npm - decocms - Versions diffs - 4.286.0 → 4.286.2 - Mend

decocms 4.286.0 → 4.286.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (231) hide show

package/dist/server/server.js CHANGED Viewed

@@ -2920,7 +2920,7 @@ Respond with the structured verdict and a short reason.`,Cc$;var vc$=D(()=>{D4()
 ${G.join(`
 `)}`:Y}function nH6($){let Z=new Set;for(let X of $)for(let Q of X.split(`
 `)){let Y=Q.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var Ol$=200,gH6=12,uH6,lH6=300,F71=3;var H71=D(()=>{xD();XT0();uH6={aheadBy:0,behindBy:0,files:[]}});function oH6($){if(!$||$.includes(".."))return!1;return tH6.test($)}function Ll$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!oH6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function wl$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var tH6;var El$=D(()=>{tH6=/^[\w./@-]+$/});function Ws($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function jl$($,Z,X,Q){if(!Q.connectionId)throw new Yv("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new Yv(G9);await jO({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(H)=>{let N=H instanceof Error?H.message:G9;throw new Yv(N)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:K}=await AW(Q.connectionId,Q.owner,Q.name,$.db,$.vault).catch((H)=>{let{code:N,message:U}=F5$(H instanceof Error?H.message:String(H));throw N?new Yv(U):H}),W=hu($),F=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:K}},...W?{operator:W}:{}})});if(!F.ok){let H=await EO(F,rH6).catch(()=>F.statusText);throw Error(`Failed to refresh sandbox git credentials (${F.status}): ${H}`)}}var rH6=10485760,Yv;var N71=D(()=>{ZJ();iA0();Xn();Wi0();zy();Yv=class Yv extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function sH6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!aH6.test(Z))throw Error(`Invalid branch name: ${$}`)}function Gv($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout($N6)])}async function XN6($,Z){let X=$.var.studioContext,Q=eG(Z.branch),Y=$.req.query("thread")??Q,G=Y&&Y===Q?Z.branchThread:Y?await X.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,K=WC(J?.metadata?.runtime);if(K)return K;let W=hO0(Z.virtualMcpMetadata),F=W==="cms"?await pZ1(X,{claimName:Z.claimName}):"alive",H=W==="cms"&&F!=="alive"?"cms":"sandbox",N=!!J&&(F==="gone"||F==="alive"&&W==="cms");if(N&&J)Cn(X,J.id,H);if(W==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:F,resolved:H,stamped:N});return H}async function QN6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await $Q($.var.studioContext)}catch{return null}}function Jv($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function mu($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=Ws(Z,X);if(!Y)throw new u4(404,"AUTH","repo","Project has no GitHub repository");let G=t(Q);return pA0(Q,G.id,Y)}function U71($,Z){if(Z instanceof aP0)return $.json({error:Z.message},429,{...P5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,P5)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,P5)}async function Al$($,Z,X){let Q;try{Q=await fetch(Z,X)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await Q.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}async function Tl$($){try{let Z=await mu($),X=await QT0(Z,$.get("vmClaim").branch);return $.json(X,200,P5)}catch(Z){return U71($,Z)}}function Fs($,Z){let Q=(JT0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return JT0.set($,Y),Y.finally(()=>{if(JT0.get($)===Y)JT0.delete($)}),Q}async function tZ($,Z,X){if(!X?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,P5);let Q=X?.runner??Jv($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),K=X?.method??"POST",W=null,F=new Headers;if(X?.jsonBody!==void 0)W=X.jsonBody,F.set("content-type","application/json");else if(X?.forwardJsonBody)W=await $.req.text(),F.set("content-type","application/json");let H=X?.signal,N={method:K,headers:F,body:W,...H?{signal:H}:{}},U=async()=>{let B=await Q.proxyDaemonRequest(Y,Z,N);if(X?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Q.adoptLiveClaim({userId:G,projectRef:J},Y))B=await Q.proxyDaemonRequest(Y,Z,N);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...P5}})}}let O=await B.text(),L=X?.redactRepoDir?YN6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...P5}})};try{if(H){let B=U();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(H.aborted)return w(H.reason);H.addEventListener("abort",()=>w(H.reason),{once:!0})})])}return await U()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function YN6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function KT0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let K=`Daemon error (${G.status})`;try{K=JSON.parse(J).error??K}catch{}throw Error(K)}return JSON.parse(J)}function GN6($){return Rl$.includes($)}var aH6,zl$=524288,eH6=65536,$N6=1e4,Pl$=2000,ZN6,JT0,P5,Rl$,Il$=()=>{let $=new H1;$.use("/:virtualMcpId/:branch/*",ZN6),$.post("/:virtualMcpId/:branch/write",(X)=>tZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>tZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>tZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>tZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>tZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>tZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>tZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:Gv(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return tZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return tZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>tZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>tZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!GN6(Q))return X.json({error:`step must be one of: ${Rl$.join(", ")}`},400);let Y=X.get("vmClaim"),G=await pZ1(X.var.studioContext,{claimName:Y.claimName})==="gone"?null:await QN6(X);if(!G)return X.json({error:"sandbox not found: nothing is running at this ref"},404,P5);if(Q==="start"){let J=t(X.var.studioContext),K=Ey(Y.virtualMcpMetadata);try{await Z70({ctx:X.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:K})}catch(W){let F=W instanceof Error?W.message:String(W);return X.json({error:`Failed to push env to daemon: ${F}`},502)}}return tZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return gN(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Ic$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Tl$(X);return Z(X)});let Z=(X)=>tZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Pl$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Tl$(X);return tZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(Pl$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")try{let Y=await X.req.json().catch(()=>({})),G=await mu(X),J=await YT0(G,Q.branch,Y.base);return X.json(J,200,P5)}catch(Y){return U71(X,Y)}return tZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").runtime==="cms")return X.json({ok:!0},200,P5);let Q=Jv(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),K=X.var.studioContext;return Fs(Y,async()=>{try{await nZ1(K,Q,Y);let W=Ws(G,J);if(W)await jl$(K,Q,Y,W)}catch(W){if(W instanceof Yv)return X.json({error:W.message},403,P5);let F=W instanceof Error?W.message:String(W);return X.json({error:F},502,P5)}return tZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return Fs(Q.claimName,async()=>{let Y=await X.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return X.json({error:"filepaths is required"},400,P5);try{let J=await mu(X);return await Dl$(J,Q.branch,G),X.json({ok:!0},200,P5)}catch(J){let K=J instanceof u4&&J.status===409?409:502,W=J instanceof Error?J.message:String(J);return X.json({error:W},K,P5)}});return Fs(Q.claimName,()=>tZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return Fs(Q.claimName,async()=>{try{let K=await X.req.json().catch(()=>({})),W=await mu(X),F=K.base??await W.getDefaultBranch();return await GT0(W,Q.branch,F),X.json({ok:!0},200,P5)}catch(K){return U71(X,K)}});let Y=Jv(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return Fs(G,async()=>{try{await nZ1(J,Y,G)}catch(K){let W=K instanceof Error?K.message:String(K);return X.json({error:W},502,P5)}return tZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",p5({maxSize:zl$,onError:(X)=>X.json({error:"Payload too large"},413,P5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let F=Jv(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:K}=Q,W=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[B,O]=rZ1(H)&&U?