=$}static isInstance($){return J1.hasMarker($,ne1)}},oe1=`vercel.ai.error.${te1}`,Ke8=Symbol.for(oe1),px=class extends(Ae1=J1,Pe1=Ke8,Ae1){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:te1,message:Z});this[Pe1]=!0,this.data=$}static isInstance($){return J1.hasMarker($,oe1)}},ae1=`vercel.ai.error.${re1}`,He8=Symbol.for(ae1),RF=class extends(Re1=J1,Te1=He8,Re1){constructor({text:$,cause:Z}){super({name:re1,message:`JSON parsing failed: Text: ${$}.
 Error message: ${NK(Z)}`,cause:Z});this[Te1]=!0,this.text=$}static isInstance($){return J1.hasMarker($,ae1)}},ee1=`vercel.ai.error.${se1}`,Fe8=Symbol.for(ee1),$E=class extends(qe1=J1,Ie1=Fe8,qe1){constructor({message:$}){super({name:se1,message:$});this[Ie1]=!0}static isInstance($){return J1.hasMarker($,ee1)}},Z0$=`vercel.ai.error.${$0$}`,Ne8=Symbol.for(Z0$),X0$=class extends(ke1=J1,Me1=Ne8,ke1){constructor({message:$}){super({name:$0$,message:$});this[Me1]=!0}static isInstance($){return J1.hasMarker($,Z0$)}},Y0$=`vercel.ai.error.${Q0$}`,Ue8=Symbol.for(Y0$),G0$=class extends(Se1=J1,Ve1=Ue8,Se1){constructor({message:$="No content generated."}={}){super({name:Q0$,message:$});this[Ve1]=!0}static isInstance($){return J1.hasMarker($,Y0$)}},W0$=`vercel.ai.error.${J0$}`,Oe8=Symbol.for(W0$),u5=class extends(_e1=J1,Ce1=Oe8,_e1){constructor({errorName:$=J0$,modelId:Z,modelType:X,message:Q=`No such ${X}: ${Z}`}){super({name:$,message:Q});this[Ce1]=!0,this.modelId=Z,this.modelType=X}static isInstance($){return J1.hasMarker($,W0$)}},H0$=`vercel.ai.error.${K0$}`,Be8=Symbol.for(H0$),nx=class extends(fe1=J1,ve1=Be8,fe1){constructor($){super({name:K0$,message:`Too many values for a single embedding call. The ${$.provider} model "${$.modelId}" can only embed up to ${$.maxEmbeddingsPerCall} values per call, but ${$.values.length} values were provided.`});this[ve1]=!0,this.provider=$.provider,this.modelId=$.modelId,this.maxEmbeddingsPerCall=$.maxEmbeddingsPerCall,this.values=$.values}static isInstance($){return J1.hasMarker($,H0$)}},N0$=`vercel.ai.error.${F0$}`,De8=Symbol.for(N0$),O5=class $ extends(xe1=J1,be1=De8,xe1){constructor({value:Z,cause:X,context:Q}){let Y="Type validation failed";if(Q==null?void 0:Q.field)Y+=` for ${Q.field}`;if((Q==null?void 0:Q.entityName)||(Q==null?void 0:Q.entityId)){Y+=" (";let G=[];if(Q.entityName)G.push(Q.entityName);if(Q.entityId)G.push(`id: "${Q.entityId}"`);Y+=G.join(", "),Y+=")"}super({name:F0$,message:`${Y}: Value: ${JSON.stringify(Z)}.
 Error message: ${NK(X)}`,cause:X});this[be1]=!0,this.value=Z,this.context=Q}static isInstance(Z){return J1.hasMarker(Z,N0$)}static wrap({value:Z,cause:X,context:Q}){var Y,G,J;if($.isInstance(X)&&X.value===Z&&((Y=X.context)==null?void 0:Y.field)===(Q==null?void 0:Q.field)&&((G=X.context)==null?void 0:G.entityName)===(Q==null?void 0:Q.entityName)&&((J=X.context)==null?void 0:J.entityId)===(Q==null?void 0:Q.entityId))return X;return new $({value:Z,cause:X,context:Q})}},O0$=`vercel.ai.error.${U0$}`,Le8=Symbol.for(O0$),v4=class extends(ge1=J1,ye1=Le8,ge1){constructor({functionality:$,message:Z=`'${$}' functionality not supported.`}){super({name:U0$,message:Z});this[ye1]=!0,this.functionality=$}static isInstance($){return J1.hasMarker($,O0$)}}});import*as QZ0 from"zod/v4";import{ZodFirstPartyTypeKind as O4}from"zod/v3";import{ZodFirstPartyTypeKind as fe8}from"zod/v3";import{ZodFirstPartyTypeKind as $Z0}from"zod/v3";function o$(...$){return $.reduce((Z,X)=>({...Z,...X!=null?X:{}}),{})}function ZZ0({tools:$=[],providerToolNames:Z,resolveProviderToolName:X}){var Q;let Y={},G={};for(let J of $)if(J.type==="provider"){let W=(Q=X==null?void 0:X(J))!=null?Q:(J.id in Z)?Z[J.id]:void 0;if(W==null)continue;Y[J.name]=W,G[W]=J.name}return{toProviderToolName:(J)=>{var W;return(W=Y[J])!=null?W:J},toCustomToolName:(J)=>{var W;return(W=G[J])!=null?W:J}}}async function bQ($,Z){if($==null)return Promise.resolve();let X=Z==null?void 0:Z.abortSignal;return new Promise((Q,Y)=>{if(X==null?void 0:X.aborted){Y(B0$());return}let G=setTimeout(()=>{J(),Q()},$),J=()=>{clearTimeout(G),X==null||X.removeEventListener("abort",W)},W=()=>{J(),Y(B0$())};X==null||X.addEventListener("abort",W)})}function B0$(){return new DOMException("Delay was aborted","AbortError")}function tx($){return Object.fromEntries([...$.headers])}function P9($){let Z=$.replace(/-/g,"+").replace(/_/g,"/"),X=Ee8(Z);return Uint8Array.from(X,(Q)=>Q.codePointAt(0))}function yQ($){let Z="";for(let X=0;X<$.length;X++)Z+=String.fromCodePoint($[X]);return we8(Z)}function KZ($){return $ instanceof Uint8Array?yQ($):$}function z0$($,Z={}){let{useArrayBrackets:X=!0}=Z,Q=new FormData;for(let[Y,G]of Object.entries($)){if(G==null)continue;if(Array.isArray(G)){if(G.length===1){Q.append(Y,G[0]);continue}let J=X?`${Y}[]`:Y;for(let W of G)Q.append(J,W);continue}Q.append(Y,G)}return Q}async function Hp($){var Z;try{await((Z=$.body)==null?void 0:Z.cancel())}catch(X){}}function ze8($=globalThis){return $.window!=null}function Pe8($){let Z;try{Z=new URL($)}catch(Q){throw new WZ({url:$,message:`Invalid URL: ${$}`})}if(Z.protocol==="data:")return;if(Z.protocol!=="http:"&&Z.protocol!=="https:")throw new WZ({url:$,message:`URL scheme must be http, https, or data, got ${Z.protocol}`});let X=Z.hostname.toLowerCase().replace(/\.+$/,"");if(!X)throw new WZ({url:$,message:"URL must have a hostname"});if(X==="localhost"||X.endsWith(".local")||X.endsWith(".localhost"))throw new WZ({url:$,message:`URL with hostname ${X} is not allowed`});if(X.startsWith("[")&&X.endsWith("]")){let Q=X.slice(1,-1);if(Te8(Q))throw new WZ({url:$,message:`URL with IPv6 address ${X} is not allowed`});return}if(T0$(X)){if(R0$(X))throw new WZ({url:$,message:`URL with IP address ${X} is not allowed`});return}}function T0$($){let Z=$.split(".");if(Z.length!==4)return!1;return Z.every((X)=>{let Q=Number(X);return Number.isInteger(Q)&&Q>=0&&Q<=255&&String(Q)===X})}function R0$($){let Z=$.split(".").map(Number),[X,Q,Y]=Z;if(X===0)return!0;if(X===10)return!0;if(X===100&&Q>=64&&Q<=127)return!0;if(X===127)return!0;if(X===169&&Q===254)return!0;if(X===172&&Q>=16&&Q<=31)return!0;if(X===192&&Q===0&&Y===0)return!0;if(X===192&&Q===168)return!0;if(X===198&&(Q===18||Q===19))return!0;if(X>=240)return!0;return!1}function Ae8($){let Z=$.toLowerCase(),X=Z.indexOf("%");if(X!==-1)Z=Z.slice(0,X);let Q=Z.split("::");if(Q.length>2)return null;let Y=(J)=>{if(J==="")return[];let W=[],K=J.split(":");for(let H=0;H<K.length;H++){let F=K[H];if(F.includes(".")){if(H!==K.length-1||!T0$(F))return null;let[N,U,O,B]=F.split(".").map(Number);W.push(N<<8|U,O<<8|B);continue}if(!/^[0-9a-f]{1,4}$/.test(F))return null;W.push(parseInt(F,16))}return W},G=Y(Q[0]);if(G===null)return null;if(Q.length===2){let J=Y(Q[1]);if(J===null)return null;let W=8-G.length-J.length;if(W<0)return null;return[...G,...Array(W).fill(0),...J]}return G.length===8?G:null}function Te8($){let Z=Ae8($);if(Z===null)return!0;let X=(Y)=>Z.slice(0,Y).every((G)=>G===0);if(X(7)&&(Z[7]===0||Z[7]===1))return!0;if((Z[0]&65024)===64512)return!0;if((Z[0]&65472)===65152)return!0;if((Z[0]&65472)===65216)return!0;if((Z[0]&65280)===65280)return!0;if(X(6)||X(5)&&Z[5]===65535||X(4)&&Z[4]===65535&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===0&&Z[3]===0&&Z[4]===0&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===1){let Y=Z[6]>>8&255,G=Z[6]&255,J=Z[7]>>8&255,W=Z[7]&255;return R0$(`${Y}.${G}.${J}.${W}`)}return!1}async function jd0({url:$,headers:Z,abortSignal:X,maxRedirects:Q=Re8}){let Y={signal:X};if(Z!==void 0)Y.headers=Z;let G=$;for(let J=0;J<=Q;J++){Pe8(G);let W=await fetch(G,{...Y,redirect:"manual"});if(W.type==="opaqueredirect"){if(!ze8())throw new WZ({url:$,message:`Redirect from ${G} could not be validated and was blocked`});return await fetch(G,{...Y,redirect:"follow"})}let K=W.headers.get("location");if(W.status>=300&&W.status<400&&K){await Hp(W),G=new URL(K,G).toString();continue}return W}throw new WZ({url:$,message:`Too many redirects (max ${Q})`})}async function zd0({response:$,url:Z,maxBytes:X=XZ0}){let Q=$.headers.get("content-length");if(Q!=null){let F=parseInt(Q,10);if(!isNaN(F)&&F>X)throw await Hp($),new WZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes (Content-Length: ${F}).`})}let Y=$.body;if(Y==null)return new Uint8Array(0);let G=Y.getReader(),J=[],W=0;try{while(!0){let{done:F,value:N}=await G.read();if(F)break;if(W+=N.length,W>X)throw new WZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes.`});J.push(N)}}finally{try{await G.cancel()}finally{G.releaseLock()}}let K=new Uint8Array(W),H=0;for(let F of J)K.set(F,H),H+=F.length;return K}async function Pd0($,Z){var X,Q;try{let Y=await jd0({url:$,abortSignal:Z==null?void 0:Z.abortSignal});if(!Y.ok)throw await Hp(Y),new WZ({url:$,statusCode:Y.status,statusText:Y.statusText});let G=await zd0({response:Y,url:$,maxBytes:(X=Z==null?void 0:Z.maxBytes)!=null?X:XZ0}),J=(Q=Y.headers.get("content-type"))!=null?Q:void 0;return new Blob([G],J?{type:J}:void 0)}catch(Y){if(WZ.isInstance(Y))throw Y;throw new WZ({url:$,cause:Y})}}function ox($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function fQ($){return($ instanceof Error||$ instanceof DOMException)&&($.name==="AbortError"||$.name==="ResponseAborted"||$.name==="TimeoutError")}function Me8($){if(!($ instanceof Error))return!1;let Z=$.code;if(typeof Z==="string"&&qe8.includes(Z))return!0;return!1}function I0$({error:$,url:Z,requestBodyValues:X}){if(fQ($))return $;if($ instanceof TypeError&&Ie8.includes($.message.toLowerCase())){let Q=$.cause;if(Q!=null)return new Q4({message:`Cannot connect to API: ${Q.message}`,cause:Q,url:Z,requestBodyValues:X,isRetryable:!0})}if(Me8($))return new Q4({message:`Cannot connect to API: ${$.message}`,cause:$,url:Z,requestBodyValues:X,isRetryable:!0});return $}function iO($=globalThis){var Z,X,Q;if($.window)return"runtime/browser";if((Z=$.navigator)==null?void 0:Z.userAgent)return`runtime/${$.navigator.userAgent.toLowerCase()}`;if((Q=(X=$.process)==null?void 0:X.versions)==null?void 0:Q.node)return`runtime/node.js/${$.process.version.substring(0)}`;if($.EdgeRuntime)return"runtime/vercel-edge";return"runtime/unknown"}function pO($){if($==null)return{};let Z={};if($ instanceof Headers)$.forEach((X,Q)=>{Z[Q.toLowerCase()]=X});else{if(!Array.isArray($))$=Object.entries($);for(let[X,Q]of $)if(Q!=null)Z[X.toLowerCase()]=Q}return Z}function t4($,...Z){let X=new Headers(pO($)),Q=X.get("user-agent")||"";return X.set("user-agent",[Q,...Z].filter(Boolean).join(" ")),Object.fromEntries(X.entries())}function XE($){return $!=null}function M0$($,Z){try{return new URL($).origin===new URL(Z).origin}catch(X){return!1}}function k0$({mediaType:$,url:Z,supportedUrls:X}){return Z=Z.toLowerCase(),$=$.toLowerCase(),Object.entries(X).map(([Q,Y])=>{let G=Q.toLowerCase();return G==="*"||G==="*/*"?{mediaTypePrefix:"",regexes:Y}:{mediaTypePrefix:G.replace(/\*/,""),regexes:Y}}).filter(({mediaTypePrefix:Q})=>$.startsWith(Q)).flatMap(({regexes:Q})=>Q).some((Q)=>Q.test(Z))}function rx({apiKey:$,environmentVariableName:Z,apiKeyParameterName:X="apiKey",description:Q}){if(typeof $==="string")return $;if($!=null)throw new $E({message:`${Q} API key must be a string.`});if(typeof process>"u")throw new $E({message:`${Q} API key is missing. Pass it using the '${X}' parameter. Environment variables are not supported in this environment.`});if($=process.env[Z],$==null)throw new $E({message:`${Q} API key is missing. Pass it using the '${X}' parameter or the ${Z} environment variable.`});if(typeof $!=="string")throw new $E({message:`${Q} API key must be a string. The value of the ${Z} environment variable is not a string.`});return $}function UK({settingValue:$,environmentVariableName:Z}){if(typeof $==="string")return $;if($!=null||typeof process>"u")return;if($=process.env[Z],$==null||typeof $!=="string")return;return $}function V0$($){var Z;let[X,Q=""]=$.toLowerCase().split("/");return(Z={mpeg:"mp3","x-wav":"wav",opus:"ogg",mp4:"m4a","x-m4a":"m4a"}[Q])!=null?Z:Q}function w0$($){let Z=JSON.parse($);if(Z===null||typeof Z!=="object")return Z;if(Ve8.test($)===!1&&Se8.test($)===!1)return Z;return Ce8(Z)}function Ce8($){let Z=[$];while(Z.length){let X=Z;Z=[];for(let Q of X){if(Object.prototype.hasOwnProperty.call(Q,"__proto__"))throw SyntaxError("Object contains forbidden prototype property");if(Object.prototype.hasOwnProperty.call(Q,"constructor")&&Q.constructor!==null&&typeof Q.constructor==="object"&&Object.prototype.hasOwnProperty.call(Q.constructor,"prototype"))throw SyntaxError("Object contains forbidden prototype property");for(let Y in Q){let G=Q[Y];if(G&&typeof G==="object")Z.push(G)}}}return $}function Ad0($){let{stackTraceLimit:Z}=Error;try{Error.stackTraceLimit=0}catch(X){return w0$($)}try{return w0$($)}finally{Error.stackTraceLimit=Z}}function Td0($){if($.type==="object"||Array.isArray($.type)&&$.type.includes("object")){$.additionalProperties=!1;let{properties:X}=$;if(X!=null)for(let Q of Object.keys(X))X[Q]=ZE(X[Q])}if($.items!=null)$.items=Array.isArray($.items)?$.items.map(ZE):ZE($.items);if($.anyOf!=null)$.anyOf=$.anyOf.map(ZE);if($.allOf!=null)$.allOf=$.allOf.map(ZE);if($.oneOf!=null)$.oneOf=$.oneOf.map(ZE);let{definitions:Z}=$;if(Z!=null)for(let X of Object.keys(Z))Z[X]=ZE(Z[X]);return $}function ZE($){if(typeof $==="boolean")return $;return Td0($)}function uY(){return{}}function be8($,Z){var X,Q,Y;let G={type:"array"};if(((X=$.type)==null?void 0:X._def)&&((Y=(Q=$.type)==null?void 0:Q._def)==null?void 0:Y.typeName)!==fe8.ZodAny)G.items=j6($.type._def,{...Z,currentPath:[...Z.currentPath,"items"]});if($.minLength)G.minItems=$.minLength.value;if($.maxLength)G.maxItems=$.maxLength.value;if($.exactLength)G.minItems=$.exactLength.value,G.maxItems=$.exactLength.value;return G}function xe8($){let Z={type:"integer",format:"int64"};if(!$.checks)return Z;for(let X of $.checks)switch(X.kind){case"min":if(X.inclusive)Z.minimum=X.value;else Z.exclusiveMinimum=X.value;break;case"max":if(X.inclusive)Z.maximum=X.value;else Z.exclusiveMaximum=X.value;break;case"multipleOf":Z.multipleOf=X.value;break}return Z}function ye8(){return{type:"boolean"}}function S0$($,Z){return j6($.type._def,Z)}function C0$($,Z,X){let Q=X!=null?X:Z.dateStrategy;if(Array.isArray(Q))return{anyOf:Q.map((Y,G)=>C0$($,Z,Y))};switch(Q){case"string":case"format:date-time":return{type:"string",format:"date-time"};case"format:date":return{type:"string",format:"date"};case"integer":return he8($)}}function ue8($,Z){return{...j6($.innerType._def,Z),default:$.defaultValue()}}function ce8($,Z){return Z.effectStrategy==="input"?j6($.schema._def,Z):uY()}function le8($){return{type:"string",enum:Array.from($.values)}}function me8($,Z){let X=[j6($.left._def,{...Z,currentPath:[...Z.currentPath,"allOf","0"]}),j6($.right._def,{...Z,currentPath:[...Z.currentPath,"allOf","1"]})].filter((Y)=>!!Y),Q=[];return X.forEach((Y)=>{if(de8(Y))Q.push(...Y.allOf);else{let G=Y;if("additionalProperties"in Y&&Y.additionalProperties===!1){let{additionalProperties:J,...W}=Y;G=W}Q.push(G)}}),Q.length?{allOf:Q}:void 0}function ie8($){let Z=typeof $.value;if(Z!=="bigint"&&Z!=="number"&&Z!=="boolean"&&Z!=="string")return{type:Array.isArray($.value)?"array":"object"};return{type:Z==="bigint"?"integer":Z,const:$.value}}function _0$($,Z){let X={type:"string"};if($.checks)for(let Q of $.checks)switch(Q.kind){case"min":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value;break;case"max":X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"email":switch(Z.emailStrategy){case"format:email":I3(X,"email",Q.message,Z);break;case"format:idn-email":I3(X,"idn-email",Q.message,Z);break;case"pattern:zod":nX(X,R3.email,Q.message,Z);break}break;case"url":I3(X,"uri",Q.message,Z);break;case"uuid":I3(X,"uuid",Q.message,Z);break;case"regex":nX(X,Q.regex,Q.message,Z);break;case"cuid":nX(X,R3.cuid,Q.message,Z);break;case"cuid2":nX(X,R3.cuid2,Q.message,Z);break;case"startsWith":nX(X,RegExp(`^${Ld0(Q.value,Z)}`),Q.message,Z);break;case"endsWith":nX(X,RegExp(`${Ld0(Q.value,Z)}$`),Q.message,Z);break;case"datetime":I3(X,"date-time",Q.message,Z);break;case"date":I3(X,"date",Q.message,Z);break;case"time":I3(X,"time",Q.message,Z);break;case"duration":I3(X,"duration",Q.message,Z);break;case"length":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value,X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"includes":{nX(X,RegExp(Ld0(Q.value,Z)),Q.message,Z);break}case"ip":{if(Q.version!=="v6")I3(X,"ipv4",Q.message,Z);if(Q.version!=="v4")I3(X,"ipv6",Q.message,Z);break}case"base64url":nX(X,R3.base64url,Q.message,Z);break;case"jwt":nX(X,R3.jwt,Q.message,Z);break;case"cidr":{if(Q.version!=="v6")nX(X,R3.ipv4Cidr,Q.message,Z);if(Q.version!=="v4")nX(X,R3.ipv6Cidr,Q.message,Z);break}case"emoji":nX(X,R3.emoji(),Q.message,Z);break;case"ulid":{nX(X,R3.ulid,Q.message,Z);break}case"base64":{switch(Z.base64Strategy){case"format:binary":{I3(X,"binary",Q.message,Z);break}case"contentEncoding:base64":{X.contentEncoding="base64";break}case"pattern:zod":{nX(X,R3.base64,Q.message,Z);break}}break}case"nanoid":nX(X,R3.nanoid,Q.message,Z);case"toLowerCase":case"toUpperCase":case"trim":break;default:}return X}function Ld0($,Z){return Z.patternStrategy==="escape"?ne8($):$}function ne8($){let Z="";for(let X=0;X<$.length;X++){if(!pe8.has($[X]))Z+="\\";Z+=$[X]}return Z}function I3($,Z,X,Q){var Y;if($.format||((Y=$.anyOf)==null?void 0:Y.some((G)=>G.format))){if(!$.anyOf)$.anyOf=[];if($.format)$.anyOf.push({format:$.format}),delete $.format;$.anyOf.push({format:Z,...X&&Q.errorMessages&&{errorMessage:{format:X}}})}else $.format=Z}function nX($,Z,X,Q){var Y;if($.pattern||((Y=$.allOf)==null?void 0:Y.some((G)=>G.pattern))){if(!$.allOf)$.allOf=[];if($.pattern)$.allOf.push({pattern:$.pattern}),delete $.pattern;$.allOf.push({pattern:j0$(Z,Q),...X&&Q.errorMessages&&{errorMessage:{pattern:X}}})}else $.pattern=j0$(Z,Q)}function j0$($,Z){var X;if(!Z.applyRegexFlags||!$.flags)return $.source;let Q={i:$.flags.includes("i"),m:$.flags.includes("m"),s:$.flags.includes("s")},Y=Q.i?$.source.toLowerCase():$.source,G="",J=!1,W=!1,K=!1;for(let H=0;H<Y.length;H++){if(J){G+=Y[H],J=!1;continue}if(Q.i){if(W){if(Y[H].match(/[a-z]/)){if(K)G+=Y[H],G+=`${Y[H-2]}-${Y[H]}`.toUpperCase(),K=!1;else if(Y[H+1]==="-"&&((X=Y[H+2])==null?void 0:X.match(/[a-z]/)))G+=Y[H],K=!0;else G+=`${Y[H]}${Y[H].toUpperCase()}`;continue}}else if(Y[H].match(/[a-z]/)){G+=`[${Y[H]}${Y[H].toUpperCase()}]`;continue}}if(Q.m){if(Y[H]==="^"){G+=`(^|(?<=[\r
 ]))`;continue}else if(Y[H]==="$"){G+=`($|(?=[\r
@@ -977,7 +977,7 @@ ${Y}`:Y}var s4$,e64;var Im0=D(()=>{s4$=/[\r\n<>]/,e64=/^[^\s@<>]+@[^\s@<>]+\.[^\
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=zp0(" "+Y+"="+Q[Y]+`
 `);return y4.from(X)};qJ4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(y4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=y4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};qJ4.encode=function(Z){let X=y4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(y4.byteLength(Q)!==Q.length)return null;while(y4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(y4.byteLength(Q)>100||y4.byteLength(Y)>155)return null;if(Z.linkname&&y4.byteLength(Z.linkname)>100)return null;if(y4.write(X,Q),y4.write(X,BB(Z.mode&4095,6),100),y4.write(X,BB(Z.uid,6),108),y4.write(X,BB(Z.gid,6),116),RJ4(Z.size,X,124),y4.write(X,BB(Z.mtime.getTime()/1000|0,11),136),X[156]=48+AJ4(Z.type),Z.linkname)y4.write(X,Z.linkname,157);if(y4.copy(oX$,X,257),y4.copy(DJ4,X,263),Z.uname)y4.write(X,Z.uname,265);if(Z.gname)y4.write(X,Z.gname,297);if(y4.write(X,BB(Z.devmajor||0,6),329),y4.write(X,BB(Z.devminor||0,6),337),Y)y4.write(X,Y,345);return y4.write(X,BB(aX$(X),6),148),X};qJ4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=zy(Z,0,100,X),J=OB(Z,100,8),W=OB(Z,108,8),K=OB(Z,116,8),H=OB(Z,124,12),F=OB(Z,136,12),N=PJ4(Y),U=Z[157]===0?null:zy(Z,157,100,X),O=zy(Z,265,32),B=zy(Z,297,32),L=OB(Z,329,8),w=OB(Z,337,8),E=aX$(Z);if(E===256)return null;if(E!==OB(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(EJ4(Z)){if(Z[345])G=zy(Z,345,155,X)+"/"+G}else if(jJ4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*F),type:N,linkname:U,uname:O,gname:B,devmajor:L,devminor:w,pax:null}};function EJ4($){return y4.equals(oX$,$.subarray(257,263))}function jJ4($){return y4.equals(LJ4,$.subarray(257,263))&&y4.equals(wJ4,$.subarray(263,265))}function zJ4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function PJ4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function AJ4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function rX$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function aX$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function BB($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function TJ4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function RJ4($,Z,X){if($.toString(8).length>11)TJ4($,Z,X);else y4.write(Z,BB($,11),X)}function IJ4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function OB($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return IJ4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=zJ4(rX$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(y4.toString($.subarray(Z,Q)),8)}}function zy($,Z,X,Q){return y4.toString($.subarray(Z,rX$($,0,Z,Z+X)),Q)}function zp0($){let Z=y4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var GQ$=_((NE9,YQ$)=>{var{Writable:_J4,Readable:vJ4,getStreamError:sX$}=jp0(),fJ4=Op0(),eX$=jy(),Py=Pp0(),bJ4=eX$.alloc(0);class $Q${constructor(){this.buffered=0,this.shifted=0,this.queue=new fJ4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return bJ4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return eX$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class ZQ$ extends vJ4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(sX$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=QQ$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class XQ$ extends _J4{constructor($){super($);if(!$)$={};this._buffer=new $Q$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Ap0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Py.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Py.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Py.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Py.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?Py.decodePax($):Object.assign({},this._paxGlobal,Py.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=QQ$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new ZQ$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=Ap0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(sX$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",K),this.on("error",(N)=>{$=N}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return F(null)},throw(N){return F(N)}};function J(N){if(!Y)return;let U=Y;Y=null,U(N)}function W(N,U){if($)return U($);if(Q){N({value:Q,done:!1}),Q=null;return}if(Z=N,X=U,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(N,U,O){if(Y=O,U.on("error",Ap0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function F(N){return G.destroy(N),J(N),new Promise((U,O)=>{if(G.destroyed)return U({value:void 0,done:!0});G.once("close",function(){if(N)O(N);else U({value:void 0,done:!0})})})}}}YQ$.exports=function(Z){return new XQ$(Z)};function Ap0(){}function QQ$($){return $&=511,$&&512-$}});var WQ$=_((UE9,Tp0)=>{var JQ$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Tp0.exports=z0("fs").constants||JQ$}catch{Tp0.exports=JQ$}});var BQ$=_((OE9,OQ$)=>{var{Readable:xJ4,Writable:yJ4,getStreamError:KQ$}=jp0(),mS=jy(),Ay=WQ$(),sO0=Pp0(),HQ$=mS.alloc(1024);class FQ$ extends yJ4{constructor($,Z,X){super({mapWritable:hJ4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?mS.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?mS.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);UQ$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return KQ$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class NQ$ extends xJ4{constructor($){super($);this._drain=Rp0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Rp0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=gJ4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=mS.from(Z);let Q=new FQ$(this,$,X);if(mS.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(HQ$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=sO0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=sO0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(sO0.encode(X)),this.push(Z),UQ$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(sO0.encode(X))}_doDrain(){let $=this._drain;this._drain=Rp0,$()}_predestroy(){let $=KQ$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}OQ$.exports=function(Z){return new NQ$(Z)};function gJ4($){switch($&Ay.S_IFMT){case Ay.S_IFBLK:return"block-device";case Ay.S_IFCHR:return"character-device";case Ay.S_IFDIR:return"directory";case Ay.S_IFIFO:return"fifo";case Ay.S_IFLNK:return"symlink"}return"file"}function Rp0(){}function UQ$($,Z){if(Z&=511,Z)$.push(HQ$.subarray(0,512-Z))}function hJ4($){return mS.isBuffer($)?$:mS.from($)}});var DQ$=_((uJ4)=>{uJ4.extract=GQ$();uJ4.pack=BQ$()});var EQ$=_((DE9,wQ$)=>{wQ$.exports=LQ$;function LQ$($,Z){if($&&Z)return LQ$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(W){G[W]=J[W]});return G}}});var qp0=_((LE9,Ip0)=>{var jQ$=EQ$();Ip0.exports=jQ$(eO0);Ip0.exports.strict=jQ$(zQ$);eO0.proto=eO0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return eO0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return zQ$(this)},configurable:!0})});function eO0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function zQ$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var TQ$=_((wE9,AQ$)=>{var dJ4=qp0(),mJ4=function(){},iJ4=global.Bare?queueMicrotask:process.nextTick.bind(process),pJ4=function($){return $.setHeader&&typeof $.abort==="function"},nJ4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},PQ$=function($,Z,X){if(typeof Z==="function")return PQ$($,null,Z);if(!Z)Z={};X=dJ4(X||mJ4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},F=function(){if(G=!1,!J)X.call($)},N=function(w){X.call($,w?Error("exited with error code: "+w):null)},U=function(w){X.call($,w)},O=function(){iJ4(B)},B=function(){if(W)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},L=function(){$.req.on("finish",H)};if(pJ4($))if($.on("complete",H),$.on("abort",O),$.req)L();else $.on("request",L);else if(J&&!Q)$.on("end",K),$.on("close",K);if(nJ4($))$.on("exit",N);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",O),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",O),$.removeListener("request",L),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",N),$.removeListener("end",F),$.removeListener("error",U),$.removeListener("close",O)}};AQ$.exports=PQ$});var qQ$=_((EE9,IQ$)=>{var tJ4=qp0(),oJ4=TQ$(),$B0;try{$B0=z0("fs")}catch($){}var ap=function(){},rJ4=typeof process>"u"?!1:/^v?\.0/.test(process.version),ZB0=function($){return typeof $==="function"},aJ4=function($){if(!rJ4)return!1;if(!$B0)return!1;return($ instanceof($B0.ReadStream||ap)||$ instanceof($B0.WriteStream||ap))&&ZB0($.close)},sJ4=function($){return $.setHeader&&ZB0($.abort)},eJ4=function($,Z,X,Q){Q=tJ4(Q);var Y=!1;$.on("close",function(){Y=!0}),oJ4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,aJ4($))return $.close(ap);if(sJ4($))return $.abort();if(ZB0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},RQ$=function($){$()},$34=function($,Z){return $.pipe(Z)},Z34=function(){var $=Array.prototype.slice.call(arguments),Z=ZB0($[$.length-1]||ap)&&$.pop()||ap;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,W=G>0;return eJ4(Y,J,W,function(K){if(!X)X=K;if(K)Q.forEach(RQ$);if(J)return;Q.forEach(RQ$),Z(X)})});return $.reduce($34)};IQ$.exports=Z34});var bQ$=_((G34)=>{var MQ$=DQ$(),kQ$=qQ$(),VQ$=z0("fs"),G9=z0("path"),sp=(global.Bare?global.Bare.platform:process.platform)==="win32";G34.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||VQ$,Y=X.ignore||X.filter||ep,G=X.mapStream||vQ$,J=Y34(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~SQ$(),H=X.pack||MQ$.pack(),F=X.finish||ep,N=X.map||ep,U=typeof X.dmode==="number"?X.dmode:0,O=typeof X.fmode==="number"?X.fmode:0;if(X.strip)N=fQ$(N,X.strip);if(X.readable)U|=parseInt(555,8),O|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),O|=parseInt(222,8);w();function B(E,j){Q.readlink(G9.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=Mp0(A),H.entry(j,w)})}function L(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return F(H)}if(z.isSocket())return w();let A={name:Mp0(j),mode:(z.mode|(z.isDirectory()?U:O))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=N(A)||A,H.entry(A,w);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=N(A)||A,B(j,A);if(A=N(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return w()}let P=H.entry(A,w),I=G(Q.createReadStream(G9.