[H,N]:Y?await Promise.all([KT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:K}),KT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:K})]):await(async()=>{let w=await mu(X);return Promise.all([QT0(w,Q.branch),YT0(w,Q.branch)])})(),L=await Sc$(W,B,O);return X.json(L,200,P5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,P5);return X.json({error:H},502,P5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",p5({maxSize:zl$,onError:(X)=>X.json({error:"Payload too large"},413,P5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let F=Jv(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:K}=Q,W=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[B,O]=rZ1(H)&&U?[H,N]:Y?await Promise.all([KT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:K}),KT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:K})]):await(async()=>{let w=await mu(X);return Promise.all([QT0(w,Q.branch),YT0(w,Q.branch)])})(),L=await _c$(W,B,O,typeof F.language==="string"?F.language:void 0);return X.json(L,200,P5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,P5);return X.json({error:H},502,P5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=Jv(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let K=J.replace(/\/+$/,"");return Al$(X,`${K}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",p5({maxSize:eH6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=Jv(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let K=Ll$(J);if(!K)return X.json({error:"Invalid or missing __resolveType"},400);let W=wl$(G,K.resolveType);return Al$(X,W,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var ql$=D(()=>{U8();UF();gu();iZ1();ap();Ac$();b3();gy();Tc$();u3();Rc$();qc$();Gi0();$n();eZ1();vc$();Z71();xD();H71();El$();N71();aH6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;ZN6=mA0(async($,Z)=>{let X=$.var.studioContext;try{r(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=o0(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=t(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{sH6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let K=await X.storage.virtualMcps.findById(G);if(!K||K.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let W=op({orgId:Y.id,virtualMcpId:G,branch:J}),F=await em0(X,J),H=$i0(F,Q),N=Pc$({userId:H,projectRef:W}),U=K.metadata??null,B=await XN6($,{claimName:N,branch:J,virtualMcpId:G,sandboxUserId:H,virtualMcpMetadata:U,branchThread:F});if(B==="cms")return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:H,projectRef:W,virtualMcpMetadata:U,connectionIds:K.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await $Q(X)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:O,virtualMcpId:G,branch:J,userId:H,projectRef:W,virtualMcpMetadata:U,connectionIds:K.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});JT0=new Map;P5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Rl$=["clone","install","start"]});function Ml$($,Z,X){let Q=B71.get($);if(!Q)Q={pending:null,running:!1},B71.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,K]of Object.entries(X.set??{}))Y.set.set(J,K),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,K)=>{Y.resolvers.push(J),Y.rejecters.push(K)});if(!Q.running)KN6($,Q);return G}async function KN6($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await WN6(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)B71.delete($)}}async function WN6($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await du(Z,X),J=await Z.getCommitTreeSha(G),K=await Z.getTreeRecursive(J),W=K71(K,Q),F=[],H=new Map(W.map((O)=>[O.path,{stem:O.stem,sha:O.sha}]));for(let[O,L]of $.set){let w=W71(W,O),E=`${JSON.stringify(L,null,2)}
-`,j=await Z.createBlob(E);await Nl$(Z.owner,Z.repo,j,E);let z=w[0]??`${ZT0(Q)}/${X71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let O of $.del)for(let L of W71(W,O))F.push({path:L,mode:"100644",type:"blob",sha:null}),H.delete(L);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(K.some((O)=>O.type==="blob"&&O.path===N)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=Ys(O);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),B=await Z.createCommit({message:FN6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,B),B}catch(O){if(!(O instanceof u4&&O.status===422)||Y>=JN6-1)throw O;await L$(aZ(2000,200,Y,2,0.5))}}}function FN6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return nm0(Q,$.deps.coAuthor)}var JN6=3,B71;var kl$=D(()=>{vO0();tA0();K4();xD();XT0();B71=new Map});import{createHmac as Vl$,randomBytes as HN6,timingSafeEqual as NN6}from"crypto";function Sl$(){if(WT0)return WT0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return WT0=$?Buffer.from($):HN6(32),WT0}function O71($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+UN6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=Vl$("sha256",Sl$()).update(Q).digest("base64url");return`${Q}.${Y}`}function Cl$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(Vl$("sha256",Sl$()).update(Q).digest("base64url"));if(Y.length!==G.length||!NN6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let K=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=K}var UN6=21600000,WT0=null;var _l$=D(()=>{R$()});import{z as iu}from"zod";function ON6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&BN6.test($)}function yl$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Hs($){let Z=$.get("decofileScope");return pA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Ns($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function gl$(){let $=new H1;return $.use("/:virtualMcpId/:branch",xl$),$.use("/:virtualMcpId/:branch/*",xl$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Ul$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=O71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(yl$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Ns(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await Hs(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return Ns(Z,Y)}}),$.patch("/:virtualMcpId/:branch",LN6,async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=wN6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{nA0(J)}catch(K){let W=K instanceof Error?K.message:String(K);return Z.json({error:W},400)}for(let[J,K]of Object.entries(G.set??{}))if(typeof K!=="object"||K===null||Array.isArray(K))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Hs(Z),K=await Ml$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:hu(Q)},G),W=O71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:K,token:W,apiHost:yl$(Z)})}catch(J){return Ns(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(K){if(!(K instanceof u4&&K.status===409))throw K;await GT0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let W=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:W.number,url:W.html_url})}throw J}}catch(Q){return Ns(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return Ns(Z,Q)}}),$}var BN6,vl$=500,fl$=1048576,bl$=1024,DN6=8388608,LN6,wN6,xl$;var hl$=D(()=>{tA0();U8();UF();iZ1();iA0();N71();Z71();kl$();_l$();H71();xD();XT0();BN6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;LN6=p5({maxSize:DN6,onError:($)=>$.json({error:"Payload too large"},413)}),wN6=iu.object({set:iu.record(iu.string(),iu.unknown()).optional(),delete:iu.array(iu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=vl$,{message:`Patch cannot touch more than ${vl$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=fl$),{message:`Each block must be at most ${fl$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=bl$),{message:`Each block key must be at most ${bl$} characters`}),xl$=mA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!ON6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Cl$(B,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let K=await X.storage.virtualMcps.findById(Y);if(!K||K.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let W=K.metadata??null;if(!gO0(W))return $.json({error:"Project has no preview server configured"},404);let H=K.connections?.map((B)=>B.connection_id)??[],N=Ws(W,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=W?