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);I.on("error",function(q){P.destroy(q)}),kQ$(I,P)}function w(E){if(E)return H.destroy(E);J(L)}return H};function X34($){return $.length?$[$.length-1]:null}function Q34(){return!global.Bare&&process.getuid?process.getuid():-1}function SQ$(){return!global.Bare&&process.umask?process.umask():0}G34.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=G9.resolve(Z);let Q=X.fs||VQ$,Y=X.ignore||X.filter||ep,G=X.mapStream||vQ$,J=X.chown!==!1&&!sp&&Q34()===0,W=X.extract||MQ$.extract(),K=[],H=new Date,F=typeof X.umask==="number"?~X.umask:~SQ$(),N=X.strict!==!1,U=X.validateSymlinks!==!1,O=X.map||ep,B=typeof X.dmode==="number"?X.dmode:0,L=typeof X.fmode==="number"?X.fmode:0;if(X.strip)O=fQ$(O,X.strip);if(X.readable)B|=parseInt(555,8),L|=parseInt(444,8);if(X.writable)B|=parseInt(333,8),L|=parseInt(222,8);if(W.on("entry",w),X.finish)W.on("finish",X.finish);return W;function w(P,I,q){P=O(P)||P,P.name=Mp0(P.name);let M=G9.join(Z,G9.join("/",P.name));if(Y(M,P))return I.resume(),q();let C=G9.join(M,".")===G9.join(Z,".")?Z:G9.dirname(M);_Q$(Q,C,G9.join(Z,"."),function(a,O0){if(a)return q(a);if(!O0)return q(Error(C+" is not a valid path"));if(P.type==="directory")return K.push([M,P.mtime]),A(M,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},l);A(C,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(L0){if(L0)return q(L0);switch(P.type){case"file":return u();case"link":return x();case"symlink":return f()}if(N)return q(Error("unsupported type for "+M+" ("+P.type+")"));I.resume(),q()})});function l(a){if(a)return q(a);j(M,P,function(O0){if(O0)return q(O0);if(sp)return q();z(M,P,q)})}function f(){if(sp)return q();Q.unlink(M,function(){let a=G9.resolve(G9.dirname(M),P.linkname);if(!n(a)&&U)return q(Error(M+" is not a valid symlink"));CQ$(Q,a,G9.join(Z,"."),function(O0,L0){if(O0)return q(O0);if(!L0&&U)return q(Error(M+" is not a valid symlink"));Q.symlink(P.linkname,M,l)})})}function x(){if(sp)return q();Q.unlink(M,function(){let a=G9.join(Z,G9.join("/",P.linkname));Q.realpath(a,function(O0,L0){if(O0||!n(L0))return q(Error(M+" is not a valid hardlink"));Q.link(L0,M,function(e){if(e&&e.code==="EPERM"&&X.hardlinkAsFilesFallback)return I=Q.createReadStream(L0),u();l(e)})})})}function n(a){return a===Z||a.startsWith(Z+G9.sep)}function u(){let a=Q.createWriteStream(M),O0=G(I,P);a.on("error",function(L0){O0.destroy(L0)}),kQ$(O0,a,function(L0){if(L0)return q(L0);a.on("close",l)})}}function E(P,I){let q;while((q=X34(K))&&P.slice(0,q[0].length)!==q[0])K.pop();if(!q)return I();Q.utimes(q[0],H,q[1],I)}function j(P,I,q){if(X.utimes===!1)return q();if(I.type==="directory")return Q.utimes(P,H,I.mtime,q);if(I.type==="symlink")return E(P,q);Q.utimes(P,H,I.mtime,function(M){if(M)return q(M);E(P,q)})}function z(P,I,q){let M=I.type==="symlink",C=M?Q.lchmod:Q.chmod,l=M?Q.lchown:Q.chown;if(!C)return q();let f=(I.mode|(I.type==="directory"?B:L))&F;if(l&&J)l.call(Q,P,I.uid,I.gid,x);else x(null);function x(n){if(n)return q(n);if(!C)return q();C.call(Q,P,f,q)}}function A(P,I,q){Q.stat(P,function(M){if(!M)return q(null);if(M.code!=="ENOENT")return q(M);Q.mkdir(P,{mode:I.mode,recursive:!0},function(C,l){if(C)return q(C);z(P,I,q)})})}};function CQ$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+G9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return CQ$($,G9.join(Z,".."),X,Q);Q(null,!1)})}function _Q$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return _Q$($,G9.join(Z,".."),X,Q);Q(null,!1)})}function ep(){}function vQ$($){return $}function Mp0($){return sp?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Y34($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),F=G9.join(X,H);Z.call($,F,function(N,U){if(N)return K(Y.indexOf(H)===-1&&N.code==="ENOENT"?null:N);if(!U.isDirectory())return K(null,H,U);$.readdir(F,function(O,B){if(O)return K(O);if(G)B.sort();for(let L=0;L<B.length;L++)if(!Q(G9.join(X,H,B[L])))J.push(G9.join(H,B[L]));K(null,H,U)})})}}function fQ$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||G9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var K34,H34;var xQ$=D(()=>{Np0();K34=V(TX$(),1),H34=V(bQ$(),1)});var XB0=()=>{};var yQ$=D(()=>{LO0()});var gQ$=D(()=>{dO0();lO0();XB0()});var hQ$=()=>{};var uQ$=()=>{};var kp0=D(()=>{YX$();Hp0();dO0();HX$();Wp0();Np0();FX$();NX$();UX$();OX$();Kp0();BX$();xQ$();XB0();yQ$();gQ$();hQ$();uQ$();XB0()});var S5,I9,iS,$n;var Zn=D(()=>{S5={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",TEMPLATE_PLURAL:"sandboxtemplates",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name",MAIN_CONTAINER_NAME:"sandbox"};I9=class I9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};iS=class iS extends I9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};$n=class $n extends I9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function F34($){let Z=$.getCurrentCluster();if(!Z)throw new I9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:Vp0(X.cert),key:Vp0(X.key),ca:Vp0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Vp0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function tY($,Z){let X=await F34($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function Sp0($){try{return await $.json()}catch{return null}}async function Xn($,Z){if($.ok)return;let X=await Sp0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new cQ$($.status,X,Q)}async function Ty($,Z,X,Q,Y="none"){try{let G=await tY($,Z);if(G.status===404)return null;if(await Xn(G,X),Y==="json")return await G.json();return null}catch(G){throw new I9(Q,G)}}async function lQ$($,Z,X){let Q=`${QB0}/${encodeURIComponent(Z)}/${S5.TEMPLATE_PLURAL}/${encodeURIComponent(X)}`;try{let Y=await tY($,{method:"GET",path:Q});if(Y.status===404||Y.status===403)return!1;return await Xn(Y,"sandboxTemplateExists"),!0}catch(Y){throw new I9(`Failed to get SandboxTemplate: ${X}`,Y)}}async function Qn($,Z,X){let Q=`${QB0}/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}`,Y;try{Y=await tY($,{method:"POST",path:Q,body:X})}catch(H){let F=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${F}`),new I9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${F})`,H)}if(Y.ok)return;let G=await Sp0(Y),J=G?.reason?` ${G.reason}`:"",W=G?.message??Y.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${W}`),Y.status===409)throw new $n(K);throw new I9(K)}async function YB0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let W=await v3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new iS(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await D$(500)}}function Cp0($,Z){return`${QB0}/${encodeURIComponent($)}/${S5.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function GB0($,Z,X,Q){await Ty($,{method:"PATCH",path:Cp0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function DB($,Z,X){await Ty($,{method:"DELETE",path:Cp0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function v3($,Z,X){return await Ty($,{method:"GET",path:Cp0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function dQ$($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let W=(await v3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await D$(200)}throw new iS(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function mQ$($,Z,X){let Y=(await Ty($,{method:"GET",path:`${QB0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await Xn(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function iQ$($,Z,X,Q){try{let Y=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}async function pQ$($,Z,X,Q,Y){try{let G=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(`${X}=${Q}`)}`});if(!G.ok)return null;let W=((await G.json()).items??[]).reduce((K,H)=>K===null||(H.metadata?.creationTimestamp??"")>(K.metadata?.creationTimestamp??"")?H:K,null);return W?N34(W,Y):null}catch{return null}}function N34($,Z){let X=($.status?.containerStatuses??[]).find((G)=>G.name===Z),Q=X?.state?.terminated??X?.lastState?.terminated;if(!Q?.reason)return null;let Y=($.spec?.containers??[]).find((G)=>G.name===Z)?.resources?.limits?.memory;return{reason:Q.reason,oomKilled:Q.reason==="OOMKilled",...Q.exitCode===void 0?{}:{exitCode:Q.exitCode},...Y===void 0?{}:{memoryLimit:Y}}}function _p0($,Z){return`${U34}/${encodeURIComponent($)}/${oQ$}/${encodeURIComponent(Z)}`}async function JB0($,Z,X){let Q=new URLSearchParams({fieldManager:aQ$,force:"true"}),Y=`${_p0(Z,X.metadata.name)}?${Q}`;try{let G=await tY($,{method:"PATCH",path:Y,patchType:"apply",body:X});await Xn(G,"applyHttpRoute")}catch(G){throw new I9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function WB0($,Z,X){await Ty($,{method:"DELETE",path:_p0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function rQ$($,Z,X){return await Ty($,{method:"GET",path:_p0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function sQ$($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:aQ$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let W=await tY($,{method:"PATCH",path:J,patchType:"apply",body:Y});await Xn(W,"ensureServicePort")}catch(W){throw new I9(`Failed to apply Service ports: ${X}`,W)}}function KB0($,Z,X,Q=180){let Y=`/apis/${S5.SANDBOX_API_GROUP}/${S5.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,F=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new iS(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),N=(U)=>{if(H)return;H=!0,clearTimeout(F),K.abort(),U()};return(async()=>{let U;try{U=await tY($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(O){N(()=>J(new I9("Failed to start watch for sandbox readiness",O)));return}if(!U.ok||!U.body){let O=await Sp0(U).catch(()=>null);N(()=>J(new I9(`Watch handshake failed (${U.status}): ${O?.message??U.statusText}`)));return}try{for await(let O of vp0(U.body)){if(H)return;if(O.type==="ERROR"){let j=O.object;N(()=>J(new I9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(O.type!=="ADDED"&&O.type!=="MODIFIED")continue;let B=O.object;if(!B.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let w=B.metadata?.name;if(!w){N(()=>J(new I9("Sandbox metadata or name is missing")));return}let E=B.metadata?.annotations?.[S5.POD_NAME_ANNOTATION]??w;N(()=>G({sandboxName:w,podName:E}));return}N(()=>J(new I9("Watch stream closed before sandbox became ready")))}catch(O){if(H)return;if(O instanceof Error&&(O.name==="AbortError"||K.signal.aborted))return;N(()=>J(new I9("Watch stream error while waiting for sandbox",O)))}})(),W}async function*vp0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var cQ$,QB0,nQ$="gateway.networking.k8s.io",tQ$="v1",oQ$="httproutes",U34,Yn,aQ$="mesh-sandbox-runner";var Gn=D(()=>{w4();Zn();cQ$=class cQ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};QB0=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces`;U34=`/apis/${nQ$}/${tQ$}/namespaces`;Yn={API_GROUP:nQ$,API_VERSION:tQ$,PLURAL:oQ$}});function B34($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function $Y$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return eQ$;let W=await J.json();return!B34(W)}catch{return eQ$}};return async()=>{if(Date.now()-X<O34)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var O34=3000,eQ$=!0;var ZY$=D(()=>{Gn()});var HB0=D(()=>{w4();Im0()});async function NB0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(D34)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function bp0($){for(let Z=0;Z<XY$;Z++){if(await NB0($)!==null)return;let X=(Math.random()*2-1)*L34;await D$(QY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${XY$*QY$/1000}s`)}async function pS($,Z,X,Q,Y){return w34($,Z,"POST",X,Q,Y)}async function w34($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??fp0)}),K=await W.text();if(!W.ok)throw new FB0(W.status,K);return JSON.parse(K)}async function YY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(fp0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function GY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(fp0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Jn($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of E34)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var FB0,D34=500,fp0=30000,XY$=25,QY$=200,L34=50,E34;var JY$=D(()=>{HB0();FB0=class FB0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};E34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*HY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??z34,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},N=new AbortController,U=()=>{N.abort(),F()};if($.signal)if($.signal.aborted)N.abort(),F();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>K("tick"),O+100),L,w=new Promise((j)=>{L=j}),E=Promise.allSettled([P34($.kc,$.namespace,$.claimName,N.signal,Y,K,Z,L),T34($.kc,$.namespace,$.claimName,N.signal,Y,K),R34($.kc,$.namespace,$.claimName,w,N.signal,Y,K,Z)]);try{let j=null,z=-1,A=WY$(Y,Q,Z);if(j=yp0(A),!xp0(A))z=KY$(A);if(yield A,xp0(A))return;while(!W){if(await H()===null)break;let I=WY$(Y,Q,Z);if(xp0(I)){let C=yp0(I);if(C!==j)j=C,yield I;return}let q=KY$(I);if(q<z)continue;let M=yp0(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(B),N.abort(),$.signal)$.signal.removeEventListener("abort",U);F(),await E.catch(()=>{})}}function WY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function xp0($){return $.kind==="ready"||$.kind==="failed"}function KY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function yp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function P34($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${j34}=${X}`)}`;return UB0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);A34(F,Y,J),G("pod")}})}function A34($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===S5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function T34($,Z,X,Q,Y,G){let J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return UB0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function R34($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return UB0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let N=F.object,U=N.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=N.message;break;case"Nominated":{let O=N.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function FY$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${S5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return UB0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function UB0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await tY(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of vp0(K.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=oZ(5000,250,J,2,0);J+=1,await D$(W,{signal:Q}).catch(()=>{})}}var j34="studio.decocms.com/sandbox-handle",z34=300000;var NY$=D(()=>{w4();Zn();Gn()});import{z as aG}from"zod";function UY$($){if(!$||$.trim()==="")return[];let Z=aG.array(I34).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function q34($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function OY$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=q34(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function BY$($,Z,X){return $?.name??(Z?X:"none")}function M34($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function DY$($){let Z=M34($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function LY$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function wY$($){return`https://github.com/${$.repo}.git`}var I34;var gp0=D(()=>{I34=aG.object({name:aG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:aG.string().min(1),repo:aG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:aG.string().min(1).optional(),branch:aG.string().min(1).default("main"),workload:aG.object({runtime:aG.enum(["node","bun","deno"]).default("node"),packageManager:aG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:aG.string().optional(),devPort:aG.number().int().positive().optional()}).default({runtime:"node"})})});async function EY$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as k34,randomBytes as V34,randomUUID as S34}from"crypto";import*as IY$ from"net";import{PassThrough as C34}from"stream";function jY$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class ip0{kind=tQ;records=new Map;inflight=new SZ0;activeGauge=new VZ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??i34(),this.portForward=new Up0(this.kubeConfig),this.namespace=$.namespace??_34,this.sandboxTemplateName=$.sandboxTemplateName??v34,this.envName=a34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>V34(b34).toString("hex")),this.idleTtlMs=$.idleTtlMs??y34,this.metrics=$.meter?m34($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${W6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??h34,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${sX.env}=${this.envName}`]:[]].join(",");FY$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=DE($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>CZ0(this.stateStore,$,tQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${W6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await DB(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,tQ);else await this.stateStore.deleteByHandle(tQ,$)}lastTermination($){return pQ$(this.kubeConfig,this.namespace,sX.sandboxHandle,$,S5.MAIN_CONTAINER_NAME)}async alive($){return await v3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return HY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=$Y$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(tQ,$),H=K?.state,F=H?.token;if(K&&F){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bF}`;try{let O=await Jn(U,F,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Jn(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await K.body?.cancel()}catch{}Y=H,K=await Jn(H.daemonUrl,H.token,Z,X)}}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let F=await Jn(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return CZ0(this.stateStore,$,tQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bF}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(tQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=up0(404,{error:"sandbox not found"});return B.headers.set(tS,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,up0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of l34)H.delete(B);let F=Z.method!=="GET"&&Z.method!=="HEAD",N={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},U;try{U=await fetch(K(G),N)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${W6}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),N);let z=new Headers;for(let[A,P]of U.headers.entries())if(!AY$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${W6}] preview fetch retry to ${L} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=up0(502,{error:"sandbox daemon unreachable"});return w.headers.set(tS,"1"),w}let O=new Headers;for(let[B,L]of U.headers.entries())if(!AY$.includes(B.toLowerCase()))O.set(B,L);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${W6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,tQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),await this.relayOrgFsConfig(W.daemonUrl,W.token,X.orgFsConfigJson),this.finish(W,Q,!1,!0,"resume");await Q.delete($,tQ)}}let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await YB0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${W6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${W6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),await YB0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${W6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await GB0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${W6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=lp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(x34.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${W6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bF)}}async resolveTemplateName($){let{name:Z,probe:X}=await DY$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:f34,exists:(Q)=>lQ$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${W6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=OY$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=$W4(Z),K=Object.keys(W).length>0;return{apiVersion:`${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{},...cp0(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:cp0(Z.tenant,{[sX.role]:"claimed",[sX.sandboxHandle]:$,...this.envName?{[sX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:J,warmpool:BY$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=S34(),G=hp0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Qn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof $n)await YB0(this.kubeConfig,this.namespace,Z),await Qn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await dQ$(this.kubeConfig,this.namespace,Z),await KB0(this.kubeConfig,this.namespace,W)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,bF,Z),H=`http://127.0.0.1:${K.localPort}`,F=this.workloadConfigPayload(X),N=Y;try{if(await bp0(H),this.sentinelToken!==null){let U=await NB0(H);if(U)N=U.bootId;await pS(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await pS(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:N,tenant:X.tenant??null,ensureOpts:GW4(X)}}workloadConfigPayload($){return vZ0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??zY$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await GY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=qm0(Z);if(!X)return;try{await pS($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${W6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${W6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await YW4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await D$(u34,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${W6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${W6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await D$(g34,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=LY$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await mQ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${W6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[sX.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=OB0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=OB0){if(Date.now()-Q.lastFailureAt<PY$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:wY$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,bF,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await bp0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=vZ0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??zY$})??{},{transition:N}=await pS(K,H,F);if(Y&&N!=="bootstrap"&&await this.isPoolPodUnbound(Z))await YY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${W6}] tenant pool ${$.name}: warmed ${Z.name} (${N})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return iQ$(this.kubeConfig,this.namespace,$.name,sX.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=OB0?` \u2014 backing off ${PY$/60000}min`:"";console.warn(`[${W6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${OB0})${G}: ${X}`)}async refreshAllGitCredentials(){await EY$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,c34);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await pS($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof FB0&&Y.status===401)try{return await pS($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${W6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${W6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await sQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bF,targetPort:bF})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=JW4(this.previewUrlPattern,$);if(!Q)throw new I9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Yn.API_GROUP}/${Yn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:cp0(X??void 0,{[sX.role]:"claimed",[sX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bF}]}]}};await JB0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await WB0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!TY$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${W6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,tQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${W6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??hp0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!TY$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=p34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=ZW4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${W6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${W6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:hp0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,bF,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await NB0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(tQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(tQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(DE(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,lp0($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...lp0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _Z0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,tQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await v3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=XW4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await GB0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${W6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await v3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=QW4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await GB0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${W6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=n34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=IY$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<d34){try{H.close()}catch{}let N=dp0+(W-dp0+1)%qY$;J(N,K+1);return}G(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new C34,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(F)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} dropped mid-connection: ${jY$(F)}`,JSON.stringify(mp0(F))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} failed: ${jY$(K)}`,JSON.stringify(mp0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${W6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function m34($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function mp0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?mp0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function i34(){let $=new Ey;return $.loadFromDefault(),$}function TY$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function p34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function n34($,Z){let X=k34("sha256").update(`${$}:${Z}`).digest();return dp0+X.readUInt32BE(0)%qY$}function up0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function RY$($){let Z=$.slice(0,o34);return t34.test(Z)?Z:""}function a34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!r34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function cp0($,Z={}){let X={...Z};if($){let Q=RY$($.orgId),Y=RY$($.userId);if(Q)X[sX.orgId]=Q;if(Y)X[sX.userId]=Y}return X}function nS($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,s34)}function e34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function $W4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[f3.orgSlug]=nS(X.orgSlug);if(X?.orgName)Z[f3.orgName]=nS(X.orgName);if(X?.userEmail)Z[f3.userEmail]=nS(X.userEmail);if(X?.userName)Z[f3.userName]=nS(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[f3.gitRepo]=nS(Q.displayName);let Y=e34(Q.cloneUrl);if(Y)Z[f3.gitRepoUrl]=nS(Y);let G=$.branch??Q.branch;if(G)Z[f3.gitBranch]=nS(G)}return Z}function ZW4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[sX.orgId],Q=Z[sX.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[f3.orgSlug],orgName:Y[f3.orgName],userEmail:Y[f3.userEmail],userName:Y[f3.userName]}}function XW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function QW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function lp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:tQ}}async function YW4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${W6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function GW4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function JW4($,Z){try{return new URL(_Z0($,Z)).hostname||null}catch{return null}}var tQ="agent-sandbox",W6="AgentSandboxProvider",tS="x-sandbox-preview-not-ready",_34="agent-sandbox-system",v34="studio-sandbox",f34=300000,bF=9000,zY$=3000,hp0="/app",b34=32,x34,y34=900000,g34=60000,h34=1800000,OB0=3,PY$=1800000,u34=900000,c34=1800000,l34,AY$,dp0=40000,qY$=1e4,d34=256,sX,f3,t34,o34=63,r34,s34=253;var MY$=D(()=>{w4();ZY$();kp0();JY$();Mm0();Gn();Zn();NY$();gp0();x34=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),l34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],AY$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];sX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},f3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},t34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;r34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var kY$={};J4(kY$,{waitForSandboxReady:()=>KB0,parseTenantPools:()=>UY$,getSandboxClaim:()=>v3,getHttpRoute:()=>rQ$,deleteSandboxClaim:()=>DB,deleteHttpRoute:()=>WB0,createSandboxClaim:()=>Qn,applyHttpRoute:()=>JB0,SandboxTimeoutError:()=>iS,SandboxError:()=>I9,PREVIEW_NOT_READY_HEADER:()=>tS,KubeConfig:()=>Ey,K8S_CONSTANTS:()=>S5,HTTPROUTE_CONSTANTS:()=>Yn,AgentSandboxProvider:()=>ip0});var pp0=D(()=>{kp0();Zn();Gn();MY$();gp0()});var fY$={};J4(fY$,{subscribeLifecycle:()=>rp0,getSandboxProviderByKind:()=>tp0,getOrInitSharedRunner:()=>op0,__resetSharedLifecyclesForTesting:()=>EW4});function _Y$($,Z){let X=VY$[$];if(X)return Promise.resolve(X);let Q=np0[$];if(Q)return Q;let Y=Z().then((G)=>{return VY$[$]=G,G}).finally(()=>{delete np0[$]});return np0[$]=Y,Y}function HW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function FW4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function NW4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function UW4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function OW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function vY$($,Z){let X=new Sp(Z),Q=HW4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (pp0(),kY$)),J=new MY(b0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:FW4(),envName:NW4(),previewGateway:OW4(),sentinelToken:UW4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:L$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=B6$(W.cloneUrl);if(!H)return null;let{cloneUrl:F}=await QB(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return F},mintOrgFsConfig:async(W)=>{if(!W.orgSlug)return null;return await cZ0({boundAuth:{apiKey:{create:(H)=>F8.api.createApiKey({body:{...H,userId:W.userId}})}},storage:{orgRepoSyncs:new EE(Z)}},{orgSlug:W.orgSlug,orgId:W.orgId,baseUrl:b9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function tp0($,Z){return _Y$(Z,()=>vY$(Z,$.db))}async function op0(){let $;try{$=LE()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await _Y$($,()=>vY$($,l8().db))}function rp0($,Z,X){let Q=LB.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:LW4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return SY$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return LB.set(Z,G),wW4($,Z,G),SY$(Z,G,X)}function LW4(){}function SY$($,Z,X){return{unsubscribe(){if(LB.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)LB.delete($),Z.abort.abort()}}}async function wW4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(LB.get(Z)===X)LB.delete(Z)}}function EW4(){for(let $ of LB.values())$.abort.abort();LB.clear()}var WW4,KW4,CY$,VY$,np0,BW4,DW4,LB;var Wn=D(()=>{kF();gG();I6();Sm0();Jy();yL();q$();Wy();gY();L9();WW4=Symbol.for("decocms.sandbox.lifecycle.runners"),KW4=Symbol.for("decocms.sandbox.lifecycle.inflight"),CY$=globalThis,VY$=CY$[WW4]??={},np0=CY$[KW4]??={};BW4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),DW4=globalThis,LB=DW4[BW4]??=new Map});async function gZ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Kn($,G);if($.sandboxPreference==="agent-sandbox")return Kn($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Kn($,LE());let[J,...W]=jW4(Y,X,Q);if(J)return Kn($,W.length===0?J:zW4(J,W));return Kn($,bY$())}function jW4($,Z,X){let Q=c5($)[Z]?.[X];if(!Q)return[];let Y=Z3(Q);return Object.keys(Y)}function zW4($,Z){let X=bY$();if(X===$||Z.includes(X))return X;return $}function bY$(){return LE()}async function Kn($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await tp0($,X),kind:X}}var xF=D(()=>{P8();kF();lQ();Wn()});var Hn;var ap0=D(()=>{Hn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function yF($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gF($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function b3($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function oS($,Z,X){return ep0(await sp0($,Z),X)}async function sp0($,Z){let X=b3(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function ep0($,Z){return $?.created_by??Z}async function rS($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function xY$($,Z){let Q=(await rS($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function yY$($,Z,X){let Q=await rS($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function PW4($,Z){let X=l90(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=q5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function wB($,Z){let X=await rS($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=PW4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function $n0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===yF($.threadId))return $.runBranch;if($.threadRepo)return yF($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function Zn0($,Z){let Q=(await rS($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function BB0($,Z){let[X,Q]=await Promise.all([wB($,Z.threadId),Zn0($,Z.threadId)]);return $n0({...Z,threadRepo:X,pinnedRef:Q})}async function gY$($,Z,X,Q,Y,G){let J=await rS($,Z);if(!J)return;let W=Vp(c5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function DB0($,Z){return c5(await rS($,Z))}async function hY$($,Z,X,Q,Y){let G=await rS($,Z);if(!G)return;let J=Vm0(c5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var x3=D(()=>{VQ();lQ()});function Ry($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!X80.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function uY$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function cY$($,Z){r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=c5(G),W=await oS(Z,$.branch,Q),K=EK(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function AW4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function lY$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=AW4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Hn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Hn[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Fn=D(()=>{P8();ap0();lQ();x3()});import{sql as TW4}from"kysely";function dY$($){return $ instanceof Date?$.toISOString():String($)}class Xn0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:dY$($.created_at),updatedBy:$.updated_by,updatedAt:dY$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new EB($.id)}async create($){let Z=t8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(LB0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(LB0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(LB0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(LB0).executeTakeFirst();if(!Q)throw new sG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(TW4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new sG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var LB0,sG,EB;var Nn=D(()=>{gX();LB0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sG=class sG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};EB=class EB extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function jB($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new mY$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var mY$;var Un=D(()=>{mY$=class mY$ extends Error{}});async function wB0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof sG||H instanceof EB){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await jB(W,RW4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var RW4=10485760;var Qn0=D(()=>{Nn();Un()});async function iY$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof sG||J instanceof EB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var pY$=D(()=>{Nn()});async function oY$($,Z,X,Q,Y){let G=await mY({connectionId:$,tokenStorage:new l6(Q,Y)});if(!G.accessToken)return null;return aY$(Z,X,G.accessToken)}function rY$($,Z){return aY$($,Z,null)}async function aY$($,Z,X){let Q=new Map,Y=new Set(nY$.map((K)=>K.path));for(let K of Object.values(tY$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await qW4($,Z,K,X))}));let G=nY$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=tY$[G.pm]??[],W=null;for(let K of J)if(W=MW4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function qW4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function MW4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(IW4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var nY$,tY$,IW4;var sY$=D(()=>{oG();dG();nY$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],tY$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},IW4=/(?:--port|PORT=|:)(\d{4,5})/});function kW4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function EB0($){return $?.name||$?.email?.split("@")[0]||void 0}function jB0($){let Z=kW4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function On($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function eY$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function zB0($){return eY$($?.previewServerUrl)??eY$($?.productionUrl)}function aS($){return $==="cms"||$==="sandbox"?$:null}function VW4($){return!!zB0($)&&$?.fastPreview===!0}function PB0($){return VW4($)?"cms":"sandbox"}var Yn0;var Iy=D(()=>{Yn0=["cms","sandbox"]});function $G$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(SW4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function AB0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var SW4;var TB0=D(()=>{SW4=new Set(["main","master","trunk","develop","HEAD"])});async function ZG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=CW4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var CW4;var XG$=D(()=>{CW4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as y3}from"zod";async function qy($,Z){r(Z);let X=t(Z),Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await oS(Z,$.branch,Q),W=EK(c5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await gZ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(await H.alive(W.sandboxHandle).catch(()=>!0))return W;await ZB(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let F=b3($.branch)??Z.metadata?.threadId;if(F)On(Z,F,"sandbox");let U=await wB(Z,F)??G.githubRepo??null,{entry:O}=await YG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:K,runner:H,...$.purpose?{purpose:$.purpose}:{}});return O}async function YG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,purpose:F}=$,N=F==="harness-run",U=$.githubRepo?await vW4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:B,port:L,packageManagerPath:w}=lY$(W),E;if(U){if(U.connectionId)await XB({ctx:Z,connectionId:U.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(x0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:U.connectionId,error:x0.message})}});let{cloneUrl:L0,gitUserName:e,gitUserEmail:o}=U.connectionId?await QB(U.connectionId,U.owner,U.name,Z.db,Z.vault):O6$(U.owner,U.name);if(!B){let x0=U.connectionId?await oY$(U.connectionId,U.owner,U.name,Z.db,Z.vault):await rY$(U.owner,U.name);if(x0)B=x0.packageManager,O=Hn[x0.packageManager].runtime,L=x0.devPort??L,await fW4(Z,G,X,x0.packageManager,x0.devPort)}let j0=b0().sandboxStickyHeadRefEnabled,X0=AB0({branch:J,derivedRef:gF(J),recordedHeadRef:j0?await xY$(Z,b3(J)):null,sticky:j0}),P0=await iY$({ctx:Z,orgId:Y,userId:X,entries:uY$(W)});E={cloneUrl:L0,...U.connectionId?{connectionId:U.connectionId}:{},userName:e,userEmail:o,branch:X0,displayName:`${U.owner}/${U.name}`,submoduleCredentials:P0}}let j=O&&B&&!N?{runtime:O,packageManager:B,...L!==null?{devPort:Number(L)}:{},...w?{packageManagerPath:w}:{}}:void 0,z=Mp({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await ZG$(Z.objectStorage,{isProduction:b0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!b0().orgFsMountsDisabled,I;if(P){let L0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(L0)I=await cZ0(Z,{orgSlug:L0,orgId:Y,baseUrl:b9()})}await xW4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:N,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Ry(W);await wB0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let l=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),f=W.runtime?.selected??null,x=W.runtime?.port??null,n=W.runtime?.path??null,u={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:f,port:x,path:n}};await X6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,u);let a=b3(J)??Z.metadata?.threadId;if(a)await gY$(Z,a,Q,J,$.providerKind,u);let O0=!K||K.sandboxHandle!==q.handle;return{entry:u,isNewVm:O0}}async function vW4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=l90(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},N=F.githubRepo;if(N?.connectionId===G.connectionId){let U=q5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...N,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function fW4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function xW4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+QG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(QG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await D$(bW4)}}var _W4,Gn0,QG$=150000,bW4=5000;var Bn=D(()=>{kF();w4();S0();Fn();Qn0();pY$();lQ();VQ();Jy();sY$();ap0();xF();Iy();x3();TB0();XG$();q$();L9();Wy();lQ();_W4=y3.enum(["agent-sandbox","user-desktop","cluster"]),Gn0=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:y3.object({virtualMcpId:y3.string().describe("Virtual MCP ID"),branch:y3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:_W4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:y3.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:y3.object({previewUrl:y3.string().nullable(),sandboxHandle:y3.string(),branch:y3.string(),isNewVm:y3.boolean(),sandboxProviderKind:y3.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=$.branch??jB0(EB0(Z.auth.user)),Y=b3(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(aS(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=Y1(Z);if(!G)throw Error("User ID required");let J=await oS(Z,Q,G),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==X.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=$.sandboxProviderKind?BE($.sandboxProviderKind):void 0,{provider:F,kind:N}=await gZ(Z,{userId:J,branch:Q,virtualMcpMetadata:K,explicitKind:H}),U=EK(c5(K),J,Q,N),B=await wB(Z,b3(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:L,isNewVm:w}=await YG$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:B,existing:U,providerKind:N,runner:F});if(Y)On(Z,Y,"sandbox");return{...L,branch:Q,isNewVm:w,sandboxProviderKind:N}}})});function yW4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new JG$(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function RB0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let W=yW4({publicUrl:b9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:GG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+GG$*1000}}function WG$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let W=gW4(J.slug??J.title??"")||"mcp",K=W;for(let H=2;G.has(K);H++)K=`${W}-${H}`;return G.add(K),{name:K,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function gW4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function KG$($){return{self:[...$.toolNames],...$.grants}}var GG$=3600,JG$;var Jn0=D(()=>{L9();JG$=class JG$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function hW4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await RB0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function My($,Z){let{provider:X,kind:Q}=await gZ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=qy({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>hW4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return km0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await ZB($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function HG$($,Z){try{let X=await My($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var IB0=D(()=>{kF();Jn0();xF();Bn();lQ()});import{z as FG$}from"zod";function ky($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=q5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function cW4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ky(X)}function lW4($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var cQ$,QB0,nQ$="gateway.networking.k8s.io",tQ$="v1",oQ$="httproutes",U34,Yn,aQ$="mesh-sandbox-runner";var Gn=D(()=>{w4();Zn();cQ$=class cQ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};QB0=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces`;U34=`/apis/${nQ$}/${tQ$}/namespaces`;Yn={API_GROUP:nQ$,API_VERSION:tQ$,PLURAL:oQ$}});function B34($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function $Y$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return eQ$;let W=await J.json();return!B34(W)}catch{return eQ$}};return async()=>{if(Date.now()-X<O34)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var O34=3000,eQ$=!0;var ZY$=D(()=>{Gn()});var HB0=D(()=>{w4();Im0()});async function NB0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(D34)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function bp0($){for(let Z=0;Z<XY$;Z++){if(await NB0($)!==null)return;let X=(Math.random()*2-1)*L34;await D$(QY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${XY$*QY$/1000}s`)}async function pS($,Z,X,Q,Y){return w34($,Z,"POST",X,Q,Y)}async function w34($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??fp0)}),K=await W.text();if(!W.ok)throw new FB0(W.status,K);return JSON.parse(K)}async function YY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(fp0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function GY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(fp0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Jn($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of E34)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var FB0,D34=500,fp0=30000,XY$=25,QY$=200,L34=50,E34;var JY$=D(()=>{HB0();FB0=class FB0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};E34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*HY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??z34,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},N=new AbortController,U=()=>{N.abort(),F()};if($.signal)if($.signal.aborted)N.abort(),F();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>K("tick"),O+100),L,w=new Promise((j)=>{L=j}),E=Promise.allSettled([P34($.kc,$.namespace,$.claimName,N.signal,Y,K,Z,L),T34($.kc,$.namespace,$.claimName,N.signal,Y,K),R34($.kc,$.namespace,$.claimName,w,N.signal,Y,K,Z)]);try{let j=null,z=-1,A=WY$(Y,Q,Z);if(j=yp0(A),!xp0(A))z=KY$(A);if(yield A,xp0(A))return;while(!W){if(await H()===null)break;let I=WY$(Y,Q,Z);if(xp0(I)){let C=yp0(I);if(C!==j)j=C,yield I;return}let q=KY$(I);if(q<z)continue;let M=yp0(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(B),N.abort(),$.signal)$.signal.removeEventListener("abort",U);F(),await E.catch(()=>{})}}function WY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function xp0($){return $.kind==="ready"||$.kind==="failed"}function KY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function yp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function P34($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${j34}=${X}`)}`;return UB0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);A34(F,Y,J),G("pod")}})}function A34($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===S5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function T34($,Z,X,Q,Y,G){let J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return UB0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function R34($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return UB0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let N=F.object,U=N.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=N.message;break;case"Nominated":{let O=N.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function FY$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${S5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return UB0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function UB0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await tY(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of vp0(K.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=oZ(5000,250,J,2,0);J+=1,await D$(W,{signal:Q}).catch(()=>{})}}var j34="studio.decocms.com/sandbox-handle",z34=300000;var NY$=D(()=>{w4();Zn();Gn()});import{z as aG}from"zod";function UY$($){if(!$||$.trim()==="")return[];let Z=aG.array(I34).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function q34($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function OY$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=q34(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function BY$($,Z,X){return $?.name??(Z?X:"none")}function M34($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function DY$($){let Z=M34($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function LY$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function wY$($){return`https://github.com/${$.repo}.git`}var I34;var gp0=D(()=>{I34=aG.object({name:aG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:aG.string().min(1),repo:aG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:aG.string().min(1).optional(),branch:aG.string().min(1).default("main"),workload:aG.object({runtime:aG.enum(["node","bun","deno"]).default("node"),packageManager:aG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:aG.string().optional(),devPort:aG.number().int().positive().optional()}).default({runtime:"node"})})});async function EY$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as k34,randomBytes as V34,randomUUID as S34}from"crypto";import*as IY$ from"net";import{PassThrough as C34}from"stream";function jY$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class ip0{kind=tQ;records=new Map;inflight=new SZ0;activeGauge=new VZ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??i34(),this.portForward=new Up0(this.kubeConfig),this.namespace=$.namespace??_34,this.sandboxTemplateName=$.sandboxTemplateName??v34,this.envName=a34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>V34(b34).toString("hex")),this.idleTtlMs=$.idleTtlMs??y34,this.metrics=$.meter?m34($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${W6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??h34,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${sX.env}=${this.envName}`]:[]].join(",");FY$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=DE($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>CZ0(this.stateStore,$,tQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${W6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await DB(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,tQ);else await this.stateStore.deleteByHandle(tQ,$)}lastTermination($){return pQ$(this.kubeConfig,this.namespace,sX.sandboxHandle,$,S5.MAIN_CONTAINER_NAME)}async alive($){return await v3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return HY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=$Y$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(tQ,$),H=K?.state,F=H?.token;if(K&&F){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bF}`;try{let O=await Jn(U,F,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Jn(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await K.body?.cancel()}catch{}Y=H,K=await Jn(H.daemonUrl,H.token,Z,X)}}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let F=await Jn(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return CZ0(this.stateStore,$,tQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bF}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(tQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=up0(404,{error:"sandbox not found"});return B.headers.set(tS,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,up0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of l34)H.delete(B);let F=Z.method!=="GET"&&Z.method!=="HEAD",N={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},U;try{U=await fetch(K(G),N)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${W6}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),N);let z=new Headers;for(let[A,P]of U.headers.entries())if(!AY$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${W6}] preview fetch retry to ${L} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=up0(502,{error:"sandbox daemon unreachable"});return w.headers.set(tS,"1"),w}let O=new Headers;for(let[B,L]of U.headers.entries())if(!AY$.includes(B.toLowerCase()))O.set(B,L);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${W6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,tQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),await this.relayOrgFsConfig(W.daemonUrl,W.token,X.orgFsConfigJson),this.finish(W,Q,!1,!0,"resume");await Q.delete($,tQ)}}let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await YB0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${W6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${W6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),await YB0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${W6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await GB0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${W6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=lp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(x34.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${W6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bF)}}async resolveTemplateName($){let{name:Z,probe:X}=await DY$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:f34,exists:(Q)=>lQ$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${W6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=OY$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=$W4(Z),K=Object.keys(W).length>0;return{apiVersion:`${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{},...cp0(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:cp0(Z.tenant,{[sX.role]:"claimed",[sX.sandboxHandle]:$,...this.envName?{[sX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:J,warmpool:BY$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=S34(),G=hp0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Qn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof $n)await YB0(this.kubeConfig,this.namespace,Z),await Qn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await dQ$(this.kubeConfig,this.namespace,Z),await KB0(this.kubeConfig,this.namespace,W)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,bF,Z),H=`http://127.0.0.1:${K.localPort}`,F=this.workloadConfigPayload(X),N=Y;try{if(await bp0(H),this.sentinelToken!==null){let U=await NB0(H);if(U)N=U.bootId;await pS(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await pS(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:N,tenant:X.tenant??null,ensureOpts:GW4(X)}}workloadConfigPayload($){return vZ0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??zY$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await GY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=qm0(Z);if(!X)return;try{await pS($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${W6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${W6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await YW4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await D$(u34,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${W6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${W6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await D$(g34,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=LY$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await mQ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${W6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[sX.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=OB0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=OB0){if(Date.now()-Q.lastFailureAt<PY$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:wY$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,bF,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await bp0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=vZ0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??zY$})??{},{transition:N}=await pS(K,H,F);if(Y&&N!=="bootstrap"&&await this.isPoolPodUnbound(Z))await YY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${W6}] tenant pool ${$.name}: warmed ${Z.name} (${N})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return iQ$(this.kubeConfig,this.namespace,$.name,sX.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=OB0?