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var ul$=($)=>{let Z=new H1;if(Z.use("*",t_),Z.route("/",KA0()),Z.route("/",Xg$()),Z.route("/",Wc$()),Z.route("/",Gc$()),Z.route("/",cA0()),Z.route("/tools",Dc$()),Z.route("/",Uc$()),Z.route("/",gu$({kvStorage:$.kvStorage})),Z.route("/",xu$()),Z.route("/fs",su$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Il$()),Z.route("/decofile",gl$()),Z.route("/",Xc$()),Z.route("/deco-sites",FA0()),Z.route("/sso",ZA0()),Z.route("/",lA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ty$()),$.mountDevAssets)Z.route("/dev-assets",HA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Ob$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",$c$()),Z.route("/mcp",Nw0()),Z.route("/mcp/self",uA0()),Z.route("/mcp",Ow0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var cl$=D(()=>{U8();B91();oy$();w91();NA0();Sa();N91();yu$();hu$();eu$();yt();G91();Dw0();gZ1();Zc$();Qc$();Jc$();Fc$();Bc$();uZ1();Lc$();cZ1();Uw0();ql$();hl$()});function EN6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jN6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},ll$=()=>{let $=new H1;return $.use("*",jN6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await nZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:EN6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var dl$=D(()=>{U8();R$();GP0()});import{z as M1}from"zod";function wF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function VN6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function SN6($,Z,X){try{return JSON.parse($)}catch{throw new pl$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function CN6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:SN6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function _N6($){let Z=$.map((X)=>{let Q=X.function.parameters?dY(X.function.parameters):dY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function vN6($){if(!$)return;return{openai:{response_format:$}}}function fN6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ml$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function il$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var zN6=256,PN6,AN6,TN6,RN6,IN6,qN6,MN6,kN6,pl$,nl$,tl$;var ol$=D(()=>{D4();U8();gu();EN();PN6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),AN6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),TN6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(AN6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),RN6=M1.object({type:M1.literal("text")}),IN6=M1.object({type:M1.literal("json_object")}),qN6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),MN6=M1.union([RN6,IN6,qN6]),kN6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(TN6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(PN6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:MN6.optional(),user:M1.string().optional()});pl$=class pl$ extends Error{constructor($){super($);this.name="MessageConversionError"}};nl$=new H1;nl$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(wF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=kN6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=VN6(G.model);if(!J)return $.json(wF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:K}=J,{modelId:W}=J;if(!K){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>$w(j.providerId));if(!E)return $.json(wF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);K=E.id}let F;try{F=await Z.aiProviders.activate(K,Z.organization.id)}catch{return $.json(wF(`AI provider credential not found or inaccessible: ${K}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(W),N=CN6(G.messages),U=G.tools?_N6(G.tools):void 0,B=vN6(G.response_format),O=fN6(),L=Math.floor(Date.now()/1000);if(G.stream)return gN($,async(w)=>{let E=ml$(H,N,U,G,B,$.req.raw.signal);try{let j=BO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=zN6)await I()}else if(q.type==="tool-call"){await I();let k=A++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:k,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:il$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ml$(H,N,U,G,B,$.req.raw.signal),E=await NO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:il$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(wF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(wF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(wF(Y.message,"server_error"),500)}});tl$=nl$});function bN6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function rl$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=o0(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!tG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),K=[];for(let F of J){if(!F.slug||_Z(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(ls1(N)!==G)continue;if(!bN6(N.metadata))continue;K.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let W={matches:K};return Z.json(W)}),$}var al$=D(()=>{U8();oB()});var el$;var sl$=D(()=>{el$={name:"decocms",version:"4.286.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function gN6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??yN6}}var $d$,yN6="https://ph.studio.decocms.com",Zd$;var Xd$=D(()=>{U8();b50();VC();$9();R$();r51();sl$();$d$=new H1;$d$.get("/",($)=>{let Z={version:el$.version,theme:Bi1(),...EH().logo&&{logo:EH().logo},...YN()&&{internalUrl:dC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Yy$(),posthog:gN6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:js()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Zd$=$d$});function pu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function D71($){return(pu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Yd$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(pu($))}&sz=${Z}`}function Qd$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Gd$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,K=Y?.trim()?Qd$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Qd$(`How does ${X} really perform? ${J}`,200);return{title:G,description:K}}import{z as l0}from"zod";var Kv,hN6,uN6,cN6,lN6,Jd$;var Kd$=D(()=>{Kv=l0.enum(["good","bad","neutral"]),hN6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:Kv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),uN6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(hN6)),cN6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},lN6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:Kv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:Kv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:Kv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:Kv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(uN6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:Kv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:Kv.optional()})).min(1)})]),Jd$=l0.object({...cN6,template:lN6})});function FT0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Jd$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var L71=D(()=>{Kd$()});import{join as Wd$}from"path";async function mN6($){try{let Z=await fetch(`${GW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(dN6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=FT0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((K)=>K.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||D71($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function OG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function iN6($,Z){let X=pu($),Q=Z?.brand?.trim()||D71(X),Y=Yd$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:K,description:W}=Gd$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${OG(K)}</title>`,`<meta name="description" content="${OG(W)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${OG(K)}" />`,`<meta property="og:description" content="${OG(W)}" />`,`<meta property="og:url" content="${OG(J)}" />`,`<meta property="og:image" content="${OG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${OG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${OG(K)}" />`,`<meta name="twitter:description" content="${OG(W)}" />`,`<meta name="twitter:image" content="${OG(F)}" />`,`<meta name="twitter:image:alt" content="${OG(H)}" />`,`<link rel="canonical" href="${OG(J)}" />`,`<link rel="icon" href="${OG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await Nl$(Z.owner,Z.repo,j,E);let z=w[0]??`${ZT0(Q)}/${X71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let O of $.del)for(let L of W71(W,O))F.push({path:L,mode:"100644",type:"blob",sha:null}),H.delete(L);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(K.some((O)=>O.type==="blob"&&O.path===N)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=Ys(O);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),B=await Z.createCommit({message:FN6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,B),B}catch(O){if(!(O instanceof u4&&O.status===422)||Y>=JN6-1)throw O;await L$(aZ(2000,200,Y,2,0.5))}}}function FN6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return nm0(Q,$.deps.coAuthor)}var JN6=3,B71;var kl$=D(()=>{vO0();tA0();K4();xD();XT0();B71=new Map});import{createHmac as Vl$,randomBytes as HN6,timingSafeEqual as NN6}from"crypto";function Sl$(){if(WT0)return WT0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return WT0=$?Buffer.from($):HN6(32),WT0}function O71($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+UN6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=Vl$("sha256",Sl$()).update(Q).digest("base64url");return`${Q}.${Y}`}function Cl$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(Vl$("sha256",Sl$()).update(Q).digest("base64url"));if(Y.length!==G.length||!NN6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let K=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=K}var UN6=21600000,WT0=null;var _l$=D(()=>{R$()});import{z as iu}from"zod";function ON6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&BN6.test($)}function yl$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Hs($){let Z=$.get("decofileScope");return pA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Ns($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function gl$(){let $=new H1;return $.use("/:virtualMcpId/:branch",xl$),$.use("/:virtualMcpId/:branch/*",xl$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Ul$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=O71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(yl$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Ns(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await Hs(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return Ns(Z,Y)}}),$.patch("/:virtualMcpId/:branch",LN6,async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=wN6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{nA0(J)}catch(K){let W=K instanceof Error?K.message:String(K);return Z.json({error:W},400)}for(let[J,K]of Object.entries(G.set??{}))if(typeof K!=="object"||K===null||Array.isArray(K))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Hs(Z),K=await Ml$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:hu(Q)},G),W=O71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:K,token:W,apiHost:yl$(Z)})}catch(J){return Ns(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(K){if(!(K instanceof u4&&K.status===409))throw K;await GT0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let W=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:W.number,url:W.html_url})}throw J}}catch(Q){return Ns(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Hs(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return Ns(Z,Q)}}),$}var BN6,vl$=500,fl$=1048576,bl$=1024,DN6=8388608,LN6,wN6,xl$;var hl$=D(()=>{tA0();U8();UF();iZ1();iA0();N71();Z71();kl$();_l$();H71();xD();XT0();BN6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;LN6=p5({maxSize:DN6,onError:($)=>$.json({error:"Payload too large"},413)}),wN6=iu.object({set:iu.record(iu.string(),iu.unknown()).optional(),delete:iu.array(iu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=vl$,{message:`Patch cannot touch more than ${vl$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=fl$),{message:`Each block must be at most ${fl$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=bl$),{message:`Each block key must be at most ${bl$} characters`}),xl$=mA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!ON6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Cl$(B,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let K=await X.storage.virtualMcps.findById(Y);if(!K||K.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let W=K.metadata??null;if(!gO0(W))return $.json({error:"Project has no preview server configured"},404);let H=K.connections?.map((B)=>B.connection_id)??[],N=Ws(W,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=W?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var ul$=($)=>{let Z=new H1;if(Z.use("*",t_),Z.route("/",KA0()),Z.route("/",Xg$()),Z.route("/",Wc$()),Z.route("/",Gc$()),Z.route("/",cA0()),Z.route("/tools",Dc$()),Z.route("/",Uc$()),Z.route("/",gu$({kvStorage:$.kvStorage})),Z.route("/",xu$()),Z.route("/fs",su$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Il$()),Z.route("/decofile",gl$()),Z.route("/",Xc$()),Z.route("/deco-sites",FA0()),Z.route("/sso",ZA0()),Z.route("/",lA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ty$()),$.mountDevAssets)Z.route("/dev-assets",HA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Ob$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",$c$()),Z.route("/mcp",Nw0()),Z.route("/mcp/self",uA0()),Z.route("/mcp",Ow0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var cl$=D(()=>{U8();B91();oy$();w91();NA0();Sa();N91();yu$();hu$();eu$();yt();G91();Dw0();gZ1();Zc$();Qc$();Jc$();Fc$();Bc$();uZ1();Lc$();cZ1();Uw0();ql$();hl$()});function EN6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jN6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},ll$=()=>{let $=new H1;return $.use("*",jN6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await nZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:EN6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var dl$=D(()=>{U8();R$();GP0()});import{z as M1}from"zod";function wF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function VN6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function SN6($,Z,X){try{return JSON.parse($)}catch{throw new pl$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function CN6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:SN6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function _N6($){let Z=$.map((X)=>{let Q=X.function.parameters?dY(X.function.parameters):dY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function vN6($){if(!$)return;return{openai:{response_format:$}}}function fN6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ml$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function il$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var zN6=256,PN6,AN6,TN6,RN6,IN6,qN6,MN6,kN6,pl$,nl$,tl$;var ol$=D(()=>{D4();U8();gu();EN();PN6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),AN6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),TN6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(AN6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),RN6=M1.object({type:M1.literal("text")}),IN6=M1.object({type:M1.literal("json_object")}),qN6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),MN6=M1.union([RN6,IN6,qN6]),kN6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(TN6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(PN6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:MN6.optional(),user:M1.string().optional()});pl$=class pl$ extends Error{constructor($){super($);this.name="MessageConversionError"}};nl$=new H1;nl$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(wF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=kN6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=VN6(G.model);if(!J)return $.json(wF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:K}=J,{modelId:W}=J;if(!K){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>$w(j.providerId));if(!E)return $.json(wF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);K=E.id}let F;try{F=await Z.aiProviders.activate(K,Z.organization.id)}catch{return $.json(wF(`AI provider credential not found or inaccessible: ${K}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(W),N=CN6(G.messages),U=G.tools?