` \u2014 backing off ${PY$/60000}min`:"";console.warn(`[${W6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${OB0})${G}: ${X}`)}async refreshAllGitCredentials(){await EY$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,c34);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await pS($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof FB0&&Y.status===401)try{return await pS($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${W6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${W6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await sQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bF,targetPort:bF})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=JW4(this.previewUrlPattern,$);if(!Q)throw new I9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Yn.API_GROUP}/${Yn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:cp0(X??void 0,{[sX.role]:"claimed",[sX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bF}]}]}};await JB0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await WB0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!TY$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${W6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,tQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${W6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??hp0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!TY$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=p34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=ZW4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${W6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${W6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:hp0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,bF,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await NB0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(tQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(tQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(DE(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,lp0($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...lp0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _Z0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,tQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await v3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=XW4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await GB0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${W6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await v3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=QW4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await GB0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${W6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=n34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=IY$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<d34){try{H.close()}catch{}let N=dp0+(W-dp0+1)%qY$;J(N,K+1);return}G(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new C34,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(F)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} dropped mid-connection: ${jY$(F)}`,JSON.stringify(mp0(F))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} failed: ${jY$(K)}`,JSON.stringify(mp0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${W6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function m34($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function mp0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?mp0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function i34(){let $=new Ey;return $.loadFromDefault(),$}function TY$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function p34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function n34($,Z){let X=k34("sha256").update(`${$}:${Z}`).digest();return dp0+X.readUInt32BE(0)%qY$}function up0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function RY$($){let Z=$.slice(0,o34);return t34.test(Z)?Z:""}function a34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!r34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function cp0($,Z={}){let X={...Z};if($){let Q=RY$($.orgId),Y=RY$($.userId);if(Q)X[sX.orgId]=Q;if(Y)X[sX.userId]=Y}return X}function nS($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,s34)}function e34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function $W4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[f3.orgSlug]=nS(X.orgSlug);if(X?.orgName)Z[f3.orgName]=nS(X.orgName);if(X?.userEmail)Z[f3.userEmail]=nS(X.userEmail);if(X?.userName)Z[f3.userName]=nS(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[f3.gitRepo]=nS(Q.displayName);let Y=e34(Q.cloneUrl);if(Y)Z[f3.gitRepoUrl]=nS(Y);let G=$.branch??Q.branch;if(G)Z[f3.gitBranch]=nS(G)}return Z}function ZW4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[sX.orgId],Q=Z[sX.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[f3.orgSlug],orgName:Y[f3.orgName],userEmail:Y[f3.userEmail],userName:Y[f3.userName]}}function XW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function QW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function lp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:tQ}}async function YW4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${W6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function GW4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function JW4($,Z){try{return new URL(_Z0($,Z)).hostname||null}catch{return null}}var tQ="agent-sandbox",W6="AgentSandboxProvider",tS="x-sandbox-preview-not-ready",_34="agent-sandbox-system",v34="studio-sandbox",f34=300000,bF=9000,zY$=3000,hp0="/app",b34=32,x34,y34=900000,g34=60000,h34=1800000,OB0=3,PY$=1800000,u34=900000,c34=1800000,l34,AY$,dp0=40000,qY$=1e4,d34=256,sX,f3,t34,o34=63,r34,s34=253;var MY$=D(()=>{w4();ZY$();kp0();JY$();Mm0();Gn();Zn();NY$();gp0();x34=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),l34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],AY$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];sX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},f3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},t34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;r34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var kY$={};J4(kY$,{waitForSandboxReady:()=>KB0,parseTenantPools:()=>UY$,getSandboxClaim:()=>v3,getHttpRoute:()=>rQ$,deleteSandboxClaim:()=>DB,deleteHttpRoute:()=>WB0,createSandboxClaim:()=>Qn,applyHttpRoute:()=>JB0,SandboxTimeoutError:()=>iS,SandboxError:()=>I9,PREVIEW_NOT_READY_HEADER:()=>tS,KubeConfig:()=>Ey,K8S_CONSTANTS:()=>S5,HTTPROUTE_CONSTANTS:()=>Yn,AgentSandboxProvider:()=>ip0});var pp0=D(()=>{kp0();Zn();Gn();MY$();gp0()});var fY$={};J4(fY$,{subscribeLifecycle:()=>rp0,getSandboxProviderByKind:()=>tp0,getOrInitSharedRunner:()=>op0,__resetSharedLifecyclesForTesting:()=>EW4});function _Y$($,Z){let X=VY$[$];if(X)return Promise.resolve(X);let Q=np0[$];if(Q)return Q;let Y=Z().then((G)=>{return VY$[$]=G,G}).finally(()=>{delete np0[$]});return np0[$]=Y,Y}function HW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function FW4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function NW4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function UW4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function OW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function vY$($,Z){let X=new Sp(Z),Q=HW4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (pp0(),kY$)),J=new MY(b0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:FW4(),envName:NW4(),previewGateway:OW4(),sentinelToken:UW4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:L$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=B6$(W.cloneUrl);if(!H)return null;let{cloneUrl:F}=await QB(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return F},mintOrgFsConfig:async(W)=>{if(!W.orgSlug)return null;return await cZ0({boundAuth:{apiKey:{create:(H)=>F8.api.createApiKey({body:{...H,userId:W.userId}})}},storage:{orgRepoSyncs:new EE(Z)}},{orgSlug:W.orgSlug,orgId:W.orgId,baseUrl:b9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function tp0($,Z){return _Y$(Z,()=>vY$(Z,$.db))}async function op0(){let $;try{$=LE()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await _Y$($,()=>vY$($,l8().db))}function rp0($,Z,X){let Q=LB.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:LW4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return SY$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return LB.set(Z,G),wW4($,Z,G),SY$(Z,G,X)}function LW4(){}function SY$($,Z,X){return{unsubscribe(){if(LB.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)LB.delete($),Z.abort.abort()}}}async function wW4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(LB.get(Z)===X)LB.delete(Z)}}function EW4(){for(let $ of LB.values())$.abort.abort();LB.clear()}var WW4,KW4,CY$,VY$,np0,BW4,DW4,LB;var Wn=D(()=>{kF();gG();I6();Sm0();Jy();yL();q$();Wy();gY();L9();WW4=Symbol.for("decocms.sandbox.lifecycle.runners"),KW4=Symbol.for("decocms.sandbox.lifecycle.inflight"),CY$=globalThis,VY$=CY$[WW4]??={},np0=CY$[KW4]??={};BW4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),DW4=globalThis,LB=DW4[BW4]??=new Map});async function gZ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Kn($,G);if($.sandboxPreference==="agent-sandbox")return Kn($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Kn($,LE());let[J,...W]=jW4(Y,X,Q);if(J)return Kn($,W.length===0?J:zW4(J,W));return Kn($,bY$())}function jW4($,Z,X){let Q=c5($)[Z]?.[X];if(!Q)return[];let Y=Z3(Q);return Object.keys(Y)}function zW4($,Z){let X=bY$();if(X===$||Z.includes(X))return X;return $}function bY$(){return LE()}async function Kn($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await tp0($,X),kind:X}}var xF=D(()=>{P8();kF();lQ();Wn()});var Hn;var ap0=D(()=>{Hn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function yF($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gF($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function b3($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function oS($,Z,X){return ep0(await sp0($,Z),X)}async function sp0($,Z){let X=b3(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function ep0($,Z){return $?.created_by??Z}async function rS($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function xY$($,Z){let Q=(await rS($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function yY$($,Z,X){let Q=await rS($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function PW4($,Z){let X=l90(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=q5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function wB($,Z){let X=await rS($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=PW4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function $n0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===yF($.threadId))return $.runBranch;if($.threadRepo)return yF($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function Zn0($,Z){let Q=(await rS($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function BB0($,Z){let[X,Q]=await Promise.all([wB($,Z.threadId),Zn0($,Z.threadId)]);return $n0({...Z,threadRepo:X,pinnedRef:Q})}async function gY$($,Z,X,Q,Y,G){let J=await rS($,Z);if(!J)return;let W=Vp(c5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function DB0($,Z){return c5(await rS($,Z))}async function hY$($,Z,X,Q,Y){let G=await rS($,Z);if(!G)return;let J=Vm0(c5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var x3=D(()=>{VQ();lQ()});function Ry($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!X80.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function uY$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function cY$($,Z){r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=c5(G),W=await oS(Z,$.branch,Q),K=EK(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function AW4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function lY$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=AW4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Hn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Hn[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Fn=D(()=>{P8();ap0();lQ();x3()});import{sql as TW4}from"kysely";function dY$($){return $ instanceof Date?$.toISOString():String($)}class Xn0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:dY$($.created_at),updatedBy:$.updated_by,updatedAt:dY$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new EB($.id)}async create($){let Z=t8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(LB0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(LB0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(LB0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(LB0).executeTakeFirst();if(!Q)throw new sG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(TW4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new sG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var LB0,sG,EB;var Nn=D(()=>{gX();LB0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sG=class sG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};EB=class EB extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function jB($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new mY$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var mY$;var Un=D(()=>{mY$=class mY$ extends Error{}});async function wB0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof sG||H instanceof EB){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await jB(W,RW4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var RW4=10485760;var Qn0=D(()=>{Nn();Un()});async function iY$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof sG||J instanceof EB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var pY$=D(()=>{Nn()});async function oY$($,Z,X,Q,Y){let G=await mY({connectionId:$,tokenStorage:new l6(Q,Y)});if(!G.accessToken)return null;return aY$(Z,X,G.accessToken)}function rY$($,Z){return aY$($,Z,null)}async function aY$($,Z,X){let Q=new Map,Y=new Set(nY$.map((K)=>K.path));for(let K of Object.values(tY$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await qW4($,Z,K,X))}));let G=nY$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=tY$[G.pm]??[],W=null;for(let K of J)if(W=MW4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function qW4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function MW4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(IW4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var nY$,tY$,IW4;var sY$=D(()=>{oG();dG();nY$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],tY$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},IW4=/(?:--port|PORT=|:)(\d{4,5})/});function kW4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function EB0($){return $?.name||$?.email?.split("@")[0]||void 0}function jB0($){let Z=kW4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function On($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function eY$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function zB0($){return eY$($?.previewServerUrl)??eY$($?.productionUrl)}function aS($){return $==="cms"||$==="sandbox"?$:null}function VW4($){return!!zB0($)&&$?.fastPreview===!0}function PB0($){return VW4($)?"cms":"sandbox"}var Yn0;var Iy=D(()=>{Yn0=["cms","sandbox"]});function $G$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(SW4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function AB0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var SW4;var TB0=D(()=>{SW4=new Set(["main","master","trunk","develop","HEAD"])});async function ZG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=CW4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var CW4;var XG$=D(()=>{CW4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as y3}from"zod";async function qy($,Z){r(Z);let X=t(Z),Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await oS(Z,$.branch,Q),W=EK(c5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await gZ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(await H.alive(W.sandboxHandle).catch(()=>!0))return W;await ZB(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let F=b3($.branch)??Z.metadata?.threadId;if(F)On(Z,F,"sandbox");let U=await wB(Z,F)??G.githubRepo??null,{entry:O}=await YG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:K,runner:H,...$.purpose?{purpose:$.purpose}:{}});return O}async function YG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,purpose:F}=$,N=F==="harness-run",U=$.githubRepo?await vW4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:B,port:L,packageManagerPath:w}=lY$(W),E;if(U){if(U.connectionId)await XB({ctx:Z,connectionId:U.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(x0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:U.connectionId,error:x0.message})}});let{cloneUrl:L0,gitUserName:e,gitUserEmail:o}=U.connectionId?await QB(U.connectionId,U.owner,U.name,Z.db,Z.vault):O6$(U.owner,U.name);if(!B){let x0=U.connectionId?await oY$(U.connectionId,U.owner,U.name,Z.db,Z.vault):await rY$(U.owner,U.name);if(x0)B=x0.packageManager,O=Hn[x0.packageManager].runtime,L=x0.devPort??L,await fW4(Z,G,X,x0.packageManager,x0.devPort)}let j0=b0().sandboxStickyHeadRefEnabled,X0=AB0({branch:J,derivedRef:gF(J),recordedHeadRef:j0?await xY$(Z,b3(J)):null,sticky:j0}),P0=await iY$({ctx:Z,orgId:Y,userId:X,entries:uY$(W)});E={cloneUrl:L0,...U.connectionId?{connectionId:U.connectionId}:{},userName:e,userEmail:o,branch:X0,displayName:`${U.owner}/${U.name}`,submoduleCredentials:P0}}let j=O&&B&&!N?{runtime:O,packageManager:B,...L!==null?{devPort:Number(L)}:{},...w?{packageManagerPath:w}:{}}:void 0,z=Mp({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await ZG$(Z.objectStorage,{isProduction:b0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!b0().orgFsMountsDisabled,I;if(P){let L0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(L0)I=await cZ0(Z,{orgSlug:L0,orgId:Y,baseUrl:b9()})}await xW4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:N,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Ry(W);await wB0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let l=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),f=W.runtime?.selected??null,x=W.runtime?.port??null,n=W.runtime?.path??null,u={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:f,port:x,path:n}};await X6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,u);let a=b3(J)??Z.metadata?.threadId;if(a)await gY$(Z,a,Q,J,$.providerKind,u);let O0=!K||K.sandboxHandle!==q.handle;return{entry:u,isNewVm:O0}}async function vW4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=l90(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},N=F.githubRepo;if(N?.connectionId===G.connectionId){let U=q5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...N,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function fW4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function xW4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+QG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(QG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await D$(bW4)}}var _W4,Gn0,QG$=150000,bW4=5000;var Bn=D(()=>{kF();w4();S0();Fn();Qn0();pY$();lQ();VQ();Jy();sY$();ap0();xF();Iy();x3();TB0();XG$();q$();L9();Wy();lQ();_W4=y3.enum(["agent-sandbox","user-desktop","cluster"]),Gn0=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:y3.object({virtualMcpId:y3.string().describe("Virtual MCP ID"),branch:y3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:_W4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:y3.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:y3.object({previewUrl:y3.string().nullable(),sandboxHandle:y3.string(),branch:y3.string(),isNewVm:y3.boolean(),sandboxProviderKind:y3.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=$.branch??jB0(EB0(Z.auth.user)),Y=b3(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(aS(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=Y1(Z);if(!G)throw Error("User ID required");let J=await oS(Z,Q,G),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==X.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=$.sandboxProviderKind?BE($.sandboxProviderKind):void 0,{provider:F,kind:N}=await gZ(Z,{userId:J,branch:Q,virtualMcpMetadata:K,explicitKind:H}),U=EK(c5(K),J,Q,N),B=await wB(Z,b3(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:L,isNewVm:w}=await YG$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:B,existing:U,providerKind:N,runner:F});if(Y)On(Z,Y,"sandbox");return{...L,branch:Q,isNewVm:w,sandboxProviderKind:N}}})});function yW4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${encodeURIComponent(X)}`;if(!Q.slug)throw new JG$(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function RB0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let W=yW4({publicUrl:b9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:GG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+GG$*1000}}function WG$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let W=gW4(J.slug??J.title??"")||"mcp",K=W;for(let H=2;G.has(K);H++)K=`${W}-${H}`;return G.add(K),{name:K,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function gW4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function KG$($){return{self:[...$.toolNames],...$.grants}}var GG$=3600,JG$;var Jn0=D(()=>{L9();JG$=class JG$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function hW4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await RB0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function My($,Z){let{provider:X,kind:Q}=await gZ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=qy({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>hW4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return km0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await ZB($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function HG$($,Z){try{let X=await My($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var IB0=D(()=>{kF();Jn0();xF();Bn();lQ()});import{z as FG$}from"zod";function ky($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=q5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function cW4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ky(X)}function lW4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function dW4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2745,7 +2745,7 @@ query LastPublishedPr($owner: String!, $repo: String!, $base: String!) {
         and status = 'pending'
         and "expiresAt" > now()
     ) as exists
-  `.execute($)).rows[0]?.exists??!1}async function Jv$($,Z,X){try{await $.addMember({body:{userId:Z,role:"user",organizationId:X}})}catch(Q){if(!cO(Q))throw Q}}async function Wv$($,Z){for(let X=0;X<Xv$;X++){let Q=X===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return t$6(await $.createOrganization({body:{name:Z.name,slug:`${Z.baseSlug}${Q}`,userId:Z.userId}}))}catch(Y){if(!o$6(Y)||X===Xv$-1)throw Y}}throw Error("Failed to create organization")}var Xv$=5,c$6,l$6;var F61=D(()=>{JP0();c$6=["labs","agent","studio","workspace","systems","core","cloud","works"],l$6=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});import{APIError as r$6}from"better-auth/api";function Kv$($,Z){if(typeof Z!=="string"||Z===$)return;throw new r$6("BAD_REQUEST",{message:"Organization slug cannot be changed after creation."})}var Hv$=()=>{};var Lv$={};J4(Lv$,{resetPasswordEnabled:()=>HP0,grantDeploymentAdmin:()=>B61,getTrustedOrigins:()=>FP0,authConfig:()=>p8,auth:()=>F8,GENERIC_EMAIL_DOMAINS:()=>T3});import{randomBytes as a$6}from"crypto";import{sso as s$6}from"@better-auth/sso";import{organization as e$6}from"@decocms/better-auth/plugins";import{betterAuth as $86}from"better-auth";import{admin as Z86,apiKey as X86,jwt as Q86,magicLink as Y86,mcp as G86,openAPI as J86}from"better-auth/plugins";import{emailOTP as W86}from"better-auth/plugins/email-otp";import{APIError as Uv$}from"better-auth/api";import{adminAc as K86,defaultRoles as H86}from"better-auth/plugins/admin/access";import{defaultStatements as F86}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as N86}from"@decocms/better-auth/plugins/access";function Fv$($){if(!d90($))return;throw new Uv$("BAD_REQUEST",{message:`Organization slug "${String($).trim()}" is reserved by Studio`})}function B61($){if(!N61.includes($))N61.push($)}function FP0(){let $=[$a];try{let Z=new URL($a);if(Z.hostname==="localhost")$.push($a.replace("localhost","127.0.0.1"));else if(Z.hostname==="127.0.0.1")$.push($a.replace("127.0.0.1","localhost"))}catch{}return $}var Ov$,U86,KP0,O61,O86,B86,D86,Nv$,N61,p8,Bv$=void 0,U61=void 0,HP0=!1,L86,w86,E86,$a,Dv$,j86=262144,z86,F8;var gY=D(()=>{q$();Bx();$u0();C4();L9();gG();pp1();Ui();tp1();l_$();p_$();n_$();MQ();G61();s_$();JP0();F61();ql0();Hv$();Ov$=Object.values(Iw()).map(($)=>$.map((Z)=>Z.name)).flat(),U86={...F86,self:["*",...Ov$]},KP0=N86(U86),O61=Y61(Ov$),O86=KP0.newRole(O61.user),B86=KP0.newRole(O61.admin),D86=KP0.newRole(O61.owner),Nv$=Object.values(Iw()).map(($)=>$.map((Z)=>`self:${Z.name}`)).flat(),N61=[];p8=Sw().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=NF(p8.emailProviders,p8.inviteEmailProviderId);if($){let Z=FF($);Bv$=async(X)=>{let Q=X.inviter.user?.name||X.inviter.user?.email,Y=`${f9()}/auth/accept-invitation?invitationId=${X.invitation.id}&redirectTo=/${X.organization.slug}`;await Z({to:X.email,subject:`You've been invited to join ${X.organization.name}`,html:UF({preheader:`${Q} has invited you to join ${X.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${Q}</strong> has invited you to join <strong>${X.organization.name}</strong> on deco Studio.`,body:bw("Accept invitation",Y),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=NF(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let Z=FF($);HP0=!0,U61=async({user:X,url:Q})=>{await Z({to:X.email,subject:"Reset your password",html:UF({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:bw("Reset password",Q)+b50("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}L86=[e$6({organizationCreation:{afterCreate:async($)=>{await u_$($.organization.id),await c_$($.organization.id,$.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:$})=>{Fv$($.slug)},beforeUpdateOrganization:async({organization:$,member:Z})=>{if(Fv$($.slug),typeof $.slug==="string"){let Y=await l8().db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(Y)Kv$(Y.slug,$.slug)}let X=$.logo;if(typeof X!=="string"||!X.startsWith("data:"))return;let Q=await i_$(Z.organizationId,X);if(Q===X)return;return{data:{...$,logo:Q}}}},ac:KP0,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:im,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:O86,admin:B86,owner:D86},sendInvitationEmail:Bv$}),G86({loginPage:"/login",oidcConfig:{scopes:Nv$,metadata:{scopes_supported:Nv$},loginPage:"/login"}}),X86({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let X=$.headers?.get("Authorization");if(X?.startsWith("Bearer "))return X.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),Z86({defaultRole:"user",adminRoles:["admin","owner"],roles:{...H86,owner:K86},adminUserIds:N61}),J86(),Q86({jwt:{expirationTime:"5m",definePayload:({user:$})=>({id:$.id,email:$.email,name:$.name,role:$.role})}}),s$6(p8.ssoConfig?a_$(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[Y86(np1(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[W86(ip1(p8.emailOtpConfig,p8.emailProviders))]:[]],w86=Ni(),E86=lp1(w86),$a=f9();Dv$=b0(),z86=Dv$.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),a$6(32).toString("base64")})(),F8=$86({secret:z86,logger:{log:($,Z,...X)=>{if($==="error"&&Z.includes("validate API key"))return;if($==="error"&&X.some((Y)=>{let G=Y?.statusCode;return typeof G==="number"&&G>=300&&G<400}))return;let Q=`${new Date().toISOString()} ${$.toUpperCase()} [Better Auth]: ${Z}`;if($==="error")console.error(Q,...X);else if($==="warn")console.warn(Q,...X);else console.log(Q,...X)}},baseURL:$a,trustedOrigins:FP0(),database:E86,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...U61&&{sendResetPassword:U61}},rateLimit:{enabled:!Dv$.disableRateLimit,window:60,max:1e4},plugins:L86,databaseHooks:{user:{create:{before:async($)=>{let Z=$.name;if(typeof Z==="string"&&Z.trim().length>0)return;let X=$v$($.email);if(!X)return;return{data:{...$,name:X}}},after:async($,Z)=>{X61({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified});let X=Z?.getCookie("studio_signup_ref")??null,Q=Z?.getCookie("studio_signup_src")??null;y1.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name,...X?{signup_ref:X}:{},...Q?{signup_src:Q}:{}}});let Y=Sw().autoCreateOrganizationOnSignup!