_N6(G.tools):void 0,B=vN6(G.response_format),O=fN6(),L=Math.floor(Date.now()/1000);if(G.stream)return gN($,async(w)=>{let E=ml$(H,N,U,G,B,$.req.raw.signal);try{let j=BO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=zN6)await I()}else if(q.type==="tool-call"){await I();let k=A++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:k,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:il$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ml$(H,N,U,G,B,$.req.raw.signal),E=await NO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:il$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(wF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(wF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(wF(Y.message,"server_error"),500)}});tl$=nl$});function bN6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function rl$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=o0(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!tG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),K=[];for(let F of J){if(!F.slug||_Z(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(ls1(N)!==G)continue;if(!bN6(N.metadata))continue;K.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let W={matches:K};return Z.json(W)}),$}var al$=D(()=>{U8();oB()});var el$;var sl$=D(()=>{el$={name:"decocms",version:"4.286.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function gN6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??yN6}}var $d$,yN6="https://ph.studio.decocms.com",Zd$;var Xd$=D(()=>{U8();b50();VC();$9();R$();r51();sl$();$d$=new H1;$d$.get("/",($)=>{let Z={version:el$.version,theme:Bi1(),...EH().logo&&{logo:EH().logo},...YN()&&{internalUrl:dC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Yy$(),posthog:gN6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:js()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Zd$=$d$});function pu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function D71($){return(pu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Yd$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(pu($))}&sz=${Z}`}function Qd$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Gd$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,K=Y?.trim()?Qd$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Qd$(`How does ${X} really perform? ${J}`,200);return{title:G,description:K}}import{z as l0}from"zod";var Kv,hN6,uN6,cN6,lN6,Jd$;var Kd$=D(()=>{Kv=l0.enum(["good","bad","neutral"]),hN6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:Kv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),uN6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(hN6)),cN6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},lN6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:Kv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:Kv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:Kv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:Kv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(uN6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:Kv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:Kv.optional()})).min(1)})]),Jd$=l0.object({...cN6,template:lN6})});function FT0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Jd$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var L71=D(()=>{Kd$()});import{join as Wd$}from"path";async function mN6($){try{let Z=await fetch(`${GW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(dN6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=FT0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((K)=>K.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||D71($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function OG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function iN6($,Z){let X=pu($),Q=Z?.brand?.trim()||D71(X),Y=Yd$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:K,description:W}=Gd$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${OG(K)}</title>`,`<meta name="description" content="${OG(W)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${OG(K)}" />`,`<meta property="og:description" content="${OG(W)}" />`,`<meta property="og:url" content="${OG(J)}" />`,`<meta property="og:image" content="${OG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${OG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${OG(K)}" />`,`<meta name="twitter:description" content="${OG(W)}" />`,`<meta name="twitter:image" content="${OG(F)}" />`,`<meta name="twitter:image:alt" content="${OG(H)}" />`,`<link rel="canonical" href="${OG(J)}" />`,`<link rel="icon" href="${OG(Y)}" sizes="any" />`].join(`
     `)}function pN6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Fd$($){let Z=new H1;return Z.get("/:domain/og.png",async(X)=>{let Q=pu(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(Wd$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${GW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(nN6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?Wd$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let K=await mN6(pu(Q)),W=iN6(Q,K);return X.html(pN6(J,W),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var dN6=2500,nN6=1e4;var Hd$=D(()=>{U8();L71();YE();R$()});function Us($,Z){return fetch(`${GW({})}${$}`,Z)}async function tN6($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await Us(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:K,drops:W}=FT0(J);return{status:K.slides.length?"ready":"empty",deck:K,scanned_at:J.scanned_at,drops:W}}var oN6,uN,Nd$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Ud$;var Bd$=D(()=>{U8();hY();YE();L71();oN6=new Set(["complete","errored","terminated","unknown"]),uN=new H1;uN.use("*",async($,Z)=>{let X=await X8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});uN.use("/link-token/*",Nd$);uN.use("/suggest",Nd$);uN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await tN6(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});uN.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Us("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${QE({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let K=await J.json(),W=K.blocked?{state:"blocked"}:K.status==="fresh"?{state:"fresh"}:K.mode==="sync"?{state:"sync"}:{state:"running",id:K.id??null};return $.json(W)}catch{return $.json({error:"run failed"},502)}});uN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Us(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${QE({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:oN6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});uN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Us(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});uN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Us(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});Ud$=uN});import{createHmac as rN6,timingSafeEqual as aN6}from"crypto";function Dd$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let F of Z.split(",")){let H=F.indexOf("=");if(H<=0)continue;let N=F.slice(0,H).trim(),U=F.slice(H+1).trim();if(N==="t")Y=U;else if(N==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>sN6)return!1;let K=rN6("sha256",X).update(`${Y}.${$}`).digest("hex"),W=Buffer.from(K,"hex");return G.some((F)=>{let H=Buffer.from(F,"hex");return W.length===H.length&&aN6(W,H)})}function Ld$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=fJ(Z),Q=fJ(fJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:EF(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function wd$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function EF($){return typeof $==="string"?$:void 0}function fJ($){return typeof $==="object"&&$!==null?$:void 0}function HT0($){return typeof $==="number"?new Date($*1000):null}function j71($){return EF($)??EF(fJ($)?.id)}function eN6($){return j71($.subscription)??EF(fJ(fJ($.parent)?.subscription_details)?.subscription)}function $U6($){let Z=HT0($.current_period_end);if(Z)return Z;let X=fJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=fJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function w71($,Z){let X=HT0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function E71($,Z){let X=HT0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function ZU6($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=EF(fJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(EF(fJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(EF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=EF(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let K=Number(fJ(X.metadata)?.creditCents);if(!Number.isInteger(K)||K<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:fJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:K,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(EF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=j71(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(w71(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:j71(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:E71(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=EF(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&w71(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":wd$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:$U6(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:E71(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=eN6(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(w71(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:HT0(X.period_end),lastStripeEventAt:E71(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function XU6($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:wd$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function Od$($,Z){let X=XU6($,Z);if(!X)return;vY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:Pn1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Ed$($){let Z=new ZW(r8().db),X=await ZU6(Z,$);if(!(X.handled&&X.topUp))Od$($,X);if(X.handled&&X.topUp)await yE$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),Od$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await he1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof uY&&(Q.status===400||Q.status===404)))throw Q}return X}var sN6=300;var jd$=D(()=>{lG();C4();O50();BE();C01()});var QU6=1048576,z71;var zd$=D(()=>{U8();UF();R$();jd$();z71=new H1;z71.post("/webhook",p5({maxSize:QU6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=b0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!Dd$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=Ld$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Ed$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as YU6}from"crypto";function JU6($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return YU6(Buffer.from(Y),Buffer.from(Q))}var GU6=5242880,P71;var Pd$=D(()=>{U8();UF();u3();P71=new H1;P71.post("/webhook",p5({maxSize:GU6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!JU6(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let K=(await Mn0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:K})})});function Ad$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Td$,KU6,WU6,Rd$;var Id$=D(()=>{U8();E3();Bg();tx();Td$=new H1,KU6=["range","if-none-match","if-modified-since"],WU6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Td$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(ju($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new $$(401,{message:"Authentication required"})}if(!X)throw new $$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new $$(400,{message:"Missing file key"});let Y=await Wt(Q,Z);if(!Y)throw new $$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&pG()){let W=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!W)throw new $$(500,{message:"Invalid data URL from storage"});let[,F,H]=W,N=Buffer.from(H,"base64"),U=new Headers({"Content-Type":F,"Cache-Control":"private, max-age=86400"});return Ad$(U,F),new Response(N,{status:200,headers:U})}let G=new Headers;for(let W of KU6){let F=$.req.header(W);if(F)G.set(W,F)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new $$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new $$(502,{message:"Upstream storage error"});let K=new Headers;for(let W of WU6){let F=J.headers.get(W);if(F)K.set(W,F)}return K.set("Cache-Control","private, max-age=86400"),Ad$(K,K.get("content-type")??""),new Response(J.body,{status:J.status,headers:K})});Rd$=Td$});var Bs=_((Wv)=>{var FU6=Wv&&Wv.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),HU6=Wv&&Wv.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))FU6(Z,$,X)};Object.defineProperty(Wv,"__esModule",{value:!0});HU6(EY(),Wv)});var kd$=_((qd$)=>{Object.defineProperty(qd$,"__esModule",{value:!0});qd$.version=void 0;qd$.version="3.4.0"});var Cd$=_((jF)=>{var NU6=jF&&jF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(jF,"__esModule",{value:!0});jF.NodeTransport=jF.VERSION=void 0;jF.nodeResolveHost=wU6;var s6=Bs(),UU6=j0("net"),A71=j0("tls"),BU6=j0("path"),Vd$=j0("fs"),OU6=NU6(j0("dns")),DU6=kd$();jF.VERSION=DU6.version;var LU6="nats.js";class Sd${socket;version;lang;yields=[];signal=(0,s6.deferred)();closedNotification=(0,s6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=LU6,this.version=jF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,s6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,K=J===!0&&Z.tls!==null;if(!Q&&(G||K))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw s6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new s6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,K=J==="ECONNREFUSED"?new s6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),K}}dial($){let Z=(0,s6.deferred)(),X,Q=(0,UU6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=s6.DataBuffer.concat(...this.yields),Y=(0,s6.extractProtocolMessage)(Q);if(Y!=="")try{let G=s6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s6.deferred)();try{if($=(0,BU6.resolve)($),!(0,Vd$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Vd$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let K=await this.loadFile(Z);if(K)$.cert=K}else if(X)$.cert=X;if(G){let K=await this.loadFile(G);if(K)$.key=K}else if(J)$.key=J;if(Q){let K=await this.loadFile(Q);if(K)$.ca=[K]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(K){return Promise.reject(K)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,s6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new s6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s6.deferred)();try{let Y=(0,A71.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new s6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,s6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new s6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,s6.deferred)();try{let Q=(0,A71.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new s6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof A71.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s6.render)($)}`);let Z=(0,s6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,s6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,s6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}jF.NodeTransport=Sd$;function wU6($){let Z=(0,s6.deferred)();return OU6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var xd$=_((bd$)=>{Object.defineProperty(bd$,"__esModule",{value:!0});bd$.connect=EU6;var _d$=Cd$(),vd$=Bs(),fd$=Bs();function EU6($={}){if((0,fd$.hasWsProtocol)($))return Promise.reject(fd$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,vd$.setTransportFactory)({factory:()=>{return new _d$.NodeTransport},dnsResolveFn:_d$.nodeResolveHost}),vd$.NatsConnectionImpl.connect($)}});var yd$=_((cN)=>{var zU6=cN&&cN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),PU6=cN&&cN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))zU6(Z,$,X)};Object.defineProperty(cN,"__esModule",{value:!0});cN.connect=void 0;var AU6=xd$();Object.defineProperty(cN,"connect",{enumerable:!0,get:function(){return AU6.connect}});PU6(Bs(),cN)});function cd$($){let Z=$?.connectFn??qU6,X=null,Q=null,Y=!1,G=!1,J=!1,K=[];function W(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function F(){console.log(`[NatsProvider] fireReady: ${K.length} callbacks`);for(let U of K)try{U()}catch{}}function H(U){(async()=>{for await(let B of U.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,F()})().catch(()=>{})}async function N(U,B){let O=0;while(!G)try{X=await Z({servers:U,timeout:IU6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,H(X),F();return}catch{O++;let L=aZ(RU6,TU6,O-1,2,0.5);await L$(L)}}return{init(U,B){if(Y)return;Y=!0,G=!1;let O=B?.creds?gd$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;N(U,O).catch(()=>{})},isConnected(){return W()},getConnection(){return W()?X:null},getJetStream(){if(!W())return null;if(!Q)Q=ud$.jetstream(X);return Q},onReady(U){if(K.push(U),W())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function qU6($){return hd$.connect($)}var gd$,hd$,ud$,TU6=100,RU6=3000,IU6=3000;var ld$=D(()=>{K4();gd$=V(wc(),1),hd$=V(yd$(),1),ud$=V(KL(),1)});function T71($,Z){return`${$}.