==!1;try{let G=await WP0({db:l8().db,authApi:F8.api,user:{id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified},allowCreate:Y,createdVia:"signup"});if(G.status==="created")y1.groupIdentify({groupType:"organization",groupKey:G.organization.id,properties:{name:G.organization.name,slug:G.organization.slug,created_at:new Date().toISOString(),created_via:G.createdVia,email_domain:G.domain}}),y1.capture({distinctId:$.id,event:"organization_created",groups:{organization:G.organization.id},properties:{organization_id:G.organization.id,organization_slug:G.organization.slug,name:G.organization.name,created_via:G.createdVia,email_domain:G.domain}});if(G.status==="joined")y1.capture({distinctId:$.id,event:"organization_domain_joined",groups:{organization:G.organization.id},properties:{organization_id:G.organization.id,organization_slug:G.organization.slug,email_domain:G.domain,joined_via:G.createdVia}})}catch(G){y1.captureException(G,$.id),console.error("Failed to ensure organization on signup:",G)}}},update:{before:async($)=>{let Z=$.image;if(typeof Z==="string"&&Z.startsWith("data:")&&Z.length>j86)throw new Uv$("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async($)=>{let Z=await l8().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!Z)return;X61({id:Z.id,email:Z.email,name:Z.name??null,emailVerified:!!Z.emailVerified})}}}}})});function L61($){return $?`/api/${$}`:""}function wv$($){let X=new URL($).pathname;if(X.endsWith("/"))X=X.slice(0,-1);let Q=(Y)=>{let G=new URL($);return G.pathname=Y,G.toString()};return[Q(`${X}/.well-known/oauth-protected-resource`),Q(`/.well-known/oauth-protected-resource${X}`),Q("/.well-known/oauth-protected-resource")]}function Ev$($){let X=new URL($).pathname;if(X.endsWith("/"))X=X.slice(0,-1);let Q=X!==""&&X!=="/",Y=(G)=>{let J=new URL($);return J.pathname=G,J.toString()};if(Q)return[Y(`/.well-known/oauth-authorization-server${X}`),Y(`/.well-known/openid-configuration${X}`),Y(`${X}/.well-known/openid-configuration`)];return[Y("/.well-known/oauth-authorization-server"),Y("/.well-known/openid-configuration")]}function jv$($){return"issuer"in $&&!("resource"in $)&&(("authorization_endpoint"in $)||("token_endpoint"in $))}function zv$($){let Z=$.toLowerCase();return Z.includes("resource_metadata=")||Z.includes("invalid_token")||Z.includes("oauth")}function Pv$($){let Z=$.message?.toLowerCase()??"";return $.status===401||$.code===401||($.message?.includes("401")??!1)||Z.includes("unauthorized")||Z.includes("invalid_token")||Z.includes("api key required")||Z.includes("api-key required")}function Av$($,{proxyResourceUrl:Z,proxyAuthServer:X}){return{...$,resource:Z,authorization_servers:[X]}}function w61({proxyResourceUrl:$,proxyAuthServer:Z,scopesSupported:X=["*"]}){return{resource:$,authorization_servers:[Z],bearer_methods_supported:["header"],scopes_supported:X}}function Tv$($){return"scopes_supported"in $&&Array.isArray($.scopes_supported)&&$.scopes_supported.length>0?$.scopes_supported:["*"]}function Rv$($,Z){return{...$,authorization_endpoint:$.authorization_endpoint?`${Z}/authorize`:void 0,token_endpoint:$.token_endpoint?`${Z}/token`:void 0,registration_endpoint:$.registration_endpoint?`${Z}/register`:void 0}}function Iv$({origin:$,prefix:Z,connectionId:X}){return`Bearer realm="mcp",resource_metadata="${$}${Z}/mcp/${X}/.well-known/oauth-protected-resource"`}var D61;var qv$=D(()=>{D61=[404,401,406]});import{oAuthProtectedResourceMetadata as P86}from"better-auth/plugins";async function A86($,Z,X){return(await Z.storage.connections.findById($,X))?.connection_url??null}async function Vv$($,Z={}){try{let X=await j61($,{method:"POST",headers:{...Z,"Content-Type":"application/json",Accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:0,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"mcp-cms-proxy",version:"1.0.0"}}})});if(X.status===401){let Q=X.headers.get("WWW-Authenticate");if(Q){if(zv$(Q))return Q}if(await T86($))return'Bearer realm="mcp"'}return null}catch{return null}}async function T86($){try{let Z=new URL($),X=new URL("/.well-known/oauth-authorization-server",Z.origin),Q=await j61(X.toString(),{method:"GET",headers:{Accept:"application/json"}});if(Q.ok){let Y=await Q.json();if(Y.authorization_endpoint||Y.token_endpoint||Y.issuer)return!0}return!1}catch{return!1}}async function ch($){let Z=wv$($),X;for(let Q=0;Q<Z.length;Q++){if(X=await bv$(Z[Q],{method:"GET",headers:{Accept:"application/json"}}),X.ok)return X;if(Q<Z.length-1&&!D61.includes(X.status))return X}return X}async function R86($){let Z;try{Z=new URL($).origin}catch{return null}try{let X=await ch($);if(X.ok){let Q=await X.json();if(Q.authorization_servers?.[0])return Q.authorization_servers[0]}}catch{}return Z}async function Sv$($){let Z=$.get("studioContext");if(!Z)Z=await WJ.create($.req.raw),$.set("studioContext",Z);return Z}async function Aa0({error:$,reqUrl:Z,connectionId:X,connectionUrl:Q,headers:Y,orgSlug:G}){if(!Pv$($))return null;if(Boolean(await Vv$(Q,Y)))return new Response(null,{status:401,headers:{"WWW-Authenticate":Iv$({origin:Z.origin,prefix:L61(G),connectionId:X})}});return new Response(JSON.stringify({error:"unauthorized",message:"Authentication required but server does not support OAuth"}),{status:401,headers:{"Content-Type":"application/json"}})}function Mv$($){let Q=$.pathname;if(Q.endsWith("/.well-known/oauth-protected-resource"))Q=Q.slice(0,-37)||"/";else if(Q.startsWith("/.well-known/oauth-protected-resource"))Q=Q.slice(37)||"/";return`${$.origin}${Q}`}async function kv$($,Z){let X=await P86(F8)($),Q=await X.json();if(Z)Q.resource=Z;return Response.json(Q,X)}function j61($,Z,X=fv$){return fetch($,{...Z,signal:AbortSignal.timeout(X)})}class E61{response;constructor($){this.response=$}}async function bv$($,Z,{attempts:X=3,timeoutMs:Q=fv$}={}){try{return await v5(async()=>{let Y=await j61($,Z,Q);if(Y.status>=500)throw new E61(Y);return Y},{maxAttempts:X,minTimeout:150,multiplier:2,jitter:0})}catch(Y){if(Y instanceof OY){if(Y.cause instanceof E61)return Y.cause.response;throw Y.cause}throw Y}}async function Xa($){if(Rd($))return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}});let Z=Ev$($),X=null;for(let Q of Z){if(X=await bv$(Q,{method:"GET",headers:{Accept:"application/json"}}),X.ok)return X;if(X.status!==404&&X.status!==401)return X}return X}var Cv$=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $},Za=async($)=>{let Z=$.req.param("connectionId"),X=await Sv$($),Q=Cv$(new URL($.req.url)),Y=$.req.param("org")??X.organization?.slug,G;if(Y)if(X.organization?.id&&X.organization.slug===Y)G=X.organization.id;else{let F=await X.db.selectFrom("organization").select("id").where("slug","=",Y).executeTakeFirst();if(!F)return $.json({error:"Connection not found"},404);G=F.id}if(G&&X.auth?.tokenOrganizationId&&X.auth.tokenOrganizationId!==G)return $.json({error:"forbidden: token is scoped to another organization"},403);if(Z==="self")return kv$($.req.raw,Mv$(Q));let J=await A86(Z,X,G);if(!J)return $.json({error:"Connection not found"},404);if(J.startsWith("virtual://"))return kv$($.req.raw,Mv$(Q));let W=L61(Y),K=`${Q.origin}${W}/mcp/${Z}`,H=`${Q.origin}/oauth-proxy/${Z}`;try{let F=await ch(J);if(!F.ok&&D61.includes(F.status)){if(await Vv$(J)){let B=w61({proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(B),{status:200,headers:{"Content-Type":"application/json"}})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}if(!F.ok)return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}});let N=await F.json();if(jv$(N)){let O=w61({proxyResourceUrl:K,proxyAuthServer:H,scopesSupported:Tv$(N)});return new Response(JSON.stringify(O),{status:200,headers:{"Content-Type":"application/json"}})}let U=Av$(N,{proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(U),{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}catch(F){let N=F;return console.error("[oauth-proxy] Failed to proxy OAuth protected resource metadata:",N),$.json({error:"Failed to proxy OAuth metadata",message:N.message},502)}},_v$=()=>{let $=new F1;return $.get("/.well-known/oauth-protected-resource/mcp/:connectionId",(Z)=>Za(Z)),$.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>Za(Z)),$},vv$=()=>{let $=new F1;return $.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>Za(Z)),$},fv$=4000,I86=async($)=>{let Z=$.req.param("connectionId"),X=await Sv$($),Q=await X.storage.connections.findById(Z);if(!Q?.connection_url)return $.json({error:"Connection not found or no auth server"},404);let Y=await R86(Q.connection_url);if(!Y)return $.json({error:"Connection not found or no auth server"},404);let G=await X.db.selectFrom("organization").select("slug").where("id","=",Q.organization_id).executeTakeFirst();try{let J=await Xa(Y);if(!J.ok)return new Response(J.body,{status:J.status,statusText:J.statusText,headers:{"Content-Type":"application/json"}});let W=await J.json(),K=Cv$(new URL($.req.url)),H=G?.slug?`${K.origin}/api/${G.slug}/oauth-proxy/${Z}`:`${K.origin}/oauth-proxy/${Z}`,F=Rv$(W,H);return new Response(JSON.stringify(F),{status:200,headers:{"Content-Type":"application/json"}})}catch(J){let W=J;return console.error("[oauth-proxy] Failed to proxy auth server metadata:",W),$.json({error:"Failed to proxy auth server metadata",message:W.message},502)}},xv$=()=>{let $=new F1;return $.get("/.well-known/oauth-authorization-server/oauth-proxy/:connectionId",I86),$};var Et=D(()=>{D8();_B();gY();w4();Kb();qv$()});async function lh($){try{let Z;try{let Q=await ch($);if(Q.ok)Z=(await Q.json()).authorization_servers?.[0]}catch{}if(!Z)Z=new URL($).origin;let X=await Xa(Z);if(X.ok){let Q=await X.json();if(typeof Q.token_endpoint==="string")try{let Y=new URL(Q.token_endpoint);if(Y.protocol==="http:"||Y.protocol==="https:")return Q.token_endpoint}catch{}}return null}catch{return null}}var NP0=D(()=>{Et()});function gh($){return!!$.refreshToken&&!!$.tokenEndpoint&&!!$.clientId}function q86($,Z){if($.includes("/oauth-proxy/"))return!0;try{return new URL($).host!==new URL(Z).host}catch{return!1}}async function V86($,Z){let X=await cd1($);if(!X.success||!X.accessToken){if(X.permanent===!0)await Z.delete($.connectionId);return{accessToken:null,permanent:X.permanent===!0}}return await Z.upsert({connectionId:$.connectionId,accessToken:X.accessToken,refreshToken:X.refreshToken??$.refreshToken,scope:X.scope??$.scope,expiresAt:X.expiresIn===void 0?null:new Date(Date.now()+X.expiresIn*1000),clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint}),{accessToken:X.accessToken,permanent:!1}}function XP0($,Z){let X=z61.get($.connectionId);if(X)return X;let Q=UP0.get($.connectionId);if(Q&&Date.now()<Q.nextAttemptAt)return Promise.resolve(null);let Y=V86($,Z).then(({accessToken:G,permanent:J})=>{if(G||J)UP0.delete($.connectionId);else{let W=UP0.get($.connectionId)?.attempt??0,K=oZ(k86,M86,W,2,0.5);UP0.set($.connectionId,{attempt:W+1,nextAttemptAt:Date.now()+K})}return G}).finally(()=>{z61.delete($.connectionId)});return z61.set($.connectionId,Y),Y}async function mY($){let{connectionId:Z,connectionUrl:X,tokenStorage:Q,force:Y}=$,G=await Q.get(Z);if(!G)return{state:"missing",accessToken:null};let J=gh(G),W=J?$.bufferMs??fp:0,K=Q.isExpired(G,W);if(!Y&&!K)return{state:"valid",accessToken:G.accessToken};if(!J){if(K)await Q.delete(Z);return{state:"expired_without_refresh",accessToken:null}}let H=G.tokenEndpoint;if(X&&H&&q86(H,X)){let N=await lh(X);if(N)H=N}let F=await XP0({...G,tokenEndpoint:H},Q);if(!F)return{state:"refresh_failed",accessToken:null};return{state:"refreshed",accessToken:F}}var fp=300000,F6$=3300000,Y9="GitHub token refresh failed \u2014 reconnect the mcp-github integration.",z61,M86=30000,k86=300000,UP0;var oG=D(()=>{w4();ld1();NP0();z61=new Map,UP0=new Map});import{SpanStatusCode as yv$}from"@opentelemetry/api";function P61($){if(Array.isArray($))return $.map(P61);if($&&typeof $==="object"){let{__binding:Z,...X}=$,Q={};for(let[Y,G]of Object.entries(X))Q[Y]=P61(G);return Q}return $}async function A61($,Z,X){return Z.tracer.startActiveSpan("studio.connection.build_headers",{attributes:{"connection.id":$.id}},async(Q)=>{try{let Y=await S86($,Z,X);return Q.setStatus({code:yv$.OK}),Y}catch(Y){throw Q.setStatus({code:yv$.ERROR,message:Y.message}),Q.recordException(Y),Y}finally{Q.end()}})}async function S86($,Z,X){let Q=$.id,Y=xh0($.configuration_state,$.configuration_scopes),G=Z.auth.user,J=G?.id??Z.auth.apiKey?.userId??(X?$.created_by:void 0),[W,K]=J?await sS1({sub:J,user:{id:J,email:G?.email,name:G?.name,role:G?.role},metadata:{state:$.configuration_state?P61($.configuration_state):void 0,studioUrl:Z.baseUrl,meshUrl:Z.baseUrl,connectionId:Q,organizationId:Z.organization?.id,organizationName:Z.organization?.name,organizationSlug:Z.organization?.slug},permissions:Y}).then((B)=>[B,null]).catch((B)=>[null,B]):[null,Error("User ID required to issue configuration token")];if(K)console.error("Failed to issue configuration token:",K);let H=Z.auth.user?.connectionId,F={...H?{"x-caller-id":H}:{},...Z.metadata.wellKnownForwardableHeaders??{},"x-request-id":Z.metadata.requestId};if(Z.metadata.runMetadata&&Object.keys(Z.metadata.runMetadata).length>0)vh0(F,"runMetadata",JSON.stringify(Z.metadata.runMetadata));let N=null;if(!!q5($)?.sourceConnectionId)try{N=await Cp(Z,$)}catch(B){console.error("[Proxy] repo-scoped legacy token mint failed",{connectionId:Q,error:B.message})}else{let B=new l6(Z.db,Z.vault),L=await mY({connectionId:Q,connectionUrl:$.connection_url,tokenStorage:B});if(L.accessToken)N=L.accessToken;else if(L.state==="expired_without_refresh")console.warn(`[Proxy] Token expired for ${Q} with no refresh capability`)}if(!N&&$.connection_token)N=$.connection_token;if(N)F.Authorization=`Bearer ${N}`;if(W)vh0(F,"token",W);return F}var gv$=D(()=>{yh0();PU();oG();dG();vp();VQ();fh0()});function OP0(){let $=new Map;function Z(Q,Y){let G=$.get(Y);if(G)return G;let J=(async()=>{let W=await Q(),K=new y9({name:`outbound-client-${Y}`,version:"1.0.0"},{capabilities:{tasks:{list:{},cancel:{},requests:{tool:{call:{}}}}},jsonSchemaValidator:F5});return K.onclose=()=>{$.delete(Y)},await K.connect(W),K})().catch((W)=>{throw $.delete(Y),W});return $.set(Y,J),J}return Object.assign(Z,{[Symbol.asyncDispose]:async()=>{let Q=[];for(let[Y,G]of $)Q.push(G.then((J)=>J.close()).catch(()=>{}));await Promise.all(Q),$.clear()}})}var T61=D(()=>{lW();yX()});function hv$($){let Z=new Mi({command:$.command,args:$.args,env:$.env,cwd:$.cwd,stderr:"pipe"}),X=$.name||$.id,Q="\x1B[2m",Y="\x1B[0m";return Z.stderr?.on("data",(G)=>{let J=G.toString().trimEnd();if(J)console.error(`${J} \x1B[2m[${X}]\x1B[0m`)}),Z}var uv$=D(()=>{Oc0()});var dh;var cv$=D(()=>{xY();Mw();yX();dh=class dh extends mf{options;constructor($,Z){super($);this.options=Z}toolsListPromise=null;fetchToolsFromServer(){if(!this.toolsListPromise)this.toolsListPromise=new Promise(($)=>{let Z=`auth-tools-${Date.now()}`,X=this.innerTransport.onmessage,Q=(G)=>{clearTimeout(Y),this.innerTransport.onmessage=X,this.toolsListPromise=null,$(G)},Y=setTimeout(()=>Q(null),f40);this.innerTransport.onmessage=(G)=>{if("id"in G&&G.id===Z)if("result"in G){let J=G.result?.tools??null;Q(J)}else Q(null);else X?.(G)},this.innerTransport.send({jsonrpc:"2.0",id:Z,method:"tools/list",params:{}}).catch(()=>Q(null))});return this.toolsListPromise}async ensureToolsMap(){let $=this.options.cache??Z9(),Z=await vO("tools",this.options.connection.id,async()=>{let X=await this.fetchToolsFromServer();if(X===null)throw Error("Failed to fetch tools list");return X},$,(X)=>this.options.ctx.pendingRevalidations.push(X),_O);if(!Z)return new Map;return new Map(Z.map((X)=>[X.name,X]))}async handleOutgoingMessage($){if(!this.isRequest($))return this.innerTransport.send($);let Z=$;if(Z.method==="tools/call")await this.authorizeToolCall(Z),this.stripMetaFromArguments(Z);return this.innerTransport.send($)}async authorizeToolCall($){if(this.options.superUser)return;let X=$.params.name,{ctx:Q,connection:Y}=this.options;if(await this.isPublicTool(X))return;if(!Q.auth.user?.id&&!Q.auth.apiKey?.id)throw Error("Authentication required. Please provide a valid OAuth token or API key.");let G=async()=>{return(await this.ensureToolsMap()).get(X)?._meta};await new qw(Q.auth.user?.id??Q.auth.apiKey?.userId,X,Q.boundAuth,Q.organization?.role??Q.auth.user?.role,Y.id,G,Q.organization?.id).check(X)}async isPublicTool($){if($.startsWith("STUDIO_PUBLIC_")||$.startsWith("MESH_PUBLIC_"))return!0;let X=(await this.ensureToolsMap()).get($);if(!X?._meta)return!1;return sW(X._meta)?.public_tool===!0}stripMetaFromArguments($){let Z=$.params;if(Z.arguments&&"_meta"in Z.arguments){let{_meta:X,...Q}=Z.arguments;Z.arguments=Q}}}});function R61($){let{ctx:Z,organizationId:X,connectionId:Q,toolName:Y,durationMs:G,isError:J}=$;if(!X||!Q||!Y)return;let W={"tool.name":Y,"organization.id":X,"connection.id":Q,status:J?"error":"success","error.type":J?$.errorType||"Error":""};Z.meter.createHistogram("tool.execution.duration",{description:"Duration of tool executions in milliseconds",unit:"ms"}).record(G,W),Z.meter.createCounter("tool.execution.count",{description:"Number of tool executions"}).add(1,W)}import{trace as v3Z,context as f3Z}from"@opentelemetry/api";function lv$($){if(!$.isError)return;let Z=$.content;if(!Array.isArray(Z))return;for(let X of Z)if(X&&typeof X==="object"&&"type"in X&&X.type==="text"&&"text"in X&&typeof X.text==="string")return X.text;return}function dv$($){if(!$)return;let Z=$._meta;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let X=Z.properties;if(!X||typeof X!=="object"||Array.isArray(X))return;let Q={};for(let[Y,G]of Object.entries(X))if(typeof G==="string")Q[Y]=G;return Object.keys(Q).length>0?Q:void 0}function mv$($,Z){if(!$&&!Z)return;if(!$)return Z;if(!Z)return $;return{...Z,...$}}var iv$=D(()=>{$L0();BY()});import{trace as C86,context as pv$}from"@opentelemetry/api";var mh;var nv$=D(()=>{yX();$L0();iv$();mh=class mh extends mf{options;inflightRequests=new Map;requestContext;constructor($,Z){super($);this.options=Z;this.requestContext=pv$.active()}async handleOutgoingMessage($){if(this.isRequest($)){let Z=$;this.onRequestStart(Z)}return this.innerTransport.send($)}handleIncomingMessage($){if(this.isResponse($)){let Z=$;this.onResponseEnd(Z)}this.onmessage?.($)}onRequestStart($){let{ctx:Z,connectionId:X}=this.options,Q,Y;if($.method==="tools/call"&&$.params){let J=$.params;Q=J.name,Y=J.arguments}let G;if($.method==="tools/call"&&Q)G=Z.tracer.startSpan("mcp.proxy.callTool",{attributes:{"connection.id":X,"tool.name":Q,"request.id":Z.metadata.requestId,"jsonrpc.id":$.id,"jsonrpc.method":$.method}},this.requestContext);if($.id!==null&&$.id!==void 0)this.inflightRequests.set($.id,{startTime:Date.now(),method:$.method,toolName:Q,toolArguments:Y,span:G})}onResponseEnd($){if($.id===null||$.id===void 0)return;let Z=this.inflightRequests.get($.id);if(!Z)return;let{ctx:X,connectionId:Q}=this.options,{startTime:Y,method:G,toolName:J,toolArguments:W,span:K}=Z,H=Date.now()-Y;if(this.inflightRequests.delete($.id),G!=="tools/call"||!J)return;let F=X.organization?.id??"",N="error"in $,U=N?$.error:$.result,O=N?{content:[{type:"text",text:$.error?.message||"Unknown error"}],isError:!0}:U,B=N||O?.isError===!0,L=N?$.error?.message:void 0,w=lv$(O)||null;if(X.meter.createHistogram("connection.proxy.duration").record(H,{"connection.id":Q,"organization.id":F,"tool.name":J,status:B?"error":"success"}),B)X.meter.createCounter("connection.proxy.errors").add(1,{"connection.id":Q,"organization.id":F,"tool.name":J,error:L??w??void 0});else X.meter.createCounter("connection.proxy.requests").add(1,{"connection.id":Q,"organization.id":F,"tool.name":J,status:"success"});if(F)R61({ctx:X,organizationId:F,connectionId:Q,toolName:J,durationMs:H,isError:B,errorType:N?"RemoteError":B?"ToolError":""});if(K){if(B)K.recordException(Error(L??w??"Tool error"));let E=dv$(W),j=mv$(X.metadata.properties,E),z=C86.setSpan(pv$.active(),K);Qt({organizationId:X.organization?.id??"",connectionId:Q,toolName:J,toolArguments:W,result:O,duration:H,isError:B,errorMessage:w,userId:X.auth.user?.id||X.auth.apiKey?.userId||null,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent||null,virtualMcpId:this.options.virtualMcpId||null,properties:j||null},z),K.end()}}async close(){for(let $ of this.inflightRequests.values())if($.span)$.span.setAttributes({"transport.closed":!0}),$.span.end();return this.inflightRequests.clear(),super.close()}}});var tv$=D(()=>{yX();cv$();nv$()});async function ov$($,Z,X=!1){let Q=$.id,Y=Z.connectionId&&Z.connectionId!==Q?Z.connectionId:void 0;switch($.connection_type){case"STDIO":{if(!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let G=$.connection_headers;if(!bW(G))throw Error("STDIO connection missing parameters");let J=hv$({id:Q,name:$.title,command:G.command,args:G.args,env:G.envVars,cwd:G.cwd});return J=pf(J,(W)=>new dh(W,{ctx:Z,connection:$,superUser:X}),(W)=>new mh(W,{ctx:Z,connectionId:Q,virtualMcpId:Y})),_86(()=>J,Q)}case"HTTP":case"Websocket":{if(!$.connection_url)throw Error(`${$.connection_type} connection missing URL`);let G=$.connection_url;return Z.getOrCreateClient(async()=>{let J=await A61($,Z,X),W=$.connection_headers;if(W&&"headers"in W)Object.assign(J,W.headers);let K=new mW(new URL(G),{requestInit:{headers:J}});return K=pf(K,(H)=>new dh(H,{ctx:Z,connection:$,superUser:X}),(H)=>new mh(H,{ctx:Z,connectionId:Q,virtualMcpId:Y})),K},Q)}case"SSE":{if(!$.connection_url)throw Error("SSE connection missing URL");let G=$.connection_url;return Z.getOrCreateClient(async()=>{let J=await A61($,Z,X),W=$.connection_headers;if(W&&"headers"in W)Object.assign(J,W.headers);let K=new QF(new URL(G),{requestInit:{headers:J}});return K=pf(K,(H)=>new dh(H,{ctx:Z,connection:$,superUser:X}),(H)=>new mh(H,{ctx:Z,connectionId:Q,virtualMcpId:Y})),K},Q)}default:throw Error(`Unknown connection type: ${$.connection_type}`)}}var _86;var rv$=D(()=>{q$();yW();Ad();ef();gv$();T61();uv$();tv$();_86=OP0()});var N6$={};J4(N6$,{clientFromConnection:()=>N5});async function N5($,Z,X=!1){if($.connection_type==="VIRTUAL")return KW$($,Z,X);return ov$($,Z,X)}var xi=D(()=>{rv$();fy()});function I61($){if($===null)return"null";if(Array.isArray($))return"array";return typeof $}function v86($,Z){if(Z==="integer")return typeof $==="number"&&Number.isInteger($);return I61($)===Z}function f86($,Z){if(Z==="object"||Z==="array"){let X;try{X=JSON.parse($)}catch{return}return I61(X)===Z?X:void 0}if(Z==="boolean"){if($==="true")return!0;if($==="false")return!1;return}if(Z==="number"||Z==="integer"){if($.trim()==="")return;let X=Number($);if(!Number.isFinite(X))return;if(Z==="integer"&&!Number.isInteger(X))return;return X}return}function av$($,Z){if(!$?.properties||!Z)return null;let X=!1,Q={...Z};for(let[Y,G]of Object.entries(Z)){if(typeof G!=="string")continue;let J=$.properties[Y]?.type;if(!J||J==="string")continue;let W=f86(G,J);if(W===void 0)continue;Q[Y]=W,X=!0}return X?Q:null}function q61($,Z,X){let Q=Object.keys(X??{}),Y=Z?.required??[],G=Y.filter((H)=>!Q.includes(H)),J=(H)=>{let F=Z?.properties?.[H]?.type;return F?`${H} (${F})`:H},W=Q.filter((H)=>{let F=Z?.properties?.[H]?.type;return F!=null&&!v86(X?.[H],F)}).map((H)=>`${H} (expected ${Z?.properties?.[H]?.type}, got ${I61(X?.[H])})`);return[`Invalid arguments for "${$}".`,Y.length?`Required: ${Y.map(J).join(", ")}.`:"",`You sent: ${Q.length?Q.join(", "):"(none)"}.`,G.length?`Missing required: ${G.join(", ")}.`:"",W.length?`Wrong type: ${W.join(", ")}.`:""].filter(Boolean).join(" ")}function sv$($,Z,X,Q){if(!($ instanceof L1)||$.code!==q1.InvalidParams)return $;if(!Z)return $;let Y=q61(Z,X,Q),G=$.message.replace(/^MCP error -?\d+: /,"");return new L1(q1.InvalidParams,`${G}
+  `.execute($)).rows[0]?.exists??!1}async function Jv$($,Z,X){try{await $.addMember({body:{userId:Z,role:"user",organizationId:X}})}catch(Q){if(!cO(Q))throw Q}}async function Wv$($,Z){for(let X=0;X<Xv$;X++){let Q=X===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return t$6(await $.createOrganization({body:{name:Z.name,slug:`${Z.baseSlug}${Q}`,userId:Z.userId}}))}catch(Y){if(!o$6(Y)||X===Xv$-1)throw Y}}throw Error("Failed to create organization")}var Xv$=5,c$6,l$6;var F61=D(()=>{JP0();c$6=["labs","agent","studio","workspace","systems","core","cloud","works"],l$6=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});import{APIError as r$6}from"better-auth/api";function Kv$($,Z){if(typeof Z!=="string"||Z===$)return;throw new r$6("BAD_REQUEST",{message:"Organization slug cannot be changed after creation."})}var Hv$=()=>{};var Lv$={};J4(Lv$,{resetPasswordEnabled:()=>HP0,grantDeploymentAdmin:()=>B61,getTrustedOrigins:()=>FP0,authConfig:()=>p8,auth:()=>F8,GENERIC_EMAIL_DOMAINS:()=>T3});import{randomBytes as a$6}from"crypto";import{sso as s$6}from"@better-auth/sso";import{organization as e$6}from"@decocms/better-auth/plugins";import{betterAuth as $86}from"better-auth";import{admin as Z86,apiKey as X86,jwt as Q86,magicLink as Y86,mcp as G86,openAPI as J86}from"better-auth/plugins";import{emailOTP as W86}from"better-auth/plugins/email-otp";import{APIError as Uv$}from"better-auth/api";import{adminAc as K86,defaultRoles as H86}from"better-auth/plugins/admin/access";import{defaultStatements as F86}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as N86}from"@decocms/better-auth/plugins/access";function Fv$($){if(!d90($))return;throw new Uv$("BAD_REQUEST",{message:`Organization slug "${String($).trim()}" is reserved by Studio`})}function B61($){if(!N61.includes($))N61.push($)}function FP0(){let $=[$a];try{let Z=new URL($a);if(Z.hostname==="localhost")$.push($a.replace("localhost","127.0.0.1"));else if(Z.hostname==="127.0.0.1")$.push($a.replace("127.0.0.1","localhost"))}catch{}return $}var Ov$,U86,KP0,O61,O86,B86,D86,Nv$,N61,p8,Bv$=void 0,U61=void 0,HP0=!1,L86,w86,E86,$a,Dv$,j86=262144,z86,F8;var gY=D(()=>{q$();Bx();$u0();C4();L9();gG();pp1();Ui();tp1();l_$();p_$();n_$();MQ();G61();s_$();JP0();F61();ql0();Hv$();Ov$=Object.values(Iw()).map(($)=>$.map((Z)=>Z.name)).flat(),U86={...F86,self:["*",...Ov$]},KP0=N86(U86),O61=Y61(Ov$),O86=KP0.newRole(O61.user),B86=KP0.newRole(O61.admin),D86=KP0.newRole(O61.owner),Nv$=Object.values(Iw()).map(($)=>$.map((Z)=>`self:${Z.name}`)).flat(),N61=[];p8=Sw().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=NF(p8.emailProviders,p8.inviteEmailProviderId);if($){let Z=FF($);Bv$=async(X)=>{let Q=X.inviter.user?.name||X.inviter.user?.email,Y=`${f9()}/auth/accept-invitation?invitationId=${X.invitation.id}&redirectTo=/${X.organization.slug}`;await Z({to:X.email,subject:`You've been invited to join ${X.organization.name}`,html:UF({preheader:`${Q} has invited you to join ${X.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${Q}</strong> has invited you to join <strong>${X.organization.name}</strong> on deco Studio.`,body:bw("Accept invitation",Y),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=NF(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let Z=FF($);HP0=!0,U61=async({user:X,url:Q})=>{await Z({to:X.email,subject:"Reset your password",html:UF({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:bw("Reset password",Q)+b50("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}L86=[e$6({organizationCreation:{afterCreate:async($)=>{await u_$($.organization.id),await c_$($.organization.id,$.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:$})=>{Fv$($.slug)},beforeUpdateOrganization:async({organization:$,member:Z})=>{if(Fv$($.slug),typeof $.slug==="string"){let Y=await l8().db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(Y)Kv$(Y.slug,$.slug)}let X=$.logo;if(typeof X!=="string"||!X.startsWith("data:"))return;let Q=await i_$(Z.organizationId,X);if(Q===X)return;return{data:{...$,logo:Q}}}},ac:KP0,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:im,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:O86,admin:B86,owner:D86},sendInvitationEmail:Bv$}),G86({loginPage:"/login",oidcConfig:{scopes:Nv$,metadata:{scopes_supported:Nv$},loginPage:"/login"}}),X86({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let X=$.headers?.get("Authorization");if(X?.startsWith("Bearer "))return X.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),Z86({defaultRole:"user",adminRoles:["admin","owner"],roles:{...H86,owner:K86},adminUserIds:N61}),J86(),Q86({jwt:{expirationTime:"5m",definePayload:({user:$})=>({id:$.id,email:$.email,name:$.name,role:$.role})}}),s$6(p8.ssoConfig?a_$(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[Y86(np1(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[W86(ip1(p8.emailOtpConfig,p8.emailProviders))]:[]],w86=Ni(),E86=lp1(w86),$a=f9();Dv$=b0(),z86=Dv$.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),a$6(32).toString("base64")})(),F8=$86({secret:z86,logger:{log:($,Z,...X)=>{if($==="error"&&Z.includes("validate API key"))return;if($==="error"&&X.some((Y)=>{let G=Y?.statusCode;return typeof G==="number"&&G>=300&&G<400}))return;let Q=`${new Date().toISOString()} ${$.toUpperCase()} [Better Auth]: ${Z}`;if($==="error")console.error(Q,...X);else if($==="warn")console.warn(Q,...X);else console.log(Q,...X)}},baseURL:$a,trustedOrigins:FP0(),database:E86,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...U61&&{sendResetPassword:U61}},rateLimit:{enabled:!Dv$.disableRateLimit,window:60,max:1e4},plugins:L86,databaseHooks:{user:{create:{before:async($)=>{let Z=$.name;if(typeof Z==="string"&&Z.trim().length>0)return;let X=$v$($.email);if(!X)return;return{data:{...$,name:X}}},after:async($,Z)=>{X61({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified});let X=Z?.getCookie("studio_signup_ref")??null,Q=Z?.getCookie("studio_signup_src")??null;y1.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name,...X?{signup_ref:X}:{},...Q?{signup_src:Q}:{}}});let Y=Sw().autoCreateOrganizationOnSignup!==!1;try{let G=await WP0({db:l8().db,authApi:F8.api,user:{id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified},allowCreate:Y,createdVia:"signup"});if(G.status==="created")y1.groupIdentify({groupType:"organization",groupKey:G.organization.id,properties:{name:G.organization.name,slug:G.organization.slug,created_at:new Date().toISOString(),created_via:G.createdVia,email_domain:G.domain}}),y1.capture({distinctId:$.id,event:"organization_created",groups:{organization:G.organization.id},properties:{organization_id:G.organization.id,organization_slug:G.organization.slug,name:G.organization.name,created_via:G.createdVia,email_domain:G.domain}});if(G.status==="joined")y1.capture({distinctId:$.id,event:"organization_domain_joined",groups:{organization:G.organization.id},properties:{organization_id:G.organization.id,organization_slug:G.organization.slug,email_domain:G.domain,joined_via:G.createdVia}})}catch(G){y1.captureException(G,$.id),console.error("Failed to ensure organization on signup:",G)}}},update:{before:async($)=>{let Z=$.image;if(typeof Z==="string"&&Z.startsWith("data:")&&Z.length>j86)throw new Uv$("PAYLOAD_TOO_LARGE",{message:"Avatar image is too large. Upload an image smaller than 5MB."})}}},session:{create:{after:async($)=>{let Z=await l8().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!Z)return;X61({id:Z.id,email:Z.email,name:Z.name??null,emailVerified:!!Z.emailVerified})}}}}})});function L61($){return $?`/api/${$}`:""}function wv$($){let X=new URL($).pathname;if(X.endsWith("/"))X=X.slice(0,-1);let Q=(Y)=>{let G=new URL($);return G.pathname=Y,G.toString()};return[Q(`${X}/.well-known/oauth-protected-resource`),Q(`/.well-known/oauth-protected-resource${X}`),Q("/.well-known/oauth-protected-resource")]}function Ev$($){let X=new URL($).pathname;if(X.endsWith("/"))X=X.slice(0,-1);let Q=X!==""&&X!=="/",Y=(G)=>{let J=new URL($);return J.pathname=G,J.toString()};if(Q)return[Y(`/.well-known/oauth-authorization-server${X}`),Y(`/.well-known/openid-configuration${X}`),Y(`${X}/.well-known/openid-configuration`)];return[Y("/.well-known/oauth-authorization-server"),Y("/.well-known/openid-configuration")]}function jv$($){return"issuer"in $&&!("resource"in $)&&(("authorization_endpoint"in $)||("token_endpoint"in $))}function zv$($){let Z=$.toLowerCase();return Z.includes("resource_metadata=")||Z.includes("invalid_token")||Z.includes("oauth")}function Pv$($){let Z=$.message?.toLowerCase()??"";return $.status===401||$.code===401||($.message?.includes("401")??!1)||Z.includes("unauthorized")||Z.includes("invalid_token")||Z.includes("api key required")||Z.includes("api-key required")}function Av$($,{proxyResourceUrl:Z,proxyAuthServer:X}){return{...$,resource:Z,authorization_servers:[X]}}function w61({proxyResourceUrl:$,proxyAuthServer:Z,scopesSupported:X=["*"]}){return{resource:$,authorization_servers:[Z],bearer_methods_supported:["header"],scopes_supported:X}}function Tv$($){return"scopes_supported"in $&&Array.isArray($.scopes_supported)&&$.scopes_supported.length>0?$.scopes_supported:["*"]}function Rv$($,Z){return{...$,authorization_endpoint:$.authorization_endpoint?`${Z}/authorize`:void 0,token_endpoint:$.token_endpoint?`${Z}/token`:void 0,registration_endpoint:$.registration_endpoint?`${Z}/register`:void 0}}function Iv$({origin:$,prefix:Z,connectionId:X}){return`Bearer realm="mcp",resource_metadata="${$}${Z}/mcp/${X}/.well-known/oauth-protected-resource"`}var D61;var qv$=D(()=>{D61=[404,401,406]});import{oAuthProtectedResourceMetadata as P86}from"better-auth/plugins";async function A86($,Z,X){return(await Z.storage.connections.findById($,X))?.connection_url??null}async function Vv$($,Z={}){try{let X=await j61($,{method:"POST",headers:{...Z,"Content-Type":"application/json",Accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:0,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"mcp-cms-proxy",version:"1.0.0"}}})});if(X.status===401){let Q=X.headers.get("WWW-Authenticate");if(Q){if(zv$(Q))return Q}if(await T86($))return'Bearer realm="mcp"'}return null}catch{return null}}async function T86($){try{let Z=new URL($),X=new URL("/.well-known/oauth-authorization-server",Z.origin),Q=await j61(X.toString(),{method:"GET",headers:{Accept:"application/json"}});if(Q.ok){let Y=await Q.json();if(Y.authorization_endpoint||Y.token_endpoint||Y.issuer)return!0}return!1}catch{return!1}}async function ch($){let Z=wv$($),X;for(let Q=0;Q<Z.length;Q++){if(X=await bv$(Z[Q],{method:"GET",headers:{Accept:"application/json"}}),X.ok)return X;if(Q<Z.length-1&&!D61.includes(X.status))return X}return X}async function R86($){let Z;try{Z=new URL($).origin}catch{return null}try{let X=await ch($);if(X.ok){let Q=await X.json();if(Q.authorization_servers?.[0])return Q.authorization_servers[0]}}catch{}return Z}async function Sv$($){let Z=$.get("studioContext");if(!Z)Z=await WJ.create($.req.raw),$.set("studioContext",Z);return Z}async function Aa0({error:$,reqUrl:Z,connectionId:X,connectionUrl:Q,headers:Y,orgSlug:G}){if(!Pv$($))return null;if(Boolean(await Vv$(Q,Y)))return new Response(null,{status:401,headers:{"WWW-Authenticate":Iv$({origin:Z.origin,prefix:L61(G),connectionId:X})}});return new Response(JSON.stringify({error:"unauthorized",message:"Authentication required but server does not support OAuth"}),{status:401,headers:{"Content-Type":"application/json"}})}function Mv$($){let Q=$.pathname;if(Q.endsWith("/.well-known/oauth-protected-resource"))Q=Q.slice(0,-37)||"/";else if(Q.startsWith("/.well-known/oauth-protected-resource"))Q=Q.slice(37)||"/";return`${$.origin}${Q}`}async function kv$($,Z){let X=await P86(F8)($),Q=await X.json();if(Z)Q.resource=Z;return Response.json(Q,X)}function j61($,Z,X=fv$){return fetch($,{...Z,signal:AbortSignal.timeout(X)})}class E61{response;constructor($){this.response=$}}async function bv$($,Z,{attempts:X=3,timeoutMs:Q=fv$}={}){try{return await v5(async()=>{let Y=await j61($,Z,Q);if(Y.status>=500)throw new E61(Y);return Y},{maxAttempts:X,minTimeout:150,multiplier:2,jitter:0})}catch(Y){if(Y instanceof OY){if(Y.cause instanceof E61)return Y.cause.response;throw Y.cause}throw Y}}async function Xa($){if(Rd($))return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}});let Z=Ev$($),X=null;for(let Q of Z){if(X=await bv$(Q,{method:"GET",headers:{Accept:"application/json"}}),X.ok)return X;if(X.status!==404&&X.status!==401)return X}return X}var Cv$=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $},Za=async($)=>{let Z=$.req.param("connectionId"),X=await Sv$($),Q=Cv$(new URL($.req.url)),Y=$.req.param("org")??X.organization?.slug,G;if(Y)if(X.organization?.id&&X.organization.slug===Y)G=X.organization.id;else{let F=await X.db.selectFrom("organization").select("id").where("slug","=",Y).executeTakeFirst();if(!F)return $.json({error:"Connection not found"},404);G=F.id}if(G&&X.auth?.tokenOrganizationId&&X.auth.tokenOrganizationId!==G)return $.json({error:"forbidden: token is scoped to another organization"},403);if(Z==="self")return kv$($.req.raw,Mv$(Q));let J=await A86(Z,X,G);if(!J)return $.json({error:"Connection not found"},404);if(J.startsWith("virtual://"))return kv$($.req.raw,Mv$(Q));let W=L61(Y),K=`${Q.origin}${W}/mcp/${Z}`,H=`${Q.origin}/oauth-proxy/${Z}`;try{let F=await ch(J);if(!F.ok&&D61.includes(F.status)){if(await Vv$(J)){let B=w61({proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(B),{status:200,headers:{"Content-Type":"application/json"}})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}if(!F.ok)return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}});let N=await F.json();if(jv$(N)){let O=w61({proxyResourceUrl:K,proxyAuthServer:H,scopesSupported:Tv$(N)});return new Response(JSON.stringify(O),{status:200,headers:{"Content-Type":"application/json"}})}let U=Av$(N,{proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(U),{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}catch(F){let N=F;return console.error("[oauth-proxy] Failed to proxy OAuth protected resource metadata:",N),$.json({error:"Failed to proxy OAuth metadata",message:N.message},502)}},_v$=()=>{let $=new F1;return $.get("/.well-known/oauth-protected-resource/mcp/:connectionId",(Z)=>Za(Z)),$.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>Za(Z)),$},vv$=()=>{let $=new F1;return $.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>Za(Z)),$},fv$=4000,I86=async($)=>{let Z=$.req.param("connectionId"),X=await Sv$($),Q=await X.storage.connections.findById(Z);if(!Q?.connection_url)return $.json({error:"Connection not found or no auth server"},404);let Y=await R86(Q.connection_url);if(!Y)return $.json({error:"Connection not found or no auth server"},404);let G=await X.db.selectFrom("organization").select("slug").where("id","=",Q.organization_id).executeTakeFirst();try{let J=await Xa(Y);if(!J.ok)return new Response(J.body,{status:J.status,statusText:J.statusText,headers:{"Content-Type":"application/json"}});let W=await J.json(),K=Cv$(new URL($.req.url)),H=G?.slug?`${K.origin}/api/${G.slug}/oauth-proxy/${Z}`:`${K.origin}/oauth-proxy/${Z}`,F=Rv$(W,H);return new Response(JSON.stringify(F),{status:200,headers:{"Content-Type":"application/json"}})}catch(J){let W=J;return console.error("[oauth-proxy] Failed to proxy auth server metadata:",W),$.json({error:"Failed to proxy auth server metadata",message:W.message},502)}},xv$=()=>{let $=new F1;return $.get("/.well-known/oauth-authorization-server/oauth-proxy/:connectionId",I86),$};var Et=D(()=>{D8();_B();gY();w4();Kb();qv$()});async function lh($){try{let Z;try{let Q=await ch($);if(Q.ok)Z=(await Q.json()).authorization_servers?.[0]}catch{}if(!Z)Z=new URL($).origin;let X=await Xa(Z);if(X.ok){let Q=await X.json();if(typeof Q.token_endpoint==="string")try{let Y=new URL(Q.token_endpoint);if(Y.protocol==="http:"||Y.protocol==="https:")return Q.token_endpoint}catch{}}return null}catch{return null}}var NP0=D(()=>{Et()});function gh($){return!!$.refreshToken&&!!$.tokenEndpoint&&!!$.clientId}function q86($,Z){if($.includes("/oauth-proxy/"))return!0;try{return new URL($).host!==new URL(Z).host}catch{return!1}}async function V86($,Z){let X=await cd1($);if(!X.success||!X.accessToken){if(X.permanent===!0)await Z.delete($.connectionId).catch((Q)=>{console.warn("[TokenRefresh] failed to delete dead token row",{connectionId:$.connectionId,message:Q instanceof Error?Q.message:String(Q)})});return{accessToken:null,permanent:X.permanent===!0}}try{await Z.upsert({connectionId:$.connectionId,accessToken:X.accessToken,refreshToken:X.refreshToken??$.refreshToken,scope:X.scope??$.scope,expiresAt:X.expiresIn===void 0?null:new Date(Date.now()+X.expiresIn*1000),clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint})}catch(Q){return console.warn("[TokenRefresh] failed to persist refreshed token",{connectionId:$.connectionId,message:Q instanceof Error?Q.message:String(Q)}),{accessToken:null,permanent:!1}}return{accessToken:X.accessToken,permanent:!1}}function XP0($,Z){let X=z61.get($.connectionId);if(X)return X;let Q=UP0.get($.connectionId);if(Q&&Date.now()<Q.nextAttemptAt)return Promise.resolve(null);let Y=V86($,Z).then(({accessToken:G,permanent:J})=>{if(G||J)UP0.delete($.connectionId);else{let W=UP0.get($.connectionId)?.attempt??0,K=oZ(k86,M86,W,2,0.5);UP0.set($.connectionId,{attempt:W+1,nextAttemptAt:Date.now()+K})}return G}).finally(()=>{z61.delete($.connectionId)});return z61.set($.connectionId,Y),Y}async function mY($){let{connectionId:Z,connectionUrl:X,tokenStorage:Q,force:Y}=$,G=await Q.get(Z);if(!G)return{state:"missing",accessToken:null};let J=gh(G),W=J?$.bufferMs??fp:0,K=Q.isExpired(G,W);if(!Y&&!K)return{state:"valid",accessToken:G.accessToken};if(!J){if(K)await Q.delete(Z);return{state:"expired_without_refresh",accessToken:null}}let H=G.tokenEndpoint;if(X&&H&&q86(H,X)){let N=await lh(X);if(N)H=N}let F=await XP0({...G,tokenEndpoint:H},Q);if(!F)return{state:"refresh_failed",accessToken:null};return{state:"refreshed",accessToken:F}}var fp=300000,F6$=3300000,Y9="GitHub token refresh failed \u2014 reconnect the mcp-github integration.",z61,M86=30000,k86=300000,UP0;var oG=D(()=>{w4();ld1();NP0();z61=new Map,UP0=new Map});import{SpanStatusCode as yv$}from"@opentelemetry/api";function P61($){if(Array.isArray($))return $.map(P61);if($&&typeof $==="object"){let{__binding:Z,...X}=$,Q={};for(let[Y,G]of Object.entries(X))Q[Y]=P61(G);return Q}return $}async function A61($,Z,X){return Z.tracer.startActiveSpan("studio.connection.build_headers",{attributes:{"connection.id":$.id}},async(Q)=>{try{let Y=await S86($,Z,X);return Q.setStatus({code:yv$.OK}),Y}catch(Y){throw Q.setStatus({code:yv$.ERROR,message:Y.message}),Q.recordException(Y),Y}finally{Q.end()}})}async function S86($,Z,X){let Q=$.id,Y=xh0($.configuration_state,$.configuration_scopes),G=Z.auth.user,J=G?.id??Z.auth.apiKey?.userId??(X?$.created_by:void 0),[W,K]=J?await sS1({sub:J,user:{id:J,email:G?.email,name:G?.name,role:G?.role},metadata:{state:$.configuration_state?P61($.configuration_state):void 0,studioUrl:Z.baseUrl,meshUrl:Z.baseUrl,connectionId:Q,organizationId:Z.organization?.id,organizationName:Z.organization?.name,organizationSlug:Z.organization?.slug},permissions:Y}).then((B)=>[B,null]).catch((B)=>[null,B]):[null,Error("User ID required to issue configuration token")];if(K)console.error("Failed to issue configuration token:",K);let H=Z.auth.user?.connectionId,F={...H?{"x-caller-id":H}:{},...Z.metadata.wellKnownForwardableHeaders??{},"x-request-id":Z.metadata.requestId};if(Z.metadata.runMetadata&&Object.keys(Z.metadata.runMetadata).length>0)vh0(F,"runMetadata",JSON.stringify(Z.metadata.runMetadata));let N=null;if(!!q5($)?.sourceConnectionId)try{N=await Cp(Z,$)}catch(B){console.error("[Proxy] repo-scoped legacy token mint failed",{connectionId:Q,error:B.message})}else{let B=new l6(Z.db,Z.vault),L=await mY({connectionId:Q,connectionUrl:$.connection_url,tokenStorage:B});if(L.accessToken)N=L.accessToken;else if(L.state==="expired_without_refresh")console.warn(`[Proxy] Token expired for ${Q} with no refresh capability`)}if(!N&&$.connection_token)N=$.connection_token;if(N)F.Authorization=`Bearer ${N}`;if(W)vh0(F,"token",W);return F}var gv$=D(()=>{yh0();PU();oG();dG();vp();VQ();fh0()});function OP0(){let $=new Map;function Z(Q,Y){let G=$.get(Y);if(G)return G;let J=(async()=>{let W=await Q(),K=new y9({name:`outbound-client-${Y}`,version:"1.0.0"},{capabilities:{tasks:{list:{},cancel:{},requests:{tool:{call:{}}}}},jsonSchemaValidator:F5});return K.onclose=()=>{$.delete(Y)},await K.connect(W),K})().catch((W)=>{throw $.delete(Y),W});return $.set(Y,J),J}return Object.assign(Z,{[Symbol.asyncDispose]:async()=>{let Q=[];for(let[Y,G]of $)Q.push(G.then((J)=>J.close()).catch(()=>{}));await Promise.all(Q),$.clear()}})}var T61=D(()=>{lW();yX()});function hv$($){let Z=new Mi({command:$.command,args:$.args,env:$.env,cwd:$.cwd,stderr:"pipe"}),X=$.name||$.id,Q="\x1B[2m",Y="\x1B[0m";return Z.stderr?.on("data",(G)=>{let J=G.toString().trimEnd();if(J)console.error(`${J} \x1B[2m[${X}]\x1B[0m`)}),Z}var uv$=D(()=>{Oc0()});var dh;var cv$=D(()=>{xY();Mw();yX();dh=class dh extends mf{options;constructor($,Z){super($);this.options=Z}toolsListPromise=null;fetchToolsFromServer(){if(!this.toolsListPromise)this.toolsListPromise=new Promise(($)=>{let Z=`auth-tools-${Date.now()}`,X=this.innerTransport.onmessage,Q=(G)=>{clearTimeout(Y),this.innerTransport.onmessage=X,this.toolsListPromise=null,$(G)},Y=setTimeout(()=>Q(null),f40);this.innerTransport.onmessage=(G)=>{if("id"in G&&G.id===Z)if("result"in G){let J=G.result?.tools??null;Q(J)}else Q(null);else X?.(G)},this.innerTransport.send({jsonrpc:"2.0",id:Z,method:"tools/list",params:{}}).catch(()=>Q(null))});return this.toolsListPromise}async ensureToolsMap(){let $=this.options.cache??Z9(),Z=await vO("tools",this.options.connection.id,async()=>{let X=await this.fetchToolsFromServer();if(X===null)throw Error("Failed to fetch tools list");return X},$,(X)=>this.options.ctx.pendingRevalidations.push(X),_O);if(!Z)return new Map;return new Map(Z.map((X)=>[X.name,X]))}async handleOutgoingMessage($){if(!this.isRequest($))return this.innerTransport.send($);let Z=$;if(Z.method==="tools/call")await this.authorizeToolCall(Z),this.stripMetaFromArguments(Z);return this.innerTransport.send($)}async authorizeToolCall($){if(this.options.superUser)return;let X=$.params.name,{ctx:Q,connection:Y}=this.options;if(await this.isPublicTool(X))return;if(!Q.auth.user?.id&&!Q.auth.apiKey?.id)throw Error("Authentication required. Please provide a valid OAuth token or API key.");let G=async()=>{return(await this.ensureToolsMap()).get(X)?._meta};await new qw(Q.auth.user?.id??Q.auth.apiKey?.userId,X,Q.boundAuth,Q.organization?.role??Q.auth.user?.role,Y.id,G,Q.organization?.id).check(X)}async isPublicTool($){if($.startsWith("STUDIO_PUBLIC_")||$.startsWith("MESH_PUBLIC_"))return!0;let X=(await this.ensureToolsMap()).get($);if(!X?._meta)return!1;return sW(X._meta)?.public_tool===!0}stripMetaFromArguments($){let Z=$.params;if(Z.arguments&&"_meta"in Z.arguments){let{_meta:X,...Q}=Z.arguments;Z.arguments=Q}}}});function R61($){let{ctx:Z,organizationId:X,connectionId:Q,toolName:Y,durationMs:G,isError:J}=$;if(!X||!Q||!Y)return;let W={"tool.name":Y,"organization.id":X,"connection.id":Q,status:J?"error":"success","error.type":J?$.errorType||"Error":""};Z.meter.createHistogram("tool.execution.duration",{description:"Duration of tool executions in milliseconds",unit:"ms"}).record(G,W),Z.meter.createCounter("tool.execution.count",{description:"Number of tool executions"}).add(1,W)}import{trace as v3Z,context as f3Z}from"@opentelemetry/api";function lv$($){if(!$.isError)return;let Z=$.content;if(!Array.isArray(Z))return;for(let X of Z)if(X&&typeof X==="object"&&"type"in X&&X.type==="text"&&"text"in X&&typeof X.text==="string")return X.text;return}function dv$($){if(!$)return;let Z=$._meta;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let X=Z.properties;if(!X||typeof X!=="object"||Array.isArray(X))return;let Q={};for(let[Y,G]of Object.entries(X))if(typeof G==="string")Q[Y]=G;return Object.keys(Q).length>0?Q:void 0}function mv$($,Z){if(!$&&!Z)return;if(!$)return Z;if(!Z)return $;return{...Z,...$}}var iv$=D(()=>{$L0();BY()});import{trace as C86,context as pv$}from"@opentelemetry/api";var mh;var nv$=D(()=>{yX();$L0();iv$();mh=class mh extends mf{options;inflightRequests=new Map;requestContext;constructor($,Z){super($);this.options=Z;this.requestContext=pv$.active()}async handleOutgoingMessage($){if(this.isRequest($)){let Z=$;this.onRequestStart(Z)}return this.innerTransport.send($)}handleIncomingMessage($){if(this.isResponse($)){let Z=$;this.onResponseEnd(Z)}this.onmessage?.($)}onRequestStart($){let{ctx:Z,connectionId:X}=this.options,Q,Y;if($.method==="tools/call"&&$.params){let J=$.params;Q=J.name,Y=J.arguments}let G;if($.method==="tools/call"&&Q)G=Z.tracer.startSpan("mcp.proxy.callTool",{attributes:{"connection.id":X,"tool.name":Q,"request.id":Z.metadata.requestId,"jsonrpc.id":$.id,"jsonrpc.method":$.method}},this.requestContext);if($.id!==null&&$.id!==void 0)this.inflightRequests.set($.id,{startTime:Date.now(),method:$.method,toolName:Q,toolArguments:Y,span:G})}onResponseEnd($){if($.id===null||$.id===void 0)return;let Z=this.inflightRequests.get($.id);if(!Z)return;let{ctx:X,connectionId:Q}=this.options,{startTime:Y,method:G,toolName:J,toolArguments:W,span:K}=Z,H=Date.now()-Y;if(this.inflightRequests.delete($.id),G!=="tools/call"||!J)return;let F=X.organization?.id??"",N="error"in $,U=N?$.error:$.result,O=N?{content:[{type:"text",text:$.error?.message||"Unknown error"}],isError:!0}:U,B=N||O?.isError===!0,L=N?$.error?.message:void 0,w=lv$(O)||null;if(X.meter.createHistogram("connection.proxy.duration").record(H,{"connection.id":Q,"organization.id":F,"tool.name":J,status:B?"error":"success"}),B)X.meter.createCounter("connection.proxy.errors").add(1,{"connection.id":Q,"organization.id":F,"tool.name":J,error:L??w??void 0});else X.meter.createCounter("connection.proxy.requests").add(1,{"connection.id":Q,"organization.id":F,"tool.name":J,status:"success"});if(F)R61({ctx:X,organizationId:F,connectionId:Q,toolName:J,durationMs:H,isError:B,errorType:N?"RemoteError":B?"ToolError":""});if(K){if(B)K.recordException(Error(L??w??"Tool error"));let E=dv$(W),j=mv$(X.metadata.properties,E),z=C86.setSpan(pv$.active(),K);Qt({organizationId:X.organization?.id??"",connectionId:Q,toolName:J,toolArguments:W,result:O,duration:H,isError:B,errorMessage:w,userId:X.auth.user?.id||X.auth.apiKey?.userId||null,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent||null,virtualMcpId:this.options.virtualMcpId||null,properties:j||null},z),K.end()}}async close(){for(let $ of this.inflightRequests.values())if($.span)$.span.setAttributes({"transport.closed":!0}),$.span.end();return this.inflightRequests.clear(),super.close()}}});var tv$=D(()=>{yX();cv$();nv$()});async function ov$($,Z,X=!1){let Q=$.id,Y=Z.connectionId&&Z.connectionId!==Q?Z.connectionId:void 0;switch($.connection_type){case"STDIO":{if(!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let G=$.connection_headers;if(!bW(G))throw Error("STDIO connection missing parameters");let J=hv$({id:Q,name:$.title,command:G.command,args:G.args,env:G.envVars,cwd:G.cwd});return J=pf(J,(W)=>new dh(W,{ctx:Z,connection:$,superUser:X}),(W)=>new mh(W,{ctx:Z,connectionId:Q,virtualMcpId:Y})),_86(()=>J,Q)}case"HTTP":case"Websocket":{if(!$.connection_url)throw Error(`${$.connection_type} connection missing URL`);let G=$.connection_url;return Z.getOrCreateClient(async()=>{let J=await A61($,Z,X),W=$.connection_headers;if(W&&"headers"in W)Object.assign(J,W.headers);let K=new mW(new URL(G),{requestInit:{headers:J}});return K=pf(K,(H)=>new dh(H,{ctx:Z,connection:$,superUser:X}),(H)=>new mh(H,{ctx:Z,connectionId:Q,virtualMcpId:Y})),K},Q)}case"SSE":{if(!$.connection_url)throw Error("SSE connection missing URL");let G=$.connection_url;return Z.getOrCreateClient(async()=>{let J=await A61($,Z,X),W=$.connection_headers;if(W&&"headers"in W)Object.assign(J,W.headers);let K=new QF(new URL(G),{requestInit:{headers:J}});return K=pf(K,(H)=>new dh(H,{ctx:Z,connection:$,superUser:X}),(H)=>new mh(H,{ctx:Z,connectionId:Q,virtualMcpId:Y})),K},Q)}default:throw Error(`Unknown connection type: ${$.connection_type}`)}}var _86;var rv$=D(()=>{q$();yW();Ad();ef();gv$();T61();uv$();tv$();_86=OP0()});var N6$={};J4(N6$,{clientFromConnection:()=>N5});async function N5($,Z,X=!1){if($.connection_type==="VIRTUAL")return KW$($,Z,X);return ov$($,Z,X)}var xi=D(()=>{rv$();fy()});function I61($){if($===null)return"null";if(Array.isArray($))return"array";return typeof $}function v86($,Z){if(Z==="integer")return typeof $==="number"&&Number.isInteger($);return I61($)===Z}function f86($,Z){if(Z==="object"||Z==="array"){let X;try{X=JSON.parse($)}catch{return}return I61(X)===Z?X:void 0}if(Z==="boolean"){if($==="true")return!0;if($==="false")return!1;return}if(Z==="number"||Z==="integer"){if($.trim()==="")return;let X=Number($);if(!Number.isFinite(X))return;if(Z==="integer"&&!Number.isInteger(X))return;return X}return}function av$($,Z){if(!$?.properties||!Z)return null;let X=!1,Q={...Z};for(let[Y,G]of Object.entries(Z)){if(typeof G!=="string")continue;let J=$.properties[Y]?.type;if(!J||J==="string")continue;let W=f86(G,J);if(W===void 0)continue;Q[Y]=W,X=!0}return X?Q:null}function q61($,Z,X){let Q=Object.keys(X??{}),Y=Z?.required??[],G=Y.filter((H)=>!Q.includes(H)),J=(H)=>{let F=Z?.properties?.[H]?.type;return F?`${H} (${F})`:H},W=Q.filter((H)=>{let F=Z?.properties?.[H]?.type;return F!=null&&!v86(X?.[H],F)}).map((H)=>`${H} (expected ${Z?.properties?.[H]?.type}, got ${I61(X?.[H])})`);return[`Invalid arguments for "${$}".`,Y.length?`Required: ${Y.map(J).join(", ")}.`:"",`You sent: ${Q.length?Q.join(", "):"(none)"}.`,G.length?`Missing required: ${G.join(", ")}.`:"",W.length?`Wrong type: ${W.join(", ")}.`:""].filter(Boolean).join(" ")}function sv$($,Z,X,Q){if(!($ instanceof L1)||$.code!==q1.InvalidParams)return $;if(!Z)return $;let Y=q61(Z,X,Q),G=$.message.replace(/^MCP error -?\d+: /,"");return new L1(q1.InvalidParams,`${G}
 
 ${Y}`,$.data)}function BP0($){let Z=$;if(!Z||Z.isError!==!0||!Array.isArray(Z.content))return null;let X=Z.content.map((Q)=>Q?.type==="text"?Q.text:null).filter((Q)=>typeof Q==="string").join(`
 `);return/MCP error -32602|Input validation error/.test(X)?X:null}function ev$($,Z){let X=$;return{...X,content:(X.content??[]).map((Q,Y)=>Y===0&&Q?.type==="text"?{...Q,text:`${Q.text}
@@ -2861,7 +2861,7 @@ Respond with the structured verdict and a short reason.`,xh$;var gh$=D(()=>{B4()
 ${G.join(`
 `)}`:Y}function WK6($){let Z=new Set;for(let X of $)for(let Q of X.split(`