${Z}`}class R71{cache;constructor($){this.cache=$u({ttlMs:$?.ttlMs??MU6,maxSize:$?.maxSize??kU6})}async get($,Z){return this.cache.get(T71($,Z))??null}async set($,Z,X){this.cache.set(T71($,Z),X)}async invalidate($,Z){this.cache.delete(T71($,Z))}teardown(){this.cache.clear()}}var MU6=600000,kU6=5000;var dd$=()=>{};function NT0($,Z){return`${$}:${Z}`}function I71($){let Z=$u({ttlMs:$?.ttlMs??VU6,maxSize:$?.maxSize??SU6}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function K(W,F){let H=X?.();if(!H)return;try{H.publish(md$,Y.encode(JSON.stringify({organizationId:W,keyId:F,originId:Q})))}catch(N){console.warn("[ProviderKeyCache] Publish failed (non-critical):",N)}}return{get(W,F){return Z.get(NT0(W,F))},set(W,F,H){Z.set(NT0(W,F),H)},invalidate(W,F){Z.delete(NT0(W,F)),K(W,F)},start(){if(J)return;let W=X?.();if(!W)return;J=W.subscribe(md$),(async()=>{for await(let F of J)try{let H=JSON.parse(G.decode(F.data));if(H.originId===Q)continue;Z.delete(NT0(H.organizationId,H.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var md$="studio.ai-provider-keys.invalidate",VU6=30000,SU6=5000;var id$=()=>{};class q71{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder,Q=Z.subscribe("studio.decopilot.cancel");this.subscription=Q,(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var pd$=($)=>{let Z;return()=>Z??=$()},M71,k71;var nd$=D(()=>{I6();M71=pd$(()=>w$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),k71=pd$(()=>w$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function yU6($=UT0){return{name:WN,subjects:[`${or0}.>`],storage:DK.StorageType.File,max_age:vU6,max_bytes:bU6,max_msgs_per_subject:xU6,discard:DK.DiscardPolicy.Old,retention:DK.RetentionPolicy.Limits,duplicate_window:fU6,num_replicas:$}}class rd${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function td$($){let Z=od$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function cU6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((K)=>{if(X++,_U6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,K)})},get errorCount(){return X}}}function lU6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class V71{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Q,Y)=>{let G=yU6(Y);try{await Q.streams.info(WN),await Q.streams.update(WN,G)}catch(J){if(J instanceof Error&&J.message.includes("stream not found"))await Q.streams.add(G);else if(J instanceof Error&&/can ?not change.*storage|storage type/i.test(J.message))await Q.streams.delete(WN),await Q.streams.add(G);else throw J}},X=await y6(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await DK.jetstreamManager($);try{await Z(Q,UT0)}catch(Y){if(UT0<=1||!lU6(Y))throw Y;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${UT0} (${Y.message}); falling back to an unreplicated stream`),await Z(Q,1)}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Rg});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=cU6(Z,Q),J=!1,K=()=>{if(J)return;J=!0;let F=kB$(Z);Y.publish(F.subject,F.data).catch(()=>{})};X.addEventListener("abort",K,{once:!0});let W=(F)=>{let H=performance.now(),N=ar0(F,{runId:Z}),U=performance.now()-H;M71().record(U),k71().add(1,{"org.id":Q??"unknown"}),uU6?.record(U,N.reduce((B,O)=>B+O.data.length,0));for(let B of N)G.publish(Y,B.subject,B.data,B.headers?td$(B.headers):void 0)};return(async()=>{let F=$.getReader(),H=0,N=0,U;try{while(!0){let{done:B,value:O}=await F.read();if(B)break;if(W(O),N++,++H>=64)H=0,await new Promise((L)=>setImmediate(L))}}catch(B){U=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(F.releaseLock(),K(),hU6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:N,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishSerialized($,Z){try{return await y6(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:td$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Rg}),!0}catch(X){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,X),!1}}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=ar0(Z,{runId:$,dedup:X});M71().record(performance.now()-Y),k71().add(1);for(let J of G)if(!await this.publishSerialized(Q,J))return!1;return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=MB$({runId:$,fenceToken:Z,finalSeq:X});return await this.publishSerialized(Q,Y)}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?DK.DeliverPolicy.New:DK.DeliverPolicy.All,G=X?.closeOnDone??!1,J=aO($),K;try{K=await y6(async()=>{return(await Q.consumers.get(WN,{filter_subjects:J,deliver_policy:Y})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Rg})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let H=iL0({messages:async function*(){try{for await(let L of K)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{K.stop()}}(),onCancel:()=>K.stop()}).pipeThrough(cL0()).pipeThrough(lL0()).getReader(),N=!1,U=()=>{if(N)return;N=!0;try{H.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,K.stop(),H.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await H.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(G){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(WN,{filter:aO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var DK,od$,CU6=($)=>{let Z;return()=>Z??=$()},_U6,vU6=86400000000000,fU6=120000000000,bU6=4294967296,UT0,xU6=500000,gU6,hU6,uU6;var ad$=D(()=>{K4();sr0();pL0();dL0();I6();nd$();DK=V(KL(),1),od$=V(wc(),1),_U6=CU6(()=>w$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),UT0=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);gU6=process.env.STREAM_ENCODE_TRACE==="1",hU6=process.env.DECOPILOT_STREAM_TRACE==="1";uU6=gU6?new rd$:null});function BT0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,gK(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var sd$=D(()=>{_8()});class S71{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function ed$($,Z,X){let Q=Z.organizationId;if(Z.status!=="in_review")return!1;if(!IC(X))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Q))return!1;let Y=await $.storage.organizationSettings.get(Q),G=BW(Y?.flags),J=await $.storage.taskBoard.update(Z.id,Q,{status:G},Z.updatedBy);return await z6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G,reason:"pr_merged"}}),u$(Q,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${G}`),!0}var $m$=D(()=>{m6();KX();Hg();E5()});function oU6($){return $ instanceof nX}function rU6($,Z){return Z-$>=nU6}class C71{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??dU6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??iU6,X=this.options.itemIntervalMs??mU6,Q=new Date(Date.now()-X),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Q),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:K}of Y)try{if(await this.reconcileItem(J,K,Q))$++}catch(W){console.error(`[task-board-review-sweeper] ${J} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-Dt0),Oo0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-tU6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Uo0(this.taskBoard,Y,Q),await Bo0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==Y8)continue;let K=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!K)continue;await XN(K,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),oU6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+pU6)).catch((K)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,K))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),u$(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!rU6(SH(X),Date.now()))return;await fW($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,X){if(!await this.taskBoard.claimSweep($,Z,X))return!1;let Q=await this.taskBoard.getById($,Z);if(!Q)return!1;if(Q.status!=="in_review")return!1;let Y=Q.assigneeId===Y8,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Q.assignedBy??Q.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,Q);return!1}let K=await Promise.all(G.map(async(W)=>({...W,...await Ug(Z,W)})));if(K.every((W)=>W.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${K.length} PR(s)) \u2014 proceeding on unknown`);if(await ed$(J,Q,K))return!0;if(await OO$(J,Q))return!0;if(!Y)return!1;if(!fo0(K))return!1;return await QL0(J,Q,{previewMatchesHead:bo0(K)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var dU6=60000,mU6=300000,iU6=50,pU6=60000,nU6=900000,tU6=120000;var Zm$=D(()=>{m6();Io0();$N();Vt();$m$();E5();rG();Do0();eY();Yt()});import{readdir as aU6,rm as OT0}from"fs/promises";import{join as DT0}from"path";async function LT0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-sU6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await Fv($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Xm$($,Y,Z);else if(!Y.startsWith(".")){let G=DT0($,Y),J=await Fv(G);for(let W of J){if(!