 `)){let Y=Q.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var Au$=200,sW6=12,$K6,XK6=300,AZ1=3;var TZ1=D(()=>{m_();CA0();$K6={aheadBy:0,behindBy:0,files:[]}});function HK6($){if(!$||$.includes(".."))return!1;return KK6.test($)}function Ru$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!HK6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Iu$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var KK6;var qu$=D(()=>{KK6=/^[\w./@-]+$/});function RZ1($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function da($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Mu$($,Z,X,Q){if(!Q.connectionId)throw new p_("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new p_(Y9);await XB({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(F)=>{let N=F instanceof Error?F.message:Y9;throw new p_(N)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await QB(Q.connectionId,Q.owner,Q.name,$.db,$.vault).catch((F)=>{let{code:N,message:U}=U6$(F instanceof Error?F.message:String(F));throw N?new p_(U):F}),K=Bu($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let F=await jB(H,FK6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${F}`)}}var FK6=10485760,p_;var IZ1=D(()=>{oG();jA0();Un();vm0();Jy();p_=class p_ extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function UK6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!NK6.test(Z))throw Error(`Invalid branch name: ${$}`)}function n_($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(BK6)])}async function LK6($,Z){let X=$.var.studioContext,Q=b3(Z.branch),Y=$.req.query("thread")??Q,G=Y&&Y===Q?Z.branchThread:Y?await X.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=aS(J?.metadata?.runtime);if(W)return W;let K=PB0(Z.virtualMcpMetadata),H=K==="cms"?await XZ1(X,{claimName:Z.claimName,userId:Z.sandboxUserId,branch:Z.branch,virtualMcpMetadata:Z.virtualMcpMetadata}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",N=!!J&&(H==="gone"||H==="alive"&&K==="cms");if(N&&J)On(X,J.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:H,resolved:F,stamped:N});return F}async function wK6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{let{provider:X}=await gZ($.var.studioContext,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:Z.virtualMcpMetadata});return X}catch{return null}}function t_($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function zu($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=da(Z,X);if(!Y)throw new u4(404,"AUTH","repo","Project has no GitHub repository");let G=t(Q);return PA0(Q,G.id,Y)}function qZ1($,Z){if(Z instanceof zA0)return $.json({error:Z.message},429,{...z5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,z5)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,z5)}async function Su$($,Z,X){let Q;try{Q=await fetch(Z,X)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await Q.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}async function Cu$($){try{let Z=await zu($),X=await _A0(Z,$.get("vmClaim").branch);return $.json(X,200,z5)}catch(Z){return qZ1($,Z)}}function ma($,Z){let Q=(bA0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return bA0.set($,Y),Y.finally(()=>{if(bA0.get($)===Y)bA0.delete($)}),Q}async function pZ($,Z,X){if(!X?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,z5);let Q=X?.runner??t_($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=X?.signal,N={method:W,headers:H,body:K,...F?{signal:F}:{}},U=async()=>{let O=await Q.proxyDaemonRequest(Y,Z,N);if(X?.map404to410&&O.status===404){try{await O.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))O=await Q.proxyDaemonRequest(Y,Z,N);if(O.status===404){try{await O.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...z5}})}}let B=await O.text(),L=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?EK6(B):B,w=O.headers.get("content-type")??"application/json";return new Response(L,{status:O.status,headers:{"content-type":w,...z5}})};try{if(F){let O=U();return O.catch(()=>{}),await Promise.race([O,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await U()}catch(O){let B=O instanceof Error?O.message:String(O);return $.json({error:`Daemon unreachable: ${B}`},502)}}function EK6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function xA0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function jK6($){return _u$.includes($)}var NK6,ku$=524288,OK6=65536,BK6=1e4,Vu$=2000,DK6,bA0,z5,_u$,vu$=()=>{let $=new F1;$.use("/:virtualMcpId/:branch/*",DK6),$.post("/:virtualMcpId/:branch/write",(X)=>pZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>pZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>pZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>pZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>pZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>pZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>pZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:n_(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return pZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return pZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>pZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>pZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!jK6(Q))return X.json({error:`step must be one of: ${_u$.join(", ")}`},400);let Y=X.get("vmClaim"),G=await XZ1(X.var.studioContext,{claimName:Y.claimName,userId:Y.userId,branch:Y.branch,virtualMcpMetadata:Y.virtualMcpMetadata})==="gone"?null:await wK6(X);if(!G)return X.json({error:"sandbox not found: nothing is running at this ref"},404,z5);if(Q==="start"){let J=t(X.var.studioContext),W=Ry(Y.virtualMcpMetadata);try{await wB0({ctx:X.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return X.json({error:`Failed to push env to daemon: ${H}`},502)}}return pZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return kN(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Sh$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Cu$(X);return Z(X)});let Z=(X)=>pZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Vu$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Cu$(X);return pZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Vu$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")try{let Y=await X.req.json().catch(()=>({})),G=await zu(X),J=await vA0(G,Q.branch,Y.base);return X.json(J,200,z5)}catch(Y){return qZ1(X,Y)}return pZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").runtime==="cms")return X.json({ok:!0},200,z5);let Q=t_(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),W=X.var.studioContext;return ma(Y,async()=>{try{await QZ1(W,Q,Y);let K=da(G,J);if(K)await Mu$(W,Q,Y,K)}catch(K){if(K instanceof p_)return X.json({error:K.message},403,z5);let H=K instanceof Error?K.message:String(K);return X.json({error:H},502,z5)}return pZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return ma(Q.claimName,async()=>{let Y=await X.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return X.json({error:"filepaths is required"},400,z5);try{let J=await zu(X);return await Tu$(J,Q.branch,G),X.json({ok:!0},200,z5)}catch(J){let W=J instanceof u4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return X.json({error:K},W,z5)}});return ma(Q.claimName,()=>pZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return ma(Q.claimName,async()=>{try{let W=await X.req.json().catch(()=>({})),K=await zu(X),H=W.base??await K.getDefaultBranch();return await fA0(K,Q.branch,H),X.json({ok:!0},200,z5)}catch(W){return qZ1(X,W)}});let Y=t_(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return ma(G,async()=>{try{await QZ1(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:K},502,z5)}return pZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",V9({maxSize:ku$,onError:(X)=>X.json({error:"Payload too large"},413,z5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let H=t_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),F=H.status,N=H.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=JZ1(F)&&U?[F,N]:Y?await Promise.all([xA0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),xA0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await zu(X);return Promise.all([_A0(w,Q.branch),vA0(w,Q.branch)])})(),L=await bh$(K,O,B);return X.json(L,200,z5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,z5);return X.json({error:F},502,z5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",V9({maxSize:ku$,onError:(X)=>X.json({error:"Payload too large"},413,z5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let H=t_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),F=H.status,N=H.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=JZ1(F)&&U?[F,N]:Y?await Promise.all([xA0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),xA0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await zu(X);return Promise.all([_A0(w,Q.branch),vA0(w,Q.branch)])})(),L=await yh$(K,O,B,typeof H.language==="string"?H.language:void 0);return X.json(L,200,z5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,z5);return X.json({error:F},502,z5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=t_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,""),K=RZ1(`${W}${G}`);return Su$(X,K?.url??`${W}${G}`,{...K?{headers:{host:K.hostHeader}}:{}})}),$.post("/:virtualMcpId/:branch/preview-invoke",V9({maxSize:OK6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=t_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let W=Ru$(J);if(!W)return X.json({error:"Invalid or missing __resolveType"},400);let K=Iu$(G,W.resolveType),H=RZ1(K);return Su$(X,H?.url??K,{method:"POST",headers:{"content-type":"application/json",...H?{host:H.hostHeader}:{}},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var fu$=D(()=>{D8();jN();Ou();ZZ1();kF();Mh$();x3();Iy();kh$();xF();Vh$();Ch$();Qn0();Fn();HZ1();gh$();BZ1();m_();TZ1();qu$();IZ1();NK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;DK6=EA0(async($,Z)=>{let X=$.var.studioContext;try{r(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=Y1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=t(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{UK6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Mp({orgId:Y.id,virtualMcpId:G,branch:J}),H=await sp0(X,J),F=ep0(H,Q),N=qh$({userId:F,projectRef:K}),U=W.metadata??null,O=await LK6($,{claimName:N,branch:J,virtualMcpId:G,sandboxUserId:F,virtualMcpMetadata:U,branchThread:H});if(O==="cms")return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:O}),Z();let B;try{B=(await gZ(X,{userId:F,branch:J,virtualMcpMetadata:U})).provider}catch{B=null}if(!B)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:B,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:O}),Z()});bA0=new Map;z5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};_u$=["clone","install","start"]});function bu$($,Z,X){let Q=MZ1.get($);if(!Q)Q={pending:null,running:!1},MZ1.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,W]of Object.entries(X.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!Q.running)PK6($,Q);return G}async function PK6($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await AK6(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)MZ1.delete($)}}async function AK6($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await ju(Z,X),J=await Z.getCommitTreeSha(G),W=await Z.getTreeRecursive(J),K=zZ1(W,Q),H=[],F=new Map(K.map((B)=>[B.path,{stem:B.stem,sha:B.sha}]));for(let[B,L]of $.set){let w=PZ1(K,B),E=`${JSON.stringify(L,null,2)}
-`,j=await Z.createBlob(E);await ju$(Z.owner,Z.repo,j,E);let z=w[0]??`${SA0(Q)}/${DZ1(B)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);F.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),F.delete(P)}for(let B of $.del)for(let L of PZ1(K,B))H.push({path:L,mode:"100644",type:"blob",sha:null}),F.delete(L);if(H.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...F.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=ha(B);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);H.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:TK6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof u4&&B.status===422)||Y>=zK6-1)throw B;await D$(oZ(2000,200,Y,2,0.5))}}}function TK6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return Rm0(Q,$.deps.coAuthor)}var zK6=3,MZ1;var xu$=D(()=>{HB0();TA0();w4();m_();CA0();MZ1=new Map});import{createHmac as yu$,randomBytes as RK6,timingSafeEqual as IK6}from"crypto";function gu$(){if(yA0)return yA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return yA0=$?Buffer.from($):RK6(32),yA0}function kZ1($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+qK6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=yu$("sha256",gu$()).update(Q).digest("base64url");return`${Q}.${Y}`}function hu$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(yu$("sha256",gu$()).update(Q).digest("base64url"));if(Y.length!==G.length||!IK6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var qK6=21600000,yA0=null;var uu$=D(()=>{q$()});import{z as Pu}from"zod";function kK6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&MK6.test($)}function lu$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function ia($){let Z=$.get("decofileScope");return PA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function pa($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function du$(){let $=new F1;return $.use("/:virtualMcpId/:branch",cu$),$.use("/:virtualMcpId/:branch/*",cu$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await zu$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=kZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(lu$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return pa(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await ia(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return pa(Z,Y)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=VK6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{AA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await ia(Z),W=await bu$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Bu(Q)},G),K=kZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:lu$(Z)})}catch(J){return pa(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof u4&&W.status===409))throw W;await fA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return pa(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return pa(Z,Q)}}),$}var MK6,VK6,cu$;var mu$=D(()=>{TA0();D8();ZZ1();jA0();IZ1();BZ1();xu$();uu$();TZ1();m_();CA0();MK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;VK6=Pu.object({set:Pu.record(Pu.string(),Pu.unknown()).optional(),delete:Pu.array(Pu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),cu$=EA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!kK6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!hu$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!zB0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((O)=>O.connection_id)??[],N=da(K,F);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var iu$=($)=>{let Z=new F1;if(Z.use("*",b_),Z.route("/",bP0()),Z.route("/",Wx$()),Z.route("/",Oh$()),Z.route("/",Fh$()),Z.route("/",DA0()),Z.route("/tools",zh$()),Z.route("/",wh$()),Z.route("/",dg$({kvStorage:$.kvStorage})),Z.route("/",cg$()),Z.route("/fs",Qh$({getConnection:$.getNatsConnection})),Z.route("/sandbox",vu$()),Z.route("/decofile",du$()),Z.route("/",Wh$()),Z.route("/deco-sites",yP0()),Z.route("/sso",VP0()),Z.route("/",LA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",eb$()),$.mountDevAssets)Z.route("/dev-assets",gP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",vv$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Gh$()),Z.route("/mcp",cL0()),Z.route("/mcp/self",BA0()),Z.route("/mcp",mL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var pu$=D(()=>{D8();T51();$x$();M51();hP0();Na();P51();lg$();mg$();Yh$();Et();O51();iL0();t91();Jh$();Kh$();Nh$();Bh$();Eh$();r91();Ph$();a91();lL0();fu$();mu$()});function SK6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var CK6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},nu$=()=>{let $=new F1;return $.use("*",CK6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await iZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:SK6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var tu$=D(()=>{D8();q$();bz0()});import{z as M1}from"zod";function HH($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function cK6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function lK6($,Z,X){try{return JSON.parse($)}catch{throw new au$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function dK6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:lK6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function mK6($){let Z=$.map((X)=>{let Q=X.function.parameters?lY(X.function.parameters):lY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function iK6($){if(!$)return;return{openai:{response_format:$}}}function pK6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ou$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function ru$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var _K6=256,vK6,fK6,bK6,xK6,yK6,gK6,hK6,uK6,au$,su$,eu$;var $c$=D(()=>{B4();D8();Ou();WN();vK6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),fK6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),bK6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(fK6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),xK6=M1.object({type:M1.literal("text")}),yK6=M1.object({type:M1.literal("json_object")}),gK6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),hK6=M1.union([xK6,yK6,gK6]),uK6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(bK6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(vK6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:hK6.optional(),user:M1.string().optional()});au$=class au$ extends Error{constructor($){super($);this.name="MessageConversionError"}};su$=new F1;su$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(HH("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(HH("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(HH("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=uK6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(HH(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=cK6(G.model);if(!J)return $.json(HH("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>hL(j.providerId));if(!E)return $.json(HH("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(HH(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),N=dK6(G.messages),U=G.tools?mK6(G.tools):void 0,O=iK6(G.response_format),B=pK6(),L=Math.floor(Date.now()/1000);if(G.stream)return kN($,async(w)=>{let E=ou$(F,N,U,G,O,$.req.raw.signal);try{let j=$B(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=_K6)await I()}else if(q.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ru$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ou$(F,N,U,G,O,$.req.raw.signal),E=await sO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ru$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(HH("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(HH(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(HH(Y.message,"server_error"),500)}});eu$=su$});function nK6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function Zc$(){let $=new F1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=Y1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!mG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let H of J){if(!H.slug||H7(H))continue;let F=await X.storage.virtualMcps.list(H.id);for(let N of F){if($s1(N)!==G)continue;if(!nK6(N.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Xc$=D(()=>{D8();hO()});var Yc$;var Qc$=D(()=>{Yc$={name:"decocms",version:"4.263.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function rK6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??oK6}}var Gc$,oK6="https://ph.studio.decocms.com",Jc$;var Wc$=D(()=>{D8();$u0();MC();L9();q$();K51();Qc$();Gc$=new F1;Gc$.get("/",($)=>{let Z={version:Yc$.version,theme:qm1(),...Sw().logo&&{logo:Sw().logo},...fK()&&{internalUrl:QC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:wb$(),posthog:rK6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!fK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Jc$=Gc$});function Au($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function VZ1($){return(Au($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Hc$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Au($))}&sz=${Z}`}function Kc$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Fc$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Kc$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Kc$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var o_,aK6,sK6,eK6,$H6,Nc$;var Uc$=D(()=>{o_=l0.enum(["good","bad","neutral"]),aK6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:o_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),sK6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(aK6)),eK6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$H6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:o_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:o_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:o_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:o_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(sK6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:o_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:o_.optional()})).min(1)})]),Nc$=l0.object({...eK6,template:$H6})});function gA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Nc$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var SZ1=D(()=>{Uc$()});import{join as Oc$}from"path";async function XH6($){try{let Z=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(ZH6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=gA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||VZ1($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function FG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function QH6($,Z){let X=Au($),Q=Z?.brand?.trim()||VZ1(X),Y=Hc$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Fc$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Q} commerce report by decocms`;return[`<title>${FG(W)}</title>`,`<meta name="description" content="${FG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${FG(W)}" />`,`<meta property="og:description" content="${FG(K)}" />`,`<meta property="og:url" content="${FG(J)}" />`,`<meta property="og:image" content="${FG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${FG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${FG(W)}" />`,`<meta name="twitter:description" content="${FG(K)}" />`,`<meta name="twitter:image" content="${FG(H)}" />`,`<meta name="twitter:image:alt" content="${FG(F)}" />`,`<link rel="canonical" href="${FG(J)}" />`,`<link rel="icon" href="${FG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await ju$(Z.owner,Z.repo,j,E);let z=w[0]??`${SA0(Q)}/${DZ1(B)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);F.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),F.delete(P)}for(let B of $.del)for(let L of PZ1(K,B))H.push({path:L,mode:"100644",type:"blob",sha:null}),F.delete(L);if(H.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...F.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=ha(B);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);H.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:TK6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof u4&&B.status===422)||Y>=zK6-1)throw B;await D$(oZ(2000,200,Y,2,0.5))}}}function TK6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return Rm0(Q,$.deps.coAuthor)}var zK6=3,MZ1;var xu$=D(()=>{HB0();TA0();w4();m_();CA0();MZ1=new Map});import{createHmac as yu$,randomBytes as RK6,timingSafeEqual as IK6}from"crypto";function gu$(){if(yA0)return yA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return yA0=$?Buffer.from($):RK6(32),yA0}function kZ1($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+qK6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=yu$("sha256",gu$()).update(Q).digest("base64url");return`${Q}.${Y}`}function hu$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(yu$("sha256",gu$()).update(Q).digest("base64url"));if(Y.length!==G.length||!IK6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var qK6=21600000,yA0=null;var uu$=D(()=>{q$()});import{z as Pu}from"zod";function kK6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&MK6.test($)}function lu$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function ia($){let Z=$.get("decofileScope");return PA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function pa($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function du$(){let $=new F1;return $.use("/:virtualMcpId/:branch",cu$),$.use("/:virtualMcpId/:branch/*",cu$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await zu$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=kZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(lu$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return pa(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await ia(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return pa(Z,Y)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=VK6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{AA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await ia(Z),W=await bu$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Bu(Q)},G),K=kZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:lu$(Z)})}catch(J){return pa(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof u4&&W.status===409))throw W;await fA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return pa(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await ia(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return pa(Z,Q)}}),$}var MK6,VK6,cu$;var mu$=D(()=>{TA0();D8();ZZ1();jA0();IZ1();BZ1();xu$();uu$();TZ1();m_();CA0();MK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;VK6=Pu.object({set:Pu.record(Pu.string(),Pu.unknown()).optional(),delete:Pu.array(Pu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),cu$=EA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!kK6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!hu$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!zB0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((O)=>O.connection_id)??[],N=da(K,F);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var iu$=($)=>{let Z=new F1;if(Z.use("*",b_),Z.route("/",bP0()),Z.route("/",Wx$()),Z.route("/",Oh$()),Z.route("/",Fh$()),Z.route("/",DA0()),Z.route("/tools",zh$()),Z.route("/",wh$()),Z.route("/",dg$({kvStorage:$.kvStorage})),Z.route("/",cg$()),Z.route("/fs",Qh$({getConnection:$.getNatsConnection})),Z.route("/sandbox",vu$()),Z.route("/decofile",du$()),Z.route("/",Wh$()),Z.route("/deco-sites",yP0()),Z.route("/sso",VP0()),Z.route("/",LA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",eb$()),$.mountDevAssets)Z.route("/dev-assets",gP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",vv$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Gh$()),Z.route("/mcp",cL0()),Z.route("/mcp/self",BA0()),Z.route("/mcp",mL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var pu$=D(()=>{D8();T51();$x$();M51();hP0();Na();P51();lg$();mg$();Yh$();Et();O51();iL0();t91();Jh$();Kh$();Nh$();Bh$();Eh$();r91();Ph$();a91();lL0();fu$();mu$()});function SK6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var CK6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},nu$=()=>{let $=new F1;return $.use("*",CK6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await iZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:SK6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var tu$=D(()=>{D8();q$();bz0()});import{z as M1}from"zod";function HH($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function cK6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function lK6($,Z,X){try{return JSON.parse($)}catch{throw new au$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function dK6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:lK6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function mK6($){let Z=$.map((X)=>{let Q=X.function.parameters?lY(X.function.parameters):lY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function iK6($){if(!$)return;return{openai:{response_format:$}}}function pK6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ou$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function ru$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var _K6=256,vK6,fK6,bK6,xK6,yK6,gK6,hK6,uK6,au$,su$,eu$;var $c$=D(()=>{B4();D8();Ou();WN();vK6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),fK6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),bK6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(fK6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),xK6=M1.object({type:M1.literal("text")}),yK6=M1.object({type:M1.literal("json_object")}),gK6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),hK6=M1.union([xK6,yK6,gK6]),uK6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(bK6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(vK6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:hK6.optional(),user:M1.string().optional()});au$=class au$ extends Error{constructor($){super($);this.name="MessageConversionError"}};su$=new F1;su$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(HH("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(HH("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(HH("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=uK6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(HH(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=cK6(G.model);if(!J)return $.json(HH("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>hL(j.providerId));if(!E)return $.json(HH("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(HH(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),N=dK6(G.messages),U=G.tools?mK6(G.tools):void 0,O=iK6(G.response_format),B=pK6(),L=Math.floor(Date.now()/1000);if(G.stream)return kN($,async(w)=>{let E=ou$(F,N,U,G,O,$.req.raw.signal);try{let j=$B(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=_K6)await I()}else if(q.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ru$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ou$(F,N,U,G,O,$.req.raw.signal),E=await sO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ru$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(HH("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(HH(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(HH(Y.message,"server_error"),500)}});eu$=su$});function nK6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function Zc$(){let $=new F1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=Y1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!mG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let H of J){if(!H.slug||H7(H))continue;let F=await X.storage.virtualMcps.list(H.id);for(let N of F){if($s1(N)!==G)continue;if(!nK6(N.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Xc$=D(()=>{D8();hO()});var Yc$;var Qc$=D(()=>{Yc$={name:"decocms",version:"4.263.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function rK6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??oK6}}var Gc$,oK6="https://ph.studio.decocms.com",Jc$;var Wc$=D(()=>{D8();$u0();MC();L9();q$();K51();Qc$();Gc$=new F1;Gc$.get("/",($)=>{let Z={version:Yc$.version,theme:qm1(),...Sw().logo&&{logo:Sw().logo},...fK()&&{internalUrl:QC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:wb$(),posthog:rK6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!fK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Jc$=Gc$});function Au($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function VZ1($){return(Au($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Hc$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Au($))}&sz=${Z}`}function Kc$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Fc$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Kc$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Kc$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var o_,aK6,sK6,eK6,$H6,Nc$;var Uc$=D(()=>{o_=l0.enum(["good","bad","neutral"]),aK6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:o_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),sK6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(aK6)),eK6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$H6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:o_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:o_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:o_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:o_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(sK6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:o_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:o_.optional()})).min(1)})]),Nc$=l0.object({...eK6,template:$H6})});function gA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Nc$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var SZ1=D(()=>{Uc$()});import{join as Oc$}from"path";async function XH6($){try{let Z=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(ZH6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=gA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||VZ1($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function FG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function QH6($,Z){let X=Au($),Q=Z?.brand?.trim()||VZ1(X),Y=Hc$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Fc$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Q} commerce report by decocms`;return[`<title>${FG(W)}</title>`,`<meta name="description" content="${FG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${FG(W)}" />`,`<meta property="og:description" content="${FG(K)}" />`,`<meta property="og:url" content="${FG(J)}" />`,`<meta property="og:image" content="${FG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${FG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${FG(W)}" />`,`<meta name="twitter:description" content="${FG(K)}" />`,`<meta name="twitter:image" content="${FG(H)}" />`,`<meta name="twitter:image:alt" content="${FG(F)}" />`,`<link rel="canonical" href="${FG(J)}" />`,`<link rel="icon" href="${FG(Y)}" sizes="any" />`].join(`
     `)}function YH6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Bc$($){let Z=new F1;return Z.get("/:domain/og.png",async(X)=>{let Q=Au(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(Oc$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(GH6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?Oc$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await XH6(Au(Q)),K=QH6(Q,W);return X.html(YH6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var ZH6=2500,GH6=1e4;var Dc$=D(()=>{D8();SZ1();mw();q$()});function na($,Z){return fetch(`${QK({})}${$}`,Z)}async function JH6($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await na(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=gA0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var WH6,SN,Lc$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},wc$;var Ec$=D(()=>{D8();gY();mw();SZ1();WH6=new Set(["complete","errored","terminated","unknown"]),SN=new F1;SN.use("*",async($,Z)=>{let X=await F8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});SN.use("/link-token/*",Lc$);SN.use("/suggest",Lc$);SN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await JH6(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});SN.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await na("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${dw({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});SN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await na(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${dw({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:WH6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});SN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await na(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});SN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await na(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});wc$=SN});import{createHmac as KH6,timingSafeEqual as HH6}from"crypto";function zc$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let N=H.slice(0,F).trim(),U=H.slice(F+1).trim();if(N==="t")Y=U;else if(N==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>FH6)return!1;let W=KH6("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&HH6(K,F)})}function Pc$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=SJ(Z),Q=SJ(SJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:FH(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function Ac$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function FH($){return typeof $==="string"?$:void 0}function SJ($){return typeof $==="object"&&$!==null?$:void 0}function hA0($){return typeof $==="number"?new Date($*1000):null}function vZ1($){return FH($)??FH(SJ($)?.id)}function NH6($){return vZ1($.subscription)??FH(SJ(SJ($.parent)?.subscription_details)?.subscription)}function UH6($){let Z=hA0($.current_period_end);if(Z)return Z;let X=SJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=SJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function CZ1($,Z){let X=hA0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function _Z1($,Z){let X=hA0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function OH6($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=FH(SJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(FH(SJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(FH(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=FH(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(SJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:SJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(FH(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=vZ1(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(CZ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:vZ1(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:_Z1(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=FH(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&CZ1(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Ac$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:UH6(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:_Z1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=NH6(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(CZ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:hA0(X.period_end),lastStripeEventAt:_Z1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function BH6($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Ac$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function jc$($,Z){let X=BH6($,Z);if(!X)return;vY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:fp1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Tc$($){let Z=new eW(l8().db),X=await OH6(Z,$);if(!(X.handled&&X.topUp))jc$($,X);if(X.handled&&X.topUp)await Zw$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),jc$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await rs1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof hY&&(Q.status===400||Q.status===404)))throw Q}return X}var FH6=300;var Rc$=D(()=>{gG();C4();o60();ew();ie0()});var DH6=1048576,fZ1;var Ic$=D(()=>{D8();jN();q$();Rc$();fZ1=new F1;fZ1.post("/webhook",V9({maxSize:DH6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=b0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!zc$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=Pc$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Tc$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as LH6}from"crypto";function EH6($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return LH6(Buffer.from(Y),Buffer.from(Q))}var wH6=5242880,bZ1;var qc$=D(()=>{D8();jN();Wn();bZ1=new F1;bZ1.post("/webhook",V9({maxSize:wH6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!EH6(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await op0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function Mc$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var kc$,jH6,zH6,Vc$;var Sc$=D(()=>{D8();L3();ty();yx();kc$=new F1,jH6=["range","if-none-match","if-modified-since"],zH6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];kc$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(th($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Z$(401,{message:"Authentication required"})}if(!X)throw new Z$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Z$(400,{message:"Missing file key"});let Y=await sn(Q,Z);if(!Y)throw new Z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&lG()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Z$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,N=Buffer.from(F,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return Mc$(U,H),new Response(N,{status:200,headers:U})}let G=new Headers;for(let K of jH6){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of zH6){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),Mc$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Vc$=kc$});var ta=_((r_)=>{var PH6=r_&&r_.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),AH6=r_&&r_.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))PH6(Z,$,X)};Object.defineProperty(r_,"__esModule",{value:!0});AH6(EY(),r_)});var vc$=_((Cc$)=>{Object.defineProperty(Cc$,"__esModule",{value:!0});Cc$.version=void 0;Cc$.version="3.4.0"});var xc$=_((NH)=>{var TH6=NH&&NH.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(NH,"__esModule",{value:!0});NH.NodeTransport=NH.VERSION=void 0;NH.nodeResolveHost=VH6;var r6=ta(),RH6=z0("net"),xZ1=z0("tls"),IH6=z0("path"),fc$=z0("fs"),qH6=TH6(z0("dns")),MH6=vc$();NH.VERSION=MH6.version;var kH6="nats.js";class bc${socket;version;lang;yields=[];signal=(0,r6.deferred)();closedNotification=(0,r6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=kH6,this.version=NH.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,r6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw r6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new r6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new r6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,r6.deferred)(),X,Q=(0,RH6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,r6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=r6.DataBuffer.concat(...this.yields),Y=(0,r6.extractProtocolMessage)(Q);if(Y!=="")try{let G=r6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,r6.deferred)();try{if($=(0,IH6.resolve)($),!(0,fc$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,fc$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,r6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,r6.deferred)();try{let Y=(0,xZ1.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,r6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,r6.deferred)();try{let Q=(0,xZ1.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,r6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,r6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof xZ1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,r6.render)($)}`);let Z=(0,r6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}NH.NodeTransport=bc$;function VH6($){let Z=(0,r6.deferred)();return qH6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var cc$=_((uc$)=>{Object.defineProperty(uc$,"__esModule",{value:!0});uc$.connect=SH6;var yc$=xc$(),gc$=ta(),hc$=ta();function SH6($={}){if((0,hc$.hasWsProtocol)($))return Promise.reject(hc$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,gc$.setTransportFactory)({factory:()=>{return new yc$.NodeTransport},dnsResolveFn:yc$.nodeResolveHost}),gc$.NatsConnectionImpl.connect($)}});var lc$=_((CN)=>{var _H6=CN&&CN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),vH6=CN&&CN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))_H6(Z,$,X)};Object.defineProperty(CN,"__esModule",{value:!0});CN.connect=void 0;var fH6=cc$();Object.defineProperty(CN,"connect",{enumerable:!0,get:function(){return fH6.connect}});vH6(ta(),CN)});function pc$($){let Z=$?.connectFn??gH6,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function F(U){(async()=>{for await(let O of U.status())if(O.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(O.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function N(U,O){let B=0;while(!G)try{X=await Z({servers:U,timeout:yH6,reconnect:!0,maxReconnectAttempts:-1,...O?{authenticator:O}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${B} attempt(s)`),Q=null,J=!1,F(X),H();return}catch{B++;let L=oZ(xH6,bH6,B-1,2,0.5);await D$(L)}}return{init(U,O){if(Y)return;Y=!0,G=!1;let B=O?.creds?dc$.credsAuthenticator(new TextEncoder().encode(O.creds)):void 0;N(U,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=ic$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function gH6($){return mc$.connect($)}var dc$,mc$,ic$,bH6=100,xH6=3000,yH6=3000;var nc$=D(()=>{w4();dc$=V(nu(),1),mc$=V(lc$(),1),ic$=V(pD(),1)});function yZ1($,Z){return`${$}.${Z}`}class gZ1{cache;constructor($){this.cache=Ch({ttlMs:$?.ttlMs??hH6,maxSize:$?.maxSize??uH6})}async get($,Z){return this.cache.get(yZ1($,Z))??null}async set($,Z,X){this.cache.set(yZ1($,Z),X)}async invalidate($,Z){this.cache.delete(yZ1($,Z))}teardown(){this.cache.clear()}}var hH6=600000,uH6=5000;var tc$=()=>{};function uA0($,Z){return`${$}:${Z}`}function hZ1($){let Z=Ch({ttlMs:$?.ttlMs??cH6,maxSize:$?.maxSize??lH6}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let F=X?.();if(!F)return;try{F.publish(oc$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(N){console.warn("[ProviderKeyCache] Publish failed (non-critical):",N)}}return{get(K,H){return Z.get(uA0(K,H))},set(K,H,F){Z.set(uA0(K,H),F)},invalidate(K,H){Z.delete(uA0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(oc$),(async()=>{for await(let H of J)try{let F=JSON.parse(G.decode(H.data));if(F.originId===Q)continue;Z.delete(uA0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var oc$="studio.ai-provider-keys.invalidate",cH6=30000,lH6=5000;var rc$=()=>{};class uZ1{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=ac$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of ac$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var ac$;var sc$=D(()=>{ac$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var ec$=($)=>{let Z;return()=>Z??=$()},cZ1,lZ1;var $l$=D(()=>{I6();cZ1=ec$(()=>L$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),lZ1=ec$(()=>L$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function oH6(){return{name:aF,subjects:[`${LL0}.>`],storage:BW.StorageType.File,max_age:iH6,max_bytes:nH6,max_msgs_per_subject:tH6,discard:BW.DiscardPolicy.Old,retention:BW.RetentionPolicy.Limits,duplicate_window:pH6,num_replicas:1}}class Ql${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Zl$($){let Z=Xl$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function eH6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,mH6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function $F6($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class dZ1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=oH6(),X=await v5(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await BW.jetstreamManager($);try{await Q.streams.info(aF),await Q.streams.update(aF,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(aF),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:$F6});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=eH6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=YU$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),N=Ur0(H,{runId:Z}),U=performance.now()-F;if(cZ1().record(U),lZ1().add(1,{"org.id":Q??"unknown"}),sH6?.record(U,N.reduce((O,B)=>O+B.data.length,0)),N.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let O of N)G.publish(Y,O.subject,O.data,O.headers?Zl$(O.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,N=0,U;try{while(!0){let{done:O,value:B}=await H.read();if(O)break;if(K(B),N++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(O){U=O,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,O?.message??O)}finally{if(H.releaseLock(),W(),aH6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:N,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Ur0(Z,{runId:$,dedup:X});if(cZ1().record(performance.now()-Y),lZ1().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:Zl$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=QU$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?BW.DeliverPolicy.New:BW.DeliverPolicy.All,G=X?.closeOnDone??!1,J=gB($),W;try{W=await(await Q.consumers.get(aF,{filter_subjects:J,deliver_policy:Y})).consume()}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=PL0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(wL0()).pipeThrough(EL0()).getReader(),N=!1,U=()=>{if(N)return;N=!0;try{F.releaseLock()}catch{}},O=!1,B=()=>{if(O)return;O=!0,W.stop(),F.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){B(),L.close();return}let j=E;if(j.kind==="done"){if(G){B(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(aF,{filter:gB($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var BW,Xl$,dH6=($)=>{let Z;return()=>Z??=$()},mH6,iH6=86400000000000,pH6=120000000000,nH6=4294967296,tH6=500000,rH6,aH6,sH6;var Yl$=D(()=>{w4();Or0();AL0();jL0();I6();$l$();BW=V(pD(),1),Xl$=V(nu(),1),mH6=dH6(()=>L$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));rH6=process.env.STREAM_ENCODE_TRACE==="1",aH6=process.env.DECOPILOT_STREAM_TRACE==="1";sH6=rH6?new Ql$:null});function cA0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,xW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Gl$=D(()=>{P8()});class mZ1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function Jl$($,Z,X){let Q=Z.organizationId;if(Z.status!=="in_review")return!1;if(!Ya(X))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Q))return!1;let Y=await $.storage.taskBoard.update(Z.id,Q,{status:"done"},Z.updatedBy);return await F6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:"done",reason:"pr_merged"}}),h$(Q,Y),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to done`),!0}var Wl$=D(()=>{HX();Ga();w5()});function WF6($){return $ instanceof a7}function KF6($,Z){return Z-$>=GF6}class iZ1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??ZF6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??QF6,X=this.options.itemIntervalMs??XF6,Q=new Date(Date.now()-X),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Q),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of Y)try{if(await this.reconcileItem(J,W,Q))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-kt0),No0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-JF6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Ho0(this.taskBoard,Y,Q),await Fo0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==T8)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await n3(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),WF6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+YF6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),h$(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!KF6(AF(X),Date.now()))return;await vK($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,X){if(!await this.taskBoard.claimSweep($,Z,X))return!1;let Q=await this.taskBoard.getById($,Z);if(!Q)return!1;if(Q.status!=="in_review")return!1;let Y=Q.assigneeId===T8,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Q.assignedBy??Q.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,Q);return!1}let W=await Promise.all(G.map(async(K)=>({...K,...await ny(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Jl$(J,Q,W.map((K)=>K.merged)))return!0;if(await mU$(J,Q))return!0;if(!Y)return!1;if(!Co0(W))return!1;return await uD0(J,Q,{previewMatchesHead:_o0(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var ZF6=60000,XF6=300000,QF6=50,YF6=60000,GF6=900000,JF6=120000;var Kl$=D(()=>{X9();Ao0();_K();Ut();Wl$();w5();pG();Uo0();HJ();tn()});import{readdir as HF6,rm as lA0}from"fs/promises";import{join as dA0}from"path";async function mA0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-FF6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await a_($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Hl$($,Y,Z);else if(!Y.startsWith(".")){let G=dA0($,Y),J=await a_(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Hl$(G,K,Z)}if((await a_(G)).length===0)await lA0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Hl$($,Z,X){let Q=0,Y=dA0($,Z),G=await a_(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=dA0(Y,W),H=await a_(K);for(let N of H){if(!/^\d{2}$/.test(N))continue;let U=new Date(`${Z}-${W}-${N}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let O=dA0(K,N);await lA0(O,{recursive:!0,force:!0}),Q++}}if((await a_(K)).length===0)await lA0(K,{recursive:!0,force:!0})}if((await a_(Y)).length===0)await lA0(Y,{recursive:!0,force:!0});return Q}async function a_($){try{return(await HF6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var FF6=30;var pZ1=()=>{};import{DBOS as nZ1,SchedulerMode as NF6}from"@dbos-inc/dbos-sdk";async function OF6(){let $=[vJ(),s_(),DH()],Z=0;for(let X of $)try{Z+=await mA0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function BF6($,Z){await nZ1.runStep(()=>OF6(),{name:"monitoringRetention"})}function Nl$(){if(Fl$)return;Fl$=!0;let $=nZ1.registerWorkflow(BF6,{name:"monitoringRetentionWorkflow"});nZ1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:UF6,mode:NF6.ExactlyOncePerIntervalWhenActive})}var UF6="23 4 * * *",Fl$=!1;var Ul$=D(()=>{BY();pZ1()});function Ol$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await WJ.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await Xt($.db,Z,Q.role);return Y.boundAuth=i61({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new qw(X,void 0,Y.boundAuth,Q.role,"self"),CB(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Bl$=D(()=>{Mw();_B()});function DF6(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function wF6(){for(let $ of LF6)$()}function Dl$($){let Z=[...tZ1.logs,$];tZ1={...tZ1,logs:Z.length>500?Z.slice(-500):Z},wF6()}function oZ1(){return EF6}var tZ1,LF6,EF6=!1;var rZ1=D(()=>{tZ1=DF6(),LF6=new Set});import{EventEmitter as jF6}from"events";var aZ1;var Ll$=D(()=>{rZ1();aZ1=new jF6;aZ1.on("request",($)=>{Dl$($)})});function wl$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let O=Tu(U.params.name),B=U.params.arguments||{},L=Object.keys(B).map((E)=>Tu(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${G5.tool}${O}${G5.dim}(${w})${G5.reset}`}else if(U.method)G=`${G5.dim}${Tu(U.method)}${G5.reset}`}}catch{}}let W=Tu(Y);if(Y.startsWith("/mcp/conn_")){let F=Y.split("/")[2]??"";W=`/mcp/${G5.mcp}${Tu(F.slice(0,12))}\u2026${G5.reset}`}else if(Y==="/mcp")W=`${G5.mcp}/mcp${G5.reset}`;else if(Y==="/mcp/registry")W=`${G5.mcp}/mcp/registry${G5.reset}`;let K=PF6(Q),H=J?"\u25C0":"\u2190";if(!oZ1())console.log(`${G5.dim}${H}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let F=Date.now()-X,N=$.res.status,U=zF6(N),O=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!oZ1())console.log(`${G5.dim}${B}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""} ${U}${N}${G5.reset} ${G5.duration}${O}${G5.reset}`);aZ1.emit("request",{method:Q,path:Tu(Y),status:N,duration:F,timestamp:new Date})}}}var G5,zF6=($)=>{if($>=500)return G5.serverError;if($>=400)return G5.clientError;if($>=300)return G5.redirect;return G5.ok},PF6=($)=>{return G5[$]||G5.reset},Tu=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var El$=D(()=>{rZ1();Ll$();G5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Al$}from"crypto";import{mkdir as AF6,readdir as TF6,rm as jl$,stat as Tl$}from"fs/promises";import{join as eZ1,relative as RF6}from"path";import{z as A$}from"zod";function Il$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return eZ1(IF6,Z)}function ql$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function sZ1($,Z){let X=Il$($),Q=ql$(Z);return eZ1(X,Q)}function qF6($,Z,X,Q){let Y=b0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return Al$("sha256",Y).update(G).digest("hex")}function Pl$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=qF6(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${ql$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function Ml$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${Al$("md5","etag").update(Q).digest("hex")}"`}async function kl$($,Z,X,Q,Y){try{let G=await TF6($,{withFileTypes:!0});for(let J of G){let W=eZ1($,J.name),H=RF6(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let F=H+"/";if(!X||F.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(F)}}else await kl$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let F=H.slice(X.length);if(F.includes(Q)){let N=F.indexOf(Q),U=X+F.slice(0,N+1);Y.commonPrefixes.add(U);continue}}try{let F=await Tl$(W);Y.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:Ml$(W,F.mtime,F.size)})}catch{}}}}catch{}}function Vl$($,Z){let Q=t($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:A$.object({prefix:A$.string().optional(),maxKeys:A$.number().optional().default(1000),continuationToken:A$.string().optional(),delimiter:A$.string().optional()}),outputSchema:A$.object({objects:A$.array(A$.object({key:A$.string(),size:A$.number(),lastModified:A$.string(),etag:A$.string()})),nextContinuationToken:A$.string().optional(),isTruncated:A$.boolean(),commonPrefixes:A$.array(A$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,F=Il$(Q);await AF6(F,{recursive:!0});let N={objects:[],commonPrefixes:new Set};await kl$(F,F,J,K,N),N.objects.sort((w,E)=>w.key.localeCompare(E.key));let U=0;if(H){if(U=N.objects.findIndex((w)=>w.key>H),U===-1)U=N.objects.length}let O=N.objects.slice(U,U+W),B=U+W<N.objects.length,L=B?O[O.length-1]?.key:void 0;return{objects:O,isTruncated:B,nextContinuationToken:L,commonPrefixes:Array.from(N.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:A$.object({key:A$.string()}),outputSchema:A$.object({contentType:A$.string().optional(),contentLength:A$.number(),lastModified:A$.string(),etag:A$.string(),metadata:A$.record(A$.string(),A$.string()).optional()}),handler:async(Y)=>{let G=Y,J=sZ1(Q,G.key),W=await Tl$(J);return{contentType:V51(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:Ml$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:A$.object({key:A$.string(),expiresIn:A$.number().optional()}),outputSchema:A$.object({url:A$.string(),expiresIn:A$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??zl$;return{url:Pl$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:A$.object({key:A$.string(),expiresIn:A$.number().optional(),contentType:A$.string().optional()}),outputSchema:A$.object({url:A$.string(),expiresIn:A$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??zl$;return{url:Pl$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:A$.object({key:A$.string()}),outputSchema:A$.object({success:A$.boolean(),key:A$.string()}),handler:async(Y)=>{let G=Y,J=sZ1(Q,G.key);try{return await jl$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:A$.object({keys:A$.array(A$.string()).max(1000)}),outputSchema:A$.object({deleted:A$.array(A$.string()),errors:A$.array(A$.object({key:A$.string(),message:A$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=sZ1(Q,K);try{await jl$(H),J.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function $71($,Z,X){let Q=Vl$(Z,X),Y=new dW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:F5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:A$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:A$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let F=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let G=new XQ({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),BJ(Y,G,$,"mcp:dev-assets")}async function Sl$($,Z,X,Q){let G=Vl$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var IF6="./data/assets",zl$=3600,Rl$,Cl$;var _l$=D(()=>{q$();Wg();D8();Ld();fC();yX();hP0();Rl$=new F1;Rl$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return $71($.req.raw,Z,Q)});Cl$=Rl$});var vl$={};J4(vl$,{mountDevRoutes:()=>MF6});function MF6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return $71(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await Sl$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Cl$);let X=new F1;X.use("*",UW({mountPath:"/api/dev-assets"})),X.route("/",gP0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var fl$=D(()=>{D8();A51();hP0();_l$()});import{sql as kF6}from"kysely";import{randomUUID as bl$}from"crypto";import{z as VF6}from"zod";async function CF6($){let Z=new Date().toISOString(),X=bl$(),Q=S8.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:bl$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await kF6`SELECT
       pg_notify('studio_events', ${X}),