/^\d{4}$/.test(W))continue;X+=await Xm$(G,W,Z)}if((await Fv(G)).length===0)await OT0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Xm$($,Z,X){let Q=0,Y=DT0($,Z),G=await Fv(Y);for(let K of G){if(!/^\d{2}$/.test(K))continue;let W=DT0(Y,K),F=await Fv(W);for(let N of F){if(!/^\d{2}$/.test(N))continue;let U=new Date(`${Z}-${K}-${N}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let B=DT0(W,N);await OT0(B,{recursive:!0,force:!0}),Q++}}if((await Fv(W)).length===0)await OT0(W,{recursive:!0,force:!0})}if((await Fv(Y)).length===0)await OT0(Y,{recursive:!0,force:!0});return Q}async function Fv($){try{return(await aU6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var sU6=30;var _71=()=>{};import{DBOS as v71,SchedulerMode as eU6}from"@dbos-inc/dbos-sdk";async function ZB6(){let $=[xJ(),Hv(),TF()],Z=0;for(let X of $)try{Z+=await LT0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function XB6($,Z){await v71.runStep(()=>ZB6(),{name:"monitoringRetention"})}function Ym$(){if(Qm$)return;Qm$=!0;let $=v71.registerWorkflow(XB6,{name:"monitoringRetentionWorkflow"});v71.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:$B6,mode:eU6.ExactlyOncePerIntervalWhenActive})}var $B6="23 4 * * *",Qm$=!1;var Gm$=D(()=>{OY();_71()});function Jm$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await FJ.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await Ut($.db,Z,Q.role);return Y.boundAuth=v51({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new cw(X,void 0,Y.boundAuth,Q.role,"self"),cO(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Km$=D(()=>{lw();lO()});function QB6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function YB6(){return{services:QB6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function JB6(){for(let $ of GB6)$()}function Wm$($){let Z=[...f71.logs,$];f71={...f71,logs:Z.length>500?Z.slice(-500):Z},JB6()}function b71(){return KB6}var f71,GB6,KB6=!1;var x71=D(()=>{f71=YB6(),GB6=new Set});import{EventEmitter as WB6}from"events";var y71;var Fm$=D(()=>{x71();y71=new WB6;y71.on("request",($)=>{Wm$($)})});function Hm$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let B=nu(U.params.name),O=U.params.arguments||{},L=Object.keys(O).map((E)=>nu(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${J5.tool}${B}${J5.dim}(${w})${J5.reset}`}else if(U.method)G=`${J5.dim}${nu(U.method)}${J5.reset}`}}catch{}}let K=nu(Y);if(Y.startsWith("/mcp/conn_")){let H=Y.split("/")[2]??"";K=`/mcp/${J5.mcp}${nu(H.slice(0,12))}\u2026${J5.reset}`}else if(Y==="/mcp")K=`${J5.mcp}/mcp${J5.reset}`;else if(Y==="/mcp/registry")K=`${J5.mcp}/mcp/registry${J5.reset}`;let W=HB6(Q),F=J?"\u25C0":"\u2190";if(!b71())console.log(`${J5.dim}${F}${J5.reset} ${W}${Q}${J5.reset} ${K}${G?` ${G}`:""}`);try{await Z()}finally{let H=Date.now()-X,N=$.res.status,U=FB6(N),B=H<1000?`${H}ms`:`${(H/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!b71())console.log(`${J5.dim}${O}${J5.reset} ${W}${Q}${J5.reset} ${K}${G?` ${G}`:""} ${U}${N}${J5.reset} ${J5.duration}${B}${J5.reset}`);y71.emit("request",{method:Q,path:nu(Y),status:N,duration:H,timestamp:new Date})}}}var J5,FB6=($)=>{if($>=500)return J5.serverError;if($>=400)return J5.clientError;if($>=300)return J5.redirect;return J5.ok},HB6=($)=>{return J5[$]||J5.reset},nu=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Nm$=D(()=>{x71();Fm$();J5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Dm$}from"crypto";import{mkdir as NB6,readdir as UB6,rm as Um$,stat as Lm$}from"fs/promises";import{join as h71,relative as BB6}from"path";import{z as P$}from"zod";function Em$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return h71(OB6,Z)}function jm$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function g71($,Z){let X=Em$($),Q=jm$(Z);return h71(X,Q)}function DB6($,Z,X,Q){let Y=b0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return Dm$("sha256",Y).update(G).digest("hex")}function Om$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=DB6(Z,X,G,Y),K=new URL(`/api/dev-assets/${Z}/${jm$(X)}`,$);return K.searchParams.set("expires",G.toString()),K.searchParams.set("signature",J),K.searchParams.set("method",Y),K.toString()}function zm$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${Dm$("md5","etag").update(Q).digest("hex")}"`}async function Pm$($,Z,X,Q,Y){try{let G=await UB6($,{withFileTypes:!0});for(let J of G){let K=h71($,J.name),F=BB6(Z,K).replace(/\\/g,"/");if(X&&!F.startsWith(X))continue;if(J.isDirectory())if(Q){let H=F+"/";if(!X||H.startsWith(X)){if(!(X?F.slice(X.length):F).includes("/"))Y.commonPrefixes.add(H)}}else await Pm$(K,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let H=F.slice(X.length);if(H.includes(Q)){let N=H.indexOf(Q),U=X+H.slice(0,N+1);Y.commonPrefixes.add(U);continue}}try{let H=await Lm$(K);Y.objects.push({key:F,size:H.size,lastModified:H.mtime.toISOString(),etag:zm$(K,H.mtime,H.size)})}catch{}}}}catch{}}function Am$($,Z){let Q=t($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",K=G.maxKeys??1000,W=G.delimiter,F=G.continuationToken,H=Em$(Q);await NB6(H,{recursive:!0});let N={objects:[],commonPrefixes:new Set};await Pm$(H,H,J,W,N),N.objects.sort((w,E)=>w.key.localeCompare(E.key));let U=0;if(F){if(U=N.objects.findIndex((w)=>w.key>F),U===-1)U=N.objects.length}let B=N.objects.slice(U,U+K),O=U+K<N.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(N.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=g71(Q,G.key),K=await Lm$(J);return{contentType:j91(G.key),contentLength:K.size,lastModified:K.mtime.toISOString(),etag:zm$(J,K.mtime,K.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??Bm$;return{url:Om$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??Bm$;return{url:Om$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let G=Y,J=g71(Q,G.key);try{return await Um$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let G=Y,J=[],K=[];return await Promise.all(G.keys.map(async(W)=>{let F=g71(Q,W);try{await Um$(F),J.push(W)}catch(H){K.push({key:W,message:H instanceof Error?H.message:"Unknown error"})}})),{deleted:J,errors:K}}}]}async function u71($,Z,X){let Q=Am$(Z,X),Y=new iK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:N5});for(let J of Q){let K="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,W=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:K,outputSchema:W,annotations:J.annotations,_meta:J._meta},async(F)=>{try{let H=await J.handler(F);return{content:[{type:"text",text:JSON.stringify(H)}],structuredContent:H}}catch(H){return{content:[{type:"text",text:`Error: ${H.message}`}],isError:!0}}})}let G=new YQ({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),EJ(Y,G,$,"mcp:dev-assets")}async function Tm$($,Z,X,Q){let G=Am$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var OB6="./data/assets",Bm$=3600,wm$,Rm$;var Im$=D(()=>{R$();Sg();U8();ud();nC();gX();NA0();wm$=new H1;wm$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return u71($.req.raw,Z,Q)});Rm$=wm$});var qm$={};J4(qm$,{mountDevRoutes:()=>LB6});function LB6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return u71(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,K=Q.req.param("toolName");if(!K)return Q.json({error:"Missing tool name"},400);let W=await Q.req.json(),F=await Tm$(K,W,Y,J);if(F.isError)return Q.json(F.content,500);return Q.json(F.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Rm$);let X=new H1;X.use("*",BK({mountPath:"/api/dev-assets"})),X.route("/",HA0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var Mm$=D(()=>{U8();U91();NA0();Im$()});import{sql as wB6}from"kysely";import{randomUUID as km$}from"crypto";import{z as EB6}from"zod";async function zB6($){let Z=new Date().toISOString(),X=km$(),Q=C8.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((K)=>K.or([K("publisher","is",null),K("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((K)=>({id:km$(),event_id:X,subscription_id:K.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await wB6`SELECT
       pg_notify('studio_events', ${X}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.286.0",
+  "version": "4.286.2",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {