decocms 4.303.18 → 4.303.19

package/dist/server/server.js

@@ -1364,13 +1364,13 @@ ${G}`.trim().slice(0,KF$)}function xB4($){let Z=$.fields.priority?.name?.toLower
 
 ${O}`});if(!L)continue;try{await $.storage.jiraIntegrations.createCommentLink({commentId:L.id,organizationId:W,jiraCommentId:B.id})}catch(w){if(w.code==="23505"){await $.storage.taskBoard.deleteComment(L.id,W,yK);continue}throw w}}}class FF${ctx;organizationId;ids=new Map;constructor($,Z){this.ctx=$;this.organizationId=Z}async seed($){if($.length===0)return;let Z=await this.ctx.storage.sprints.upsertManyFromJira(this.organizationId,$.map(JF$));for(let[X,Q]of Z)this.ids.set(X,Q)}async localIdFor($){if(!$)return null;let Z=this.ids.get($.id);if(Z)return Z;let X=await this.ctx.storage.sprints.upsertFromJira(this.organizationId,JF$($));return this.ids.set($.id,X),X}}function JF$($){return{jiraSprintId:$.id,name:$.name,state:$.state,startsAt:$.startsAt,endsAt:$.endsAt}}function yB4($,Z){if($.size===0)return[];return Z.filter((X)=>!$.has(X.jiraIssueId))}async function gB4($,Z,X,Q){let Y=Z.organizationId,G=await X.searchIssueIds(`(${Q}) AND issuetype IN standardIssueTypes()`);if(G.size===0)return console.warn(`[jira] scope for org ${Y} came back empty \u2014 skipping reconciliation rather than archiving the whole board`),0;let J=yB4(G,await $.storage.jiraIntegrations.listLinkedIssuesOnBoard(Y));if(J.length===0)return 0;for(let W of J){let K=await $.storage.taskBoard.getById(W.itemId,Y);if(!K||K.status==="archived")continue;let F=await $.storage.taskBoard.update(W.itemId,Y,{status:"archived"},yK);await $.storage.taskBoard.recordActivity({taskBoardItemId:W.itemId,action:"status_changed",actorId:null,data:{from:K.status,to:"archived"}}),b$(Y,F),console.log(`[jira] ${W.jiraIssueKey} is no longer in board ${Z.boardId}'s scope \u2014 archived its card`)}return J.length}async function hB4($,Z){let{organizationId:X,boardId:Q}=Z;if(!Q)throw Error("No Jira board selected");let Y=await $.storage.organizationSettings.get(Z.organizationId),G=D7(Y?.flags,"org_board_columns"),J=await E5($,Z.organizationId),W=G?await SB4($,Z,Q):NK$(Z.statusMapping),K=new Set((await J.columns()).map((S)=>S.key));if(W.size===0)throw Error(G?"This Jira board has no columns to mirror":"No status mapping configured");let F=Z.lastSyncedAt===null||Z.rescanPending,H=new $G(Z.siteUrl,Z.email,Z.apiToken),{accountId:N}=await H.myself(),U=new Jo0(H),B=new Date,O=await H.getBoardScopeJql(Q),L=_B4(Z,O,B),w=new FF$($,X);await w.seed(await H.listBoardSprints(Q));let E={created:0,updated:0,unchanged:0,skipped:0,archived:0,unmappedStatuses:[]},j=new Set,z,A,P=0,I=0;while(P<Wo0&&I<WF$){I++;let S=await H.searchIssues({jql:L,nextPageToken:A});if(A=S.nextPageToken??void 0,S.issues.length===0){if(!A)break;continue}let m=await $.storage.jiraIntegrations.getLinksByIssueIds(X,S.issues.map((f)=>f.id));await U.resolve(S.issues.flatMap((f)=>[...Xt(f.fields.description),...(f.fields.comment?.comments??[]).flatMap((b)=>Xt(b.body))]));for(let f of S.issues){if(P>=Wo0)break;P++;let b=new Date(f.fields.updated);if(Number.isNaN(b.getTime()))throw Error(`Unparseable updated on ${f.key}`);let i=W.get(f.fields.status.name);if(!i||!QF$(f)){if(!i&&QF$(f))j.add(f.fields.status.name);E.skipped++,z=b;continue}let c=m.get(f.id);if(c&&vB4(c.jiraUpdatedAt,b,F)){E.unchanged++,z=b;continue}let a=f.fields.status.name,U0={title:f.fields.summary,description:await bB4(Z.siteUrl,f,U),priority:xB4(f),sprintId:await w.localIdFor(yK$(f.sprints)),boardColumnOrg:J.columnOwner()};if(c){let O0=c.jiraStatus!==a,s=await $.storage.taskBoard.getById(c.itemId,X),r=CB4({jiraStatusChanged:O0,currentStatus:s?.status??null,boardColumns:K}),j0=await $.storage.taskBoard.update(c.itemId,X,{...U0,...r?{status:i}:{}},yK);if(await $.storage.jiraIntegrations.touchLink(c.itemId,{jiraStatus:a}),s&&r&&s.status!==i)await $.storage.taskBoard.recordActivity({taskBoardItemId:c.itemId,action:"status_changed",actorId:null,data:{from:s.status,to:i}});if(O0&&!F)j0=await YF$($,Z,j0);await GF$($,Z,H,f,c.itemId,N,U),await $.storage.jiraIntegrations.touchLink(c.itemId,{jiraUpdatedAt:b}),b$(X,j0),E.updated++}else{let O0=await $.storage.taskBoard.create({organizationId:X,...U0,status:i,by:yK});try{await $.storage.jiraIntegrations.createLink({itemId:O0.id,organizationId:X,jiraIssueId:f.id,jiraIssueKey:f.key,jiraUpdatedAt:new Date(0),jiraStatus:a})}catch(s){if(s.code==="23505"){await $.storage.taskBoard.delete(O0.id,X,yK),E.unchanged++,z=b;continue}throw s}if(!F)O0=await YF$($,Z,O0);await GF$($,Z,H,f,O0.id,N,U),await $.storage.jiraIntegrations.touchLink(O0.id,{jiraUpdatedAt:b}),b$(X,O0),E.created++}z=b}if(!A)break}E.unmappedStatuses=[...j].sort();let k=fB4(P,I);if(!k)E.archived=await gB4($,Z,H,O);let M=F&&k;if(z===void 0&&P===0)return{counts:E,watermark:B,rescanPending:M};return{counts:E,watermark:z,rescanPending:M}}var yK="jira",Wo0=500,kB4=5,WF$=25,KF$=1e4,VB4;var oD0=D(()=>{c9();aY();C6();WN();j5();tD0();at0();VB4={highest:"urgent",high:"high",medium:"medium",low:"low",lowest:"low"}});var HF$={};J4(HF$,{setJiraSyncRuntime:()=>No0,registerJiraSyncWorkflow:()=>Bo0,maybeEnqueueJiraStatusPush:()=>ZO4,enqueueJiraCommentPush:()=>Uo0});import{DBOS as QQ,SchedulerMode as uB4}from"@dbos-inc/dbos-sdk";function No0($){rD0=$}function Yt(){if(!rD0)throw Error("[jira] sync runtime not initialized \u2014 setJiraSyncRuntime() must run before the workflow fires");return rD0}function KN(){let{db:$,encryptionKey:Z}=Yt();return new qC($,new SY(Z))}function lB4(){return new XQ(Yt().db)}async function dB4($){try{let{db:Z}=Yt(),X=await KN().getById($);if(!X)return{id:$,error:"integration no longer exists"};if(!X.enabled)return{id:$};let Q=await p3(Z,X.organizationId);if(!Q)return{id:$,error:"organization no longer exists"};let Y=await Wg(Q,X);return"error"in Y?{id:$,error:Y.error}:{id:$}}catch(Z){return{id:$,error:Z instanceof Error?Z.message:String(Z)}}}async function mB4($,Z){let X=await QQ.runStep(()=>KN().listEnabledIds(),{name:"loadJiraIntegrations"});for(let Q of X){let Y=await QQ.runStep(()=>dB4(Q),{name:`syncJira:${Q}`});if(Y.error)console.warn(`[jira] sync ${Y.id} failed: ${Y.error}`)}}async function pB4($){let Z=KN();if(!(await Z.getByOrg($.organizationId))?.enabled)return null;let Q=await Z.getLinkByItemId($.taskBoardItemId,$.organizationId);if(!Q)return null;if(await Z.hasCommentLink($.commentId))return null;return{jiraIssueId:Q.jiraIssueId}}async function nB4($){return(await Yt().db.selectFrom("organization").select("slug").where("id","=",$).executeTakeFirst())?.slug??null}async function tB4($,Z,X){let Q=await KN().getByOrg($);if(!Q?.enabled)return null;let G=(await p3(Yt().db,$))?.orgFs;if(!G)return null;let J=new $G(Q.siteUrl,Q.email,Q.apiToken);return ZF$(X,{read:(W)=>G.read(W.volume,W.path).catch((K)=>{if(K instanceof SG)return null;throw K}),listAttachments:()=>J.listAttachments(Z),upload:(W)=>J.addAttachment(Z,W),mediaIdFor:(W)=>J.resolveMediaId(W)})}async function oB4($,Z,X){let Q=KN(),Y=await Q.getByOrg($.organizationId);if(!Y?.enabled)return null;let G=await Q.getLinkByItemId($.taskBoardItemId,$.organizationId);if(!G)return null;if(await Q.hasCommentLink($.commentId))return null;return(await new $G(Y.siteUrl,Y.email,Y.apiToken).addComment(G.jiraIssueId,Z,{header:`${$.authorLabel} \xB7 via Studio:`,media:new Map(X)})).id}async function rB4($,Z){try{await KN().createCommentLink({commentId:$.commentId,organizationId:$.organizationId,jiraCommentId:Z})}catch(X){if(X.code!=="23505")throw X}}async function aB4($){let Z=$.body.slice(0,iB4),X=await QQ.runStep(()=>pB4($),{name:"resolveCommentTarget",retriesAllowed:!0,maxAttempts:3});if(!X)return;let Q=[],Y=TK$(Z);if(Y.length>0){let J=await QQ.runStep(()=>nB4($.organizationId),{name:"readOrgSlug",retriesAllowed:!0,maxAttempts:3});for(let W of $F$(Y,J??""))try{let K=await QQ.runStep(()=>tB4($.organizationId,X.jiraIssueId,W),{name:`attachCommentImage:${W.name}`,retriesAllowed:!0,maxAttempts:3});if(K)Q.push([W.target,K])}catch(K){if(!KK$(K))throw K;console.warn(`[jira] could not attach ${W.ref.path}:`,K)}}let G=await QQ.runStep(()=>oB4($,Z,Q),{name:"postCommentToJira",retriesAllowed:!1});if(!G)return;await QQ.runStep(()=>rB4($,G),{name:"recordCommentLink",retriesAllowed:!0,maxAttempts:4})}async function sB4($){let Z=KN(),X=await Z.getByOrg($.organizationId);if(!X?.enabled)return null;let Q=await Z.getLinkByItemId($.itemId,$.organizationId);if(!Q)return null;let Y=await lB4().getById($.itemId,$.organizationId);if(!Y)return null;if(ht0(X.statusMapping,Y.status,Q.jiraStatus))return null;let J=await new $G(X.siteUrl,X.email,X.apiToken).listTransitions(Q.jiraIssueId),W=BK$({mapping:X.statusMapping,lane:Y.status,currentJiraStatus:Q.jiraStatus,availableTransitions:J.map((F)=>F.to.name)});if(W.kind!=="transition"){if(W.kind==="unreachable")console.warn(`[jira] ${Q.jiraIssueKey} is ${Y.status} on the board, but its workflow offers no transition to ${W.targets.join(" / ")} \u2014 `+"the card will not move on the Jira board");return null}let K=J.find((F)=>F.to.name===W.targetName);if(!K)return null;return{jiraIssueId:Q.jiraIssueId,transitionId:K.id,targetName:W.targetName}}async function eB4($,Z){let X=KN(),Q=await X.getByOrg($.organizationId);if(!Q?.enabled)return;let Y=await X.getLinkByItemId($.itemId,$.organizationId);if(!Y||Y.jiraStatus===Z.targetName)return;let G=new $G(Q.siteUrl,Q.email,Q.apiToken);if(await G.getStatusName(Z.jiraIssueId)===Z.targetName){await X.touchLink($.itemId,{jiraStatus:Z.targetName});return}await G.transitionIssue(Z.jiraIssueId,Z.transitionId),await X.touchLink($.itemId,{jiraStatus:Z.targetName})}async function $O4($){let Z=await QQ.runStep(()=>sB4($),{name:"resolveStatusTransition",retriesAllowed:!0,maxAttempts:3});if(!Z)return;await QQ.runStep(()=>eB4($,Z),{name:"executeStatusTransition",retriesAllowed:!0,maxAttempts:3})}function ZO4($,Z){if(Z.updatedBy===yK)return;if(!Ho0||!rD0)return;let X=Ho0;(async()=>{if(!await KN().getLinkByItemId(Z.id,$))return;await QQ.startWorkflow(X,{queueName:sD,workflowID:`jira-status:${Z.id}:${Z.status}:${Date.parse(Z.updatedAt)}`,enqueueOptions:{queuePartitionKey:$}})({organizationId:$,itemId:Z.id})})().catch((Q)=>{console.warn(`[jira] status push enqueue failed for ${Z.id}:`,Q instanceof Error?Q.message:Q)})}async function Uo0($,Z){try{if(!Fo0)return;if(!await $.storage.jiraIntegrations.getLinkByItemId(Z.taskBoardItemId,Z.organizationId))return;await QQ.startWorkflow(Fo0,{queueName:sD,workflowID:`jira-cmt-push:${Z.commentId}`,enqueueOptions:{queuePartitionKey:Z.organizationId}})(Z)}catch(X){console.warn(`[jira] comment push enqueue failed for ${Z.commentId}:`,X instanceof Error?X.message:X)}}function Bo0(){if(Ko0)return;Ko0=QQ.registerWorkflow(mB4,{name:"jiraSyncWorkflow"}),QQ.registerScheduled(Ko0,{name:"jiraSyncWorkflow",crontab:cB4,mode:uB4.ExactlyOncePerIntervalWhenActive}),Fo0=QQ.registerWorkflow(aB4,{name:"jiraCommentPushWorkflow"}),Ho0=QQ.registerWorkflow($O4,{name:"jiraStatusPushWorkflow"})}var cB4="2-59/10 * * * *",rD0=null,iB4=30000,Ko0=null,Fo0=null,Ho0=null;var aD0=D(()=>{FK$();xU();Yg();uD0();fK();Gw();tD0();XF$();tt0();oD0()});function sD0($,Z,X,Q){xY({event:$,organizationId:Z,properties:{task_id:X.id,reports_task:xQ(X),...Q}})}function b$($,Z){_5.emit($,{id:crypto.randomUUID(),type:X0$,source:"task-board",subject:Z.id,data:Z,time:new Date().toISOString()}),Promise.resolve().then(() => (aD0(),HF$)).then((X)=>X.maybeEnqueueJiraStatusPush($,Z)).catch((X)=>{console.warn("[jira] status push hook unavailable:",X)})}function NF$($,Z){_5.emit($,{id:crypto.randomUUID(),type:Q0$,source:"task-board",subject:Z,data:{id:Z},time:new Date().toISOString()})}function XO4($,Z){return $?[$]:Z}async function VC($,Z,X){let Q=$.metadata?.runMetadata?.taskBoardItemId,Y=!Q&&X?await $.storage.taskBoard.linkedTaskIds(X,Z):[];return XO4(Q,Y)}async function UF$($,Z,X){let Q=$.organization?.id;if(!Q)return;try{for(let Y of await VC($,Q,X)){let G=await $.storage.taskBoard.getById(Y,Q),J=IC(Z),W=IC(G?.status??"");if(!G||J!==null&&W!==null&&J<=W)continue;let K=await $.storage.taskBoard.update(Y,Q,{status:Z},$.auth?.user?.id??G.updatedBy);if(await $.storage.taskBoard.recordActivity({taskBoardItemId:Y,action:"status_changed",actorId:null,data:{from:G.status,to:Z}}).catch((F)=>console.error("[task-board] activity log write failed",F)),b$(Q,K),Z==="in_progress")sD0("task_run_started",Q,K,{from:G.status})}}catch(Y){console.error("[task-board] run transition failed",Y)}}async function eD0($,Z){let X=$.organization?.id;if(!X)return;try{for(let Q of await VC($,X,Z)){let Y=await $.storage.taskBoard.openReviewCycleIfInProgress(Q,X);if(!Y)continue;b$(X,Y),sD0("task_run_completed",X,Y,{from:"in_progress",via:"pr_open"})}}catch(Q){console.error("[task-board] review-cycle open failed",Q)}}async function $L0($,Z,X,Q){let Y=$.organization?.id;if(!Y)return;try{let G=yD0(Z);if(!G)return;let J=await VC($,Y,Q);for(let W of J)await $.storage.taskBoard.linkPr({taskBoardItemId:W,organizationId:Y,url:G.url,prNumber:G.number,repoOwner:G.owner,repoName:G.repo,connectionId:X??null})}catch(G){console.error("[task-board] PR capture failed",G)}}async function Kg($,Z,X,Q){try{let Y=await $.advanceLinkedTasksToReviewOnThreadFinish(Z,X);for(let G of Y)b$(X,G),sD0("task_run_completed",X,G,{from:"in_progress",via:"thread_finish"});for(let G of Y)await $.clearRunRetry(G.id,X).catch(()=>{})}catch(Y){console.error("[task-board] thread-finish transition failed",Y)}await Oo0($,Z,X),await Do0($,Q,Z,X)}function BF$($){return(IC($.status)??-1)>=hD0.in_review||Boolean($.reviewCycleStartedAt)}async function Oo0($,Z,X){try{let Q=await $.failedRunInfo(Z,X);if(!Q)return;let Y=ZK$(Q);for(let G of await $.linkedTaskIds(Z,X)){let J=await $.getById(G,X);if(!J)continue;if(BF$(J))await $.relabelDeliveredFailure(Z,X,GO4).catch(()=>{});if(J.status!=="in_progress")continue;if(J.reviewCycleStartedAt)continue;if(J.threads.some((F)=>F.hasMessages&&F.status==="in_progress"))continue;let W=J.retryAttempts;if(W<Y){let F=sZ(YO4,QO4,W,2,0.5);if(!await $.scheduleRunRetry(G,X,W+1,new Date(Date.now()+F)))continue;await $.recordActivity({taskBoardItemId:G,action:"status_changed",actorId:null,data:{from:"in_progress",to:"in_progress",retry:W+1,of:Y,reason:Q.errorText??Q.kind}}).catch(()=>{});continue}let K=await $.returnToTodoAfterFailure(G,X,J.updatedBy);if(!K)continue;await $.recordActivity({taskBoardItemId:G,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q.errorText??Q.kind,retriesSpent:W}}).catch(()=>{}),b$(X,K),sD0("task_run_failed",X,J,{reason:Q.kind??"error",retries_spent:W})}}catch(Q){console.error("[task-board] failed-run reaction failed",Q)}}async function Do0($,Z,X,Q){try{for(let Y of await $.linkedTaskIds(X,Q)){let G=await $.getById(Y,Q);if(!G)continue;if(BF$(G))continue;if(G.threads.some((W)=>W.hasMessages&&(W.status===null||!en.has(W.status))))continue;if((await $.listPrs(Y,Q)).length>0)continue;await W0$(Z,Q,Y)}}catch(Y){console.error("[task-board] quota refund pass failed",Y)}}async function Lo0($,Z){if(Z.status!=="in_progress"||!aQ(Z))return;try{let X=await $.storage.taskBoard.update(Z.id,Z.organizationId,{status:"in_review"},Z.updatedBy);await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:"in_review"}}).catch(()=>{}),b$(Z.organizationId,X)}catch(X){console.error(`[task-board] parking ${Z.id} for review failed`,X)}}async function gK($,Z,X){let Q=Z.organizationId;if(Z.assigneeId!==X8)return!1;try{await Lo0($,Z);let Y=await $.storage.taskBoard.unassignSuperAgent(Z.id,Q,Z.updatedBy);if(!Y)return!1;return await z6($,{taskBoardItemId:Z.id,action:"assignee_changed",actorId:null,data:{from:Z.assigneeId,to:null,reason:X}}),console.warn(`[task-board] ${Z.id} handed to a human: ${X}`),b$(Q,Y),!0}catch(Y){return console.error(`[task-board] handing ${Z.id} to a human failed`,Y),!1}}async function OF$($,Z,X){if(!(X instanceof tX))return!1;if(X.reason!=="runs_exhausted")return!1;return await gK($,Z,"per-task run limit reached \u2014 the Super Agent can no longer re-dispatch "+"itself on this task. Re-run it manually to continue."),!0}async function DF$($,Z){let X=$.organization?.id;if(!X)return;try{let Q=await $.storage.taskBoard.reopenLinkedTasksOnThreadRun(Z,X);for(let Y of Q)b$(X,Y)}catch(Q){console.error("[task-board] thread-run reopen failed",Q)}}function LF$($){return $.includes("create_pull_request")||$.includes("createPullRequest")}function wF$($){if(JO4.test($))return!0;return WO4.test($)&&KO4.test($)}var QO4=30000,YO4=120000,GO4="Run ended after it had already delivered \u2014 the task moved on without it",JO4,WO4,KO4;var j5=D(()=>{eG();S4();fK();Qg();XK$();W4();an();C6();KX();bK();JO4=/\bgh\s+pr\s+create\b/,WO4=/api\.github\.com\/repos\/[^\s"']+\/pulls\b/,KO4=/(?:-X|--request)\s+POST/});function FO4($){if($.status==="completed")return"advance";if($.status==="failed"&&$.messageStorageVersion===2&&($.harnessId==="decopilot"||$.harnessId==="claude-code"))return"nudge";return"none"}function HO4($){return["This task is still In Progress on the board and your last run ended without finishing it.","","Look at what you already did (`git log`, `git status`, and the messages above), then either:","- finish the remaining work (and open the PR, if it needed code changes),","- or, if it's actually done, say so in one line \u2014 the board moves the card for you,",$==="decopilot"?"- or, if you're blocked on something only a human knows, call the `user_ask` tool.":"- or, if you're blocked on something only a human knows, say what you need and stop.","","Don't start over and don't redo work you already committed or pushed. You are on the same branch as before \u2014 push to it and update your existing pull request rather than opening a second one."].join(`
 `)}async function NO4($,Z,X){await $g($,Z,X,{messageId:`stall-nudge-${Z.id}-${X.id}`,prompt:HO4(X.harness_id),workflowID:`stall-nudge:${Z.id}:${X.id}`})}async function UO4($,Z){let X=await $.storage.threads.get(Z);if(!X)return{action:"none",thread:null};return{action:FO4({status:X.status,messageStorageVersion:X.message_storage_version,harnessId:X.harness_id}),thread:X}}function BO4($,Z=Date.now()){if($.status!=="in_progress")return!1;if($.run_started_at)return!1;return on($,Z)}async function OO4($,Z){let X=[];for(let Q of Z.threads){if(Q.status!=="in_progress")continue;let Y=await $.storage.threads.get(Q.threadId);if(!Y||!BO4(Y))continue;if(await $.storage.threads.markRunFailed(Q.threadId,wo0,"abandoned"))X.push(Q.threadId),console.warn(`[task-board] failed never-started thread ${Q.threadId} on ${Z.id}`)}return X}async function EF$($,Z){let X=$.organization?.id;if(!X)return;for(let Q of Z){if(Q.status==="in_progress")try{if((await OO4($,Q)).length>0)continue}catch(J){console.error(`[task-board] reaping threads for ${Q.id} failed`,J)}let Y;try{Y=Q.repo!=null&&(await $.storage.taskBoard.listPrs(Q.id,X)).length>0}catch(J){console.error(`[task-board] listPrs for ${Q.id} failed`,J);continue}if(!xt0(Q,Y))continue;let G=Q.threads.find((J)=>J.hasMessages);if(!G)continue;try{let{action:J,thread:W}=await UO4($,G.threadId);if(J==="none"||!W)continue;if(J==="advance")await Kg($.storage.taskBoard,G.threadId,X,$.storage.organizationBilling);else await NO4($,Q,W)}catch(J){console.error(`[task-board] stall recovery failed for ${Q.id}`,J)}}}var wo0="Run never started \u2014 no pod picked it up before the idle window elapsed";var Eo0=D(()=>{CD0();fK();j5()});import{z as BJ}from"zod";var DO4,SC;var jo0=D(()=>{aY();M0();_Q();m3();Eo0();DO4=BJ.object({key:BJ.string(),title:BJ.string(),position:BJ.number(),role:BJ.string().nullable()}),SC=u({name:"TASK_BOARD_ITEM_LIST",description:"List all task board items for the organization, plus the `owner/name` repos this organization has imported (the valid values for a task's `repo` field).",annotations:{title:"List Task Board Items",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BJ.object({}),outputSchema:BJ.object({items:BJ.array(ny),repos:BJ.array(BJ.string()),sprints:BJ.array(SJ$),columns:BJ.array(DO4)}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let[Q,{items:Y},G,J]=await Promise.all([Z.storage.taskBoard.list(X),Z.storage.connections.list(X,{slug:"mcp-github"}),Z.storage.sprints.listByOrg(X),E5(Z,X).then((K)=>K.columns())]),W=Je1(Y);return EF$(Z,Q),{items:Q,repos:W,sprints:G,columns:J}}})});import{z as ZG}from"zod";function EO4($){return wO4.some((Z)=>$[Z]!==void 0)}function jO4($,Z){let X=[];for(let{field:G,action:J}of LO4){if(Z[G]===$[G])continue;X.push({action:J,data:{from:$[G],to:Z[G]}})}if(Z.description!==$.description)X.push({action:"description_changed"});let Q=new Set($.tags.map((G)=>G.id));if(Z.tags.length!==$.tags.length||Z.tags.some((G)=>!Q.has(G.id)))X.push({action:"tags_changed",data:{from:$.tags,to:Z.tags}});return X}function zO4($,Z){if($!==X8)return!1;if(!Z)return!1;return Z.assigneeId!==X8?!0:Z.status==="todo"}function AO4($,Z,X){let Q=$!==void 0&&PO4.has($),Y=Z!==void 0&&aQ(Z);return X&&Q&&Y}function zo0($,Z){return $!==void 0&&gt0($)&&!Z}var LO4,wO4,PO4,CC;var ZL0=D(()=>{aY();M0();c9();m3();bK();un0();WN();KX();uO();j5();Qg();eG();LO4=[{field:"status",action:"status_changed"},{field:"assigneeId",action:"assignee_changed"},{field:"priority",action:"priority_changed"},{field:"type",action:"type_changed"},{field:"dueDate",action:"due_date_changed"},{field:"title",action:"title_changed"}],wO4=["title","description","status","priority","type","assigneeId","repo","dueDate","sortOrder","tagIds"];PO4=new Set(["approved","merged","post_deploy_validation","done","archived"]);CC=u({name:"TASK_BOARD_ITEM_UPDATE",description:"Update a task board item's fields (title, description, status, priority, assignee), and/or link a chat thread to it.",annotations:{title:"Update Task Board Item",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ZG.object({id:ZG.string(),title:ZG.string().min(1).max($D0).optional(),description:ZG.string().max(eO0).nullable().optional(),status:sH.optional(),priority:wC.optional(),type:fn.optional(),assigneeId:ZG.string().nullable().optional(),repo:ZG.string().max(ZD0).nullable().optional(),dueDate:ZG.string().datetime().nullable().optional(),sortOrder:ZG.number().optional(),tagIds:ZG.array(ZG.string()).max(1000).optional(),linkThreadId:ZG.string().optional(),prUrl:ZG.string().nullable().optional().describe("GitHub pull request URL to link to this task, e.g. https://github.com/owner/repo/pull/123. Pass it after opening a PR for an existing card; linking one is what starts its review.")}),outputSchema:ZG.object({item:ny}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.prUrl?tO($.prUrl):null;if($.prUrl&&!Q)throw Error(`Not a GitHub pull request URL: ${$.prUrl} (expected https://github.com/<owner>/<repo>/pull/<number>)`);if($.assigneeId)await XD0(Z,X,$.assigneeId);if($.linkThreadId){if(!await Z.storage.taskBoard.getById($.id,X))throw Error(`Task board item not found: ${$.id}`);if(!await Z.storage.threads.get($.linkThreadId))throw Error(`Thread not found: ${$.linkThreadId}`);await Z.storage.taskBoard.linkThread($.id,$.linkThreadId,X)}let Y=EO4($),G=Y?await Z.storage.taskBoard.getById($.id,X):null;if(Y&&!G)throw Error(`Task board item not found: ${$.id}`);let J=await E5(Z,X);if($.status!==void 0)await aO0(J,$.status);if($.status!==void 0&&gt0($.status)){let N=await Z.storage.organizationSettings.get(X);if(zo0($.status,D7(N?.flags,"delivery_lanes_enabled")))throw Error("Delivery lanes are not enabled for this organization \u2014 enable "+"them in Settings before moving a task to Approved, Merged, or Post-deploy Validation.")}let W=aH.getStore()!==void 0;if(AO4($.status,G??void 0,W))throw Error("This task is under review \u2014 a run can't move it to Done or Archived. "+"Leave it for the reviewer; only a person, or TASK_BOARD_REVIEW_DECISION on a reviewer's own run, closes out a task under review.");let K=$.assigneeId!==void 0&&$.assigneeId!==(G?.assigneeId??null),F=zO4($.assigneeId,G);if(G&&xQ(G)){if($.title!==void 0||$.description!==void 0||$.priority!==void 0)throw Error("This task was generated from your report and can't be edited \u2014 create your own task instead.");if(F)await Fy(Z,G,NO())}if($.tagIds!==void 0){let N=await Z.storage.tags.listOrgTags(X),U=new Set(N.map((B)=>B.id));for(let B of $.tagIds)if(!U.has(B))throw Error(`Tag not found: ${B}`);await Z.storage.taskBoard.setItemTags($.id,$.tagIds,o0(Z))}let H;if(Y)H=await Z.storage.taskBoard.update($.id,X,{title:$.title,description:$.description,status:F?"todo":$.status,...$.status!==void 0||F?{boardColumnOrg:J.columnOwner()}:{},priority:$.priority,type:$.type,assigneeId:$.assigneeId,assignedBy:K?$.assigneeId?o0(Z):null:void 0,repo:$.repo,dueDate:$.dueDate,sortOrder:$.sortOrder},o0(Z));else{let N=await Z.storage.taskBoard.getById($.id,X);if(!N)throw Error(`Task board item not found: ${$.id}`);H=N}if(Q)await Z.storage.taskBoard.linkPr({taskBoardItemId:H.id,organizationId:X,url:Q.url,prNumber:Q.number,repoOwner:Q.owner,repoName:Q.repo,connectionId:null});if(G){let N=o0(Z),U=jO4(G,H);if(U.length>0)await QK$(Z,U.map((B)=>({taskBoardItemId:H.id,actorId:N,...B,alsoSubscribe:B.action==="assignee_changed"&&H.assigneeId!==X8?[H.assigneeId]:void 0})))}if(G&&H.description!==G.description)await Z.storage.notifications.notifyMentions({taskBoardItemId:H.id,organizationId:X,actorId:o0(Z),body:H.description??"",previousBody:G.description});if(Y||$.linkThreadId||Q)b$(X,H);if(F)await sO(Z,H,{userInitiated:!0});return{item:H}}})});import{z as XL0}from"zod";var _C;var Po0=D(()=>{M0();j5();_C=u({name:"TASK_BOARD_ITEM_DELETE",description:"Delete a task board item. A reports-pushed task also dismisses its finding, so the next diagnostic import won't re-create the card.",annotations:{title:"Delete Task Board Item",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:XL0.object({id:XL0.string()}),outputSchema:XL0.object({success:XL0.boolean()}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.taskBoard.delete($.id,X,o0(Z)??"system"))throw Error(`Task board item not found: ${$.id}`);return NF$(X,$.id),{success:!0}}})});function vC($){if($.length===0)return!1;let Z=new Map;for(let X of $){let Q=`${X.repoOwner}/${X.repoName}`.toLowerCase(),Y=Z.get(Q);if(Y)Y.push(X);else Z.set(Q,[X])}return[...Z.values()].every(TO4)}function TO4($){return $.some((Z)=>Z.merged===!0)&&$.every((Z)=>Z.merged===!0||Z.state==="closed")}async function RO4($,Z,X,Q){let Y=await $.storage.taskBoard.getById(X,Z);if(!Y||Y.status!=="done")return!1;let G=await $.storage.taskBoard.listPrs(X,Z),J=await Promise.all(G.map(async(H)=>({...H,...await Q($,Z,H)})));if(!vC(J))return!1;let W=await E5($,Z),K=await W.archiveColumn();if(!K)return!1;let F=await $.storage.taskBoard.update(X,Z,KJ(W,K),Y.updatedBy);return await z6($,{taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:"done",to:K,reason:"merged_pr_auto_archive"}}),b$(Z,F),!0}async function jF$($,Z,X,Q=YL0){let Y=0;for(let G of X)try{if(await RO4($,Z,G,Q))Y+=1}catch(J){console.error(`[task-board-archive] ${G} failed`,J)}return{archived:Y}}function QL0($){let Z=new Map;for(let{id:X,organizationId:Q}of $){let Y=Z.get(Q);if(Y)Y.push(X);else Z.set(Q,[X])}return[...Z].map(([X,Q])=>({organizationId:X,itemIds:Q}))}var Fg=D(()=>{aY();KX();XG();j5()});function GL0($){return $.replace(/\/api\/[^/\s)]+\/fs\/([^/\s)]+)\/read\?path=([^)\s]+)/g,(Z,X,Q)=>{let Y,G;try{Y=decodeURIComponent(X),G=decodeURIComponent(Q)}catch{return Z}let J=(W)=>W.startsWith("/")||W.split("/").includes("..");if(J(Y)||J(G))return Z;return IK(Y,G)})}function JL0($,Z){return Z===$?null:"The image and file links in that description are real paths in this sandbox, not URLs \u2014 `Read` them. A screenshot the task points at is usually the clearest statement of what it wants."}var Ao0=D(()=>{hE()});function IO4($){let Z=new Map($.map((G)=>[G.id,G])),X=new Map;for(let G of py($)){let J=zF$(G.owner,G.repo);X.set(J,[...X.get(J)??[],G])}if(X.size!==1)return null;let Q=[...X.values()][0],Y=Q.find((G)=>{let J=Z.get(G.connectionId);return J?EE(J):!1})??Q[0];return{connectionId:Y.connectionId,owner:Y.owner,name:Y.repo,installationId:Y.installationId,url:`https://github.com/${Y.owner}/${Y.repo}`}}async function WL0($,Z){if(!Ts())return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"hosted sandbox unavailable \u2014 running Decopilot"),null;try{let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"}),Q=IO4(X);if(Q)return{repo:Q};let Y=new Map;for(let J of py(X)){let W=zF$(J.owner,J.repo);if(!Y.has(W))Y.set(W,{connectionId:J.connectionId,repo:`${J.owner}/${J.repo}`})}let G=Y;if(G.size===0)return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"no importable repos \u2014 running Decopilot"),null;return console.warn(`[task-board] claude-code for org ${Z}: ${G.size} importable repos \u2014 the run picks one with TASK_ADD_REPO`),{choices:[...G.values()]}}catch(X){return console.warn("[task-board] repo lookup for claude-code failed",X),null}}function PF$($,Z,X){let Q=["You've been assigned this task. Complete it and finish with a pull request if it makes sense (like a coding task) or is explicitly requested.","","You are running AUTONOMOUSLY \u2014 no human is watching, so drive this to "+"completion yourself. Make reasonable decisions and move on; do not stop to ask for confirmation.","",`Title: ${$.title}`];if($.description){let Y=GL0($.description);Q.push("","Description:",Y);let G=JL0($.description,Y);if(G)Q.push("",G)}if(Q.push("",Z?`The repository ${Z.owner}/${Z.name} is already cloned at your working directory, on its own branch. \`git\` and \`gh\` are authenticated. ${qp}`:["Your working directory is EMPTY: this organization has several repositories, so nothing has been cloned yet. FIRST call `mcp__studio__TASK_ADD_REPO` with the connectionId of the repository this task is about. It clones that repository into your working directory and waits for the checkout, so once it returns the repository is there on its own branch and `git` and `gh` are authenticated. Do not read files, run `git`, or run `gh` before it returns; there is nothing there yet.","","Repositories in this organization:",...(X?.repoChoices??[]).map((Y)=>`- ${Y.repo} (connectionId: ${Y.connectionId})`),X?.repoChoices?.length?"Start with the one the task is about. If it turns out to need a change in "+"another of them too, call `mcp__studio__TASK_ADD_REPO` again \u2014 repositories "+"accumulate, so a second call adds a checkout beside the first rather than replacing it. Each lands in its own directory and keeps its own git remote, so open one pull request per repository you changed.":"Call `mcp__studio__TASK_ADD_REPO` with no arguments to list them."].join(`
-`),""),X?.resolveConflict&&X.pr)Q.push(`Pull request #${X.pr.number} (${X.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`gh pr checkout ${X.pr.number}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(X?.feedback)Q.push(X.pr?`A reviewer requested changes on pull request #${X.pr.number} (${X.pr.url}):`:"A reviewer requested changes on your previous work:",X.feedback,X.pr?`Check that branch out (\`gh pr checkout ${X.pr.number}\`) before editing, address the feedback, then push to update the SAME pull request \u2014 do NOT open a new one.`:"Address this feedback.","");else if(X?.pr)Q.push(`This task already has an open pull request #${X.pr.number} (${X.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.","");return Q.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(X?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is dead code, and it is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path (the dev server hot-reloads, so hit the route it renders) and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.","- For a VISUAL change that means LOOKING at it: `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders the page in headless Chromium \u2014 it reaches your own dev server on localhost, and unlike `curl` it runs the page's JS, so lazily-rendered sections are actually there. Then `Read` the file: a screenshot you never opened is not verification. It is already installed; do NOT look for playwright in the repo's `node_modules` or start a browser yourself.","- As soon as `gh pr create` prints the URL, call `mcp__studio__TASK_BOARD_ITEM_PR_LINK` with that url. Do this even if you also mention the PR in a comment \u2014 the reviewers are dispatched from the linked PR, not from your message.",'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),Q.join(`
+`),""),X?.resolveConflict&&X.pr)Q.push(`Pull request #${X.pr.number} (${X.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`gh pr checkout ${X.pr.number}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(X?.feedback)Q.push(X.pr?`A reviewer requested changes on pull request #${X.pr.number} (${X.pr.url}):`:"A reviewer requested changes on your previous work:",X.feedback,X.pr?`Check that branch out (\`gh pr checkout ${X.pr.number}\`) before editing, address the feedback, then push to update the SAME pull request \u2014 do NOT open a new one.`:"Address this feedback.","");else if(X?.pr)Q.push(`This task already has an open pull request #${X.pr.number} (${X.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.","");return Q.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(X?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is dead code, and it is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.","- Nothing is installed and NO dev server is running \u2014 this sandbox is a checkout. Usually you don't need one: read the code path end to end, run the repo's tests, and `curl` the LIVE site for how it behaves today. Only start a dev server if you must see YOUR change rendered \u2014 it is a cold start, so expect several minutes: launch it ONCE in the background and poll until it answers rather than guessing a sleep.","- For a VISUAL change that means LOOKING at it: `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders the page in headless Chromium \u2014 it reaches a dev server you started on localhost as well as any public URL, and unlike `curl` it runs the page's JS, so lazily-rendered sections are actually there. Then `Read` the file: a screenshot you never opened is not verification. It is already installed; do NOT look for playwright in the repo's `node_modules` or start a browser yourself.","- As soon as `gh pr create` prints the URL, call `mcp__studio__TASK_BOARD_ITEM_PR_LINK` with that url. Do this even if you also mention the PR in a comment \u2014 the reviewers are dispatched from the linked PR, not from your message.",'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),Q.join(`
 `)}var zF$=($,Z)=>`${$}/${Z}`.toLowerCase();var To0=D(()=>{oO0();_Q();C6();R$();Ao0()});import{createHmac as qO4,randomBytes as MO4,timingSafeEqual as kO4}from"crypto";function VO4(){if(KL0)return KL0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return KL0=$?Buffer.from($):MO4(32),KL0}function Ro0($,Z,X){return`rtok_${qO4("sha256",VO4()).update(`${$}:${Z}:${X.toISOString()}`).digest("base64url")}`}function AF$($,Z,X,Q){let Y=Buffer.from($),G=Buffer.from(Ro0(Z,X,Q));return Y.length===G.length&&kO4(Y,G)}var KL0=null;var Io0=D(()=>{R$()});import{createHash as SO4}from"crypto";function Gt($,Z){if($.status===null||TF$.has($.status))return!1;return!on({updated_at:$.lastActiveAt,last_progress_at:null},Z)}function CO4($,Z){return $.threads.some((X)=>!BK.some((Q)=>FO(X.title,Q))&&Gt(X,Z))}function fO4($,Z){return Z-$>=vO4}async function FL0($,Z,X){let Q=await $.storage.organizationSettings.get(Z.organizationId),Y=vH(Q?.flags);if(Y.length===0)return;if(CO4(Z,Date.now()))return;let G=D7(Q?.flags,"cheap_reviewer_model")?"reviewer":"default",J=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId),W=Z.reviewCycleStartedAt,K=fH(J,W),F=new Date(K),H=HO(J,{cycleStartedAt:W});await Promise.all(Y.map(async(N)=>{let U=H.has(N);if(!U){let O=cO4(J,K),L=uO4(Z,N,K,O);if(L){await iO4($,Z,N,L).catch((w)=>console.error(`[task-board] ${N} verdict nudge failed`,w));return}if(dO4(O,Date.now()))return}if(gO4(Z,N,K,Date.now(),U)){await gK($,Z,`${OK[N]} failed ${qo0} times on `+"this review \u2014 it will not be retried");return}if(X?.previewMatchesHead===!1){if(fO4(K,Date.now()))await gK($,Z,"the pull request's deploy preview is not showing its latest commit (its checks never went green), so the Reviewer cannot verify this change against what the PR actually does");return}if(hO4(Z,N,K,Date.now(),U))return;let B=bO4(Z,N,K,Date.now(),U);await tO4($,Z,N,F,B,G).catch((O)=>console.error(`[task-board] ${N} reviewer enqueue failed`,O))}))}function bO4($,Z,X,Q=Date.now(),Y=!0){return $.threads.filter((G)=>FO(G.title,Z)&&Mo0(G,Q,Y)&&new Date(G.createdAt).getTime()>=X).length}function xO4($,Z){if(!$||!Z||!("choices"in Z))return null;return Z.choices.find((X)=>X.repo===$)?.connectionId??null}function yO4($,Z,X){let Q=$.threads.filter((Y)=>FO(Y.title,Z)&&Y.status==="completed"&&new Date(Y.createdAt).getTime()<X).map((Y)=>new Date(Y.lastActiveAt).getTime()).filter((Y)=>Number.isFinite(Y));return Q.length===0?0:Math.max(...Q)}function Mo0($,Z,X=!0){if($.status==="failed")return!0;if($.status!==null&&TF$.has($.status))return!X;return $.status!==null&&!Gt($,Z)}function RF$($,Z,X,Q=Date.now()){return $.threads.filter((Y)=>{if(!FO(Y.title,Z))return!1;return Gt(Y,Q)||new Date(Y.createdAt).getTime()>=X})}function gO4($,Z,X,Q=Date.now(),Y=!0){let G=RF$($,Z,X,Q);return G.length>0&&G.every((J)=>Mo0(J,Q,Y))&&G.length>=qo0}function hO4($,Z,X,Q=Date.now(),Y=!0){let G=RF$($,Z,X,Q);if(G.length===0)return!1;if(G.some((W)=>Gt(W,Q)))return!0;let J=G.filter((W)=>Mo0(W,Q,Y));if(J.length>=qo0)return!0;return J.length!==G.length}function uO4($,Z,X,Q,Y=Date.now()){return $.threads.find((G)=>FO(G.title,Z)&&G.status==="completed"&&!Gt(G,Y)&&new Date(G.createdAt).getTime()>=X&&!Q.has(G.threadId))??null}function cO4($,Z){let X=new Map;for(let Q of $){if(Q.action!=="review_verdict_requested")continue;let Y=new Date(Q.occurredAt).getTime();if(Y<Z)continue;let G=Q.data?.threadId;if(typeof G==="string")X.set(G,Y)}return X}function dO4($,Z){for(let X of $.values())if(Z-X<lO4)return!0;return!1}function mO4($){return[`Your ${OK[$]} run ended without recording a decision, so the task is stuck: nothing ships and nobody is told why. A review that reaches no verdict is not a review.`,"","Do exactly ONE thing in this run and then stop:","- Call `TASK_BOARD_REVIEW_DECISION` now, with the verdict your review already reached and notes that say what you checked.","- Approve ONLY if you actually exercised the change and it holds. If you could not finish \u2014 a check never came back, a preview never rendered, you ran out of room \u2014 `request_changes` and say exactly what is unresolved. That hands the card to a person, which is the correct outcome for an unfinished review.","- Do NOT re-run the review, do NOT change any code, and do NOT wait on any background task: whatever you know right now is the verdict."].join(`
 `)}async function iO4($,Z,X,Q){let Y=await $.storage.threads.get(Q.threadId);if(!Y||Y.message_storage_version!==2)return;await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"review_verdict_requested",actorId:null,data:{reviewer:X,threadId:Q.threadId}}),console.warn(`[task-board] ${X} reviewer on ${Z.id} completed with no verdict \u2014 `+"asking for one"),await $g($,Z,Y,{messageId:`review-verdict-${Q.threadId}`,prompt:mO4(X),workflowID:`review-verdict:${Q.threadId}`,runClass:"reviewer"})}function pO4($,Z,X,Q){return`review:${$}:${Z}:${X.toISOString()}:${Q}`}function nO4($){return`thrd_${SO4("sha256").update($).digest("hex").slice(0,32)}`}async function tO4($,Z,X,Q,Y,G){let J=Z.organizationId,W=Ro0(Z.id,X,Q),K=await WL0($,J),F=K&&"repo"in K?K.repo:null,H=K!==null,N=yO4(Z,X,Q.getTime()),U=xO4(Z.repo,K),B=H?"mcp__studio__TASK_BOARD_ITEM_PRS_GET":"TASK_BOARD_ITEM_PRS_GET",O=H?"mcp__studio__TASK_BOARD_REVIEW_DECISION":"TASK_BOARD_REVIEW_DECISION",L=H?"mcp__studio__TASK_BOARD_COMMENT_CREATE":"TASK_BOARD_COMMENT_CREATE",w=H?"mcp__studio__TASK_BOARD_COMMENT_LIST":"TASK_BOARD_COMMENT_LIST",E=[_O4[X],"","You are running AUTONOMOUSLY \u2014 no human is watching this run. Making the "+'approve / request-changes call IS your job; you are the decision-maker, not an assistant asking a human to decide. NEVER use `user_ask` to ask whether to approve, or to confirm an obvious call ("Approve the PR?"). Reserve `user_ask` for a genuine, unresolvable blocker only a human can clear (e.g. a missing credential, or a requirement so ambiguous you '+"truly cannot judge the outcome) \u2014 that should be rare. When in doubt "+"between asking and deciding, DECIDE.","","Do NOT merge the pull request \u2014 the board does that itself once your "+"approval is in. Pushing fixes to the PR's own branch is expected of you; opening a second pull request, force-pushing, or touching any other ref is not."].join(`
 `),j=Z.description&&H?GL0(Z.description):Z.description,z=Z.description&&j?JL0(Z.description,j):null,A=[...H?[]:[E,""],`Task title: ${Z.title}`,j?`
 Task description:
 ${j}
-`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,F?`- The repository ${F.owner}/${F.name} is already cloned at your working directory and \`git\` and \`gh\` are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${qp}`:H?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${U?`with connectionId \`${U}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the connectionId of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and \`gh\` are authenticated once it returns. ${qp}`:"- Load the PR's repository to inspect / exercise the change.",`- ${ee1}`,...N>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${w}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(N).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change on the PR's deploy \`previewUrl\` (from \`${B}\`) \u2014 re-read it after your push so you get the preview of YOUR commit, and wait for it if it is still building. Deep-link to the page/route the task affects (not root). If you cannot render or exercise it, do NOT approve \u2014 \`request_changes\` with what's blocking.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against your own dev server on localhost). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification.",`- Record what you validated with \`${L}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
+`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,F?`- The repository ${F.owner}/${F.name} is already cloned at your working directory and \`git\` and \`gh\` are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${qp}`:H?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${U?`with connectionId \`${U}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the connectionId of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and \`gh\` are authenticated once it returns. ${qp}`:"- Load the PR's repository to inspect / exercise the change.",`- ${ee1}`,...N>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${w}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(N).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change on the PR's deploy \`previewUrl\` (from \`${B}\`) \u2014 re-read it after your push so you get the preview of YOUR commit, and wait for it if it is still building. Deep-link to the page/route the task affects (not root). If you cannot render or exercise it, do NOT approve \u2014 \`request_changes\` with what's blocking.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against a dev server you started on localhost \u2014 none is running by default, this pod is a checkout). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification.",`- Record what you validated with \`${L}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
 
 | Before | After |
 | --- | --- |
@@ -1478,7 +1478,7 @@ ${$.description}
 `:"",Z?.resolveConflict&&Z.pr?[`Your pull request #${Z.pr.number} (${Z.pr.url}) is approved but can't be merged \u2014 it has a MERGE CONFLICT with its base branch.`,`Load the repo, CHECK OUT that PR's branch (e.g. \`gh pr checkout ${Z.pr.number}\`), then merge (or rebase) the base branch into it and resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one or start a new branch. Resolve conflicts by preserving BOTH sides' intent; never blindly discard either side. Change only what resolving the conflict requires.`,""].join(`
 `):Z?.feedback?[Z.pr?`A reviewer requested changes on the existing pull request #${Z.pr.number} (${Z.pr.url}):`:"A reviewer requested changes on your previous work:",Z.feedback,Z.pr?`Load the repo, then CHECK OUT that PR's branch (e.g. \`gh pr checkout ${Z.pr.number}\`) before editing, address the feedback, commit, and push to update the SAME pull request \u2014 do NOT open a new one or start a new branch.`:"Address this feedback.",""].join(`
 `):Z?.pr?[`This task already has an open pull request #${Z.pr.number} (${Z.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one or start a new branch. If you find it already does everything the task asks, say so and stop rather than changing it.",""].join(`
-`):"","How to work:","- First decide whether this task requires changing code in a repository. Some tasks (research, answering a question, planning) don't. If it doesn't, just do the work directly \u2014 don't load a repo or open a PR.",Z?.pr?"- If it DOES need code changes: use the `load_repo` tool to load the relevant repository, make the change, then commit and push to the pull request named above.":"- If it DOES need code changes: use the `load_repo` tool to load the relevant repository, then make the change, commit on a new branch, push, and open a pull request. Only then does a PR apply.","- Prefer the GitHub tool to open the PR. If it errors or targets the wrong repo, fall back to `git push` + the GitHub REST API (the auth token is embedded in the `origin` URL).","- If a dev server is running it hot-reloads your changes \u2014 don't restart it, hunt for its port, or run a full typecheck/build just to verify a small edit.","- Change only what the task needs. Don't trace the definition of a pre-existing symbol that's incidental to your change \u2014 note it in one line and move on. Prefer one or two broad searches over many narrow retries.","- Only if you hit a genuine blocker a human must clear (see above) may you call `user_ask` \u2014 otherwise keep going and finish the task.","",`(task id: ${$.id})`].join(`
+`):"","How to work:","- First decide whether this task requires changing code in a repository. Some tasks (research, answering a question, planning) don't. If it doesn't, just do the work directly \u2014 don't load a repo or open a PR.",Z?.pr?"- If it DOES need code changes: use the `load_repo` tool to load the relevant repository, make the change, then commit and push to the pull request named above.":"- If it DOES need code changes: use the `load_repo` tool to load the relevant repository, then make the change, commit on a new branch, push, and open a pull request. Only then does a PR apply.","- Prefer the GitHub tool to open the PR. If it errors or targets the wrong repo, fall back to `git push` + the GitHub REST API (the auth token is embedded in the `origin` URL).","- No dev server is running and dependencies are NOT installed \u2014 this sandbox is a checkout. Don't hunt for a port, and don't run a full typecheck/build just to verify a small edit.","- Change only what the task needs. Don't trace the definition of a pre-existing symbol that's incidental to your change \u2014 note it in one line and move on. Prefer one or two broad searches over many narrow retries.","- Only if you hit a genuine blocker a human must clear (see above) may you call `user_ask` \u2014 otherwise keep going and finish the task.","",`(task id: ${$.id})`].join(`
 `)}async function eA4($,Z,X){let Y=(await $.storage.taskBoard.listPrs(Z.id,Z.organizationId).catch(()=>[])).find((G)=>G.number===X);if(!Y)return null;return uF$($,Z.organizationId,Y).catch(()=>null)}async function $T4($,Z){let X=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId).catch(()=>[]);return Z0$(X)}function ZT4($){return $!=="closed"}async function XT4($,Z){let X=await $.storage.taskBoard.listPrs(Z.id,Z.organizationId).catch(()=>[]);for(let Q of X){let{state:Y}=await Ng(Z.organizationId,Q);if(ZT4(Y))return{number:Q.number,url:Q.url}}return}async function FN($,Z,X){let Q=await Y0$($,Z,X?.userInitiated?NO():void 0),Y="decopilot";try{let G=b0().taskBoardRerunReusesPrBranch,J=X?.pr??(G?await XT4($,Z):void 0),W=G&&J?await eA4($,Z,J.number):null,K=!X?.feedback&&!X?.resolveConflict,F=J&&K?await $T4($,Z):null,H=J&&J!==X?.pr||F?{...X,...J?{pr:J}:{},...F?{feedback:F}:{}}:X,N=await WL0($,Z.organizationId);if(N){Y="claude-code";let U="repo"in N?N.repo:null;await Jt($,Z,{title:`Super Agent: ${Z.title}`,...X?.runClass?{runClass:X.runClass}:{},...W?{pinnedRef:W}:{},prompt:PF$(Z,U,{...H,..."choices"in N?{repoChoices:N.choices}:{}}),temperature:0.5,harnessId:"claude-code",...U?{repo:U}:{}})}else await Jt($,Z,{title:`Super Agent: ${Z.title}`,...X?.runClass?{runClass:X.runClass}:{},prompt:sA4(Z,H),temperature:0.5,...W?{pinnedRef:W}:{}})}catch(G){throw await G0$($.storage.organizationBilling,Z.organizationId,Z.id,Q),G}await $.storage.taskBoard.supersedeFailedThreads(Z.id,Z.organizationId).catch((G)=>console.error("[task-board] superseding failed threads failed",G)),xY({event:"task_run_enqueued",organizationId:Z.organizationId,properties:{task_id:Z.id,reports_task:xQ(Z),claim:Q,harness:Y,...X?.runClass?{run_class:X.runClass}:{}}})}var WN=D(()=>{C6();eG();C6();S4();R$();Vo0();XG();Kt();To0()});import{z as iK}from"zod";var xC;var ho0=D(()=>{aY();M0();c9();m3();un0();WN();KX();j5();Qg();ZL0();xC=u({name:"TASK_BOARD_ITEM_CREATE",description:"Create a new task board item for the organization.",annotations:{title:"Create Task Board Item",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:iK.object({title:iK.string().min(1).max($D0),description:iK.string().max(eO0).nullable().optional(),status:sH.optional(),priority:wC.optional(),type:fn.optional(),assigneeId:iK.string().nullable().optional(),repo:iK.string().max(ZD0).nullable().optional(),dueDate:iK.string().datetime().nullable().optional(),tagIds:iK.array(iK.string()).max(1000).optional(),prUrl:iK.string().nullable().optional().describe("GitHub pull request URL to link to the new task, e.g. https://github.com/owner/repo/pull/123. Pass it right after you open a PR so the card lands on the board with its PR already attached for review.")}),outputSchema:iK.object({item:ny}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.prUrl?tO($.prUrl):null;if($.prUrl&&!Q)throw Error(`Not a GitHub pull request URL: ${$.prUrl} (expected https://github.com/<owner>/<repo>/pull/<number>)`);let Y=await E5(Z,X);if($.status!==void 0){await aO0(Y,$.status);let W=await Z.storage.organizationSettings.get(X);if(zo0($.status,D7(W?.flags,"delivery_lanes_enabled")))throw Error("Delivery lanes are not enabled for this organization \u2014 enable "+"them in Settings before creating a task in Approved, Merged, or Post-deploy Validation.")}if($.assigneeId)await XD0(Z,X,$.assigneeId);let G=$.assigneeId===X8;if($.tagIds?.length){let W=await Z.storage.tags.listOrgTags(X),K=new Set(W.map((F)=>F.id));for(let F of $.tagIds)if(!K.has(F))throw Error(`Tag not found: ${F}`)}let J=await Z.storage.taskBoard.create({organizationId:X,title:$.title,description:$.description??null,status:G?"todo":$.status,boardColumnOrg:Y.columnOwner(),priority:$.priority,type:$.type,assigneeId:$.assigneeId??null,assignedBy:$.assigneeId?o0(Z):null,repo:$.repo??null,dueDate:$.dueDate??null,by:o0(Z)});if($.tagIds?.length)await Z.storage.taskBoard.setItemTags(J.id,$.tagIds,o0(Z)),J=await Z.storage.taskBoard.getById(J.id,X);if(Q)await Z.storage.taskBoard.linkPr({taskBoardItemId:J.id,organizationId:X,url:Q.url,prNumber:Q.number,repoOwner:Q.owner,repoName:Q.repo,connectionId:null});return await z6(Z,{taskBoardItemId:J.id,action:"created",actorId:o0(Z),alsoSubscribe:[o0(Z),J.assigneeId===X8?null:J.assigneeId]}),await Z.storage.notifications.notifyMentions({taskBoardItemId:J.id,organizationId:X,actorId:o0(Z),body:J.description??""}),b$(X,J),await sO(Z,J),{item:J}}})});import{z as Ig}from"zod";var QT4,YT4,Ea0;var LO$=D(()=>{M0();aY();QT4=["in_review","archived"],YT4=Ig.enum(QT4),Ea0=u({name:"TASK_BOARD_COLUMN_ROLE_SET",description:"Say what one of this board's columns means to Studio, or unsay it. `in_review` is where a card sits while it is being reviewed; `archived` is where a finished card retires to, and a board with no archived column simply never archives. Pass null to clear. Only a board whose columns are "+"the org's own can be told this \u2014 Studio's own lanes already mean what "+"they say.",inputSchema:Ig.object({columnKey:Ig.string().min(1),role:YT4.nullable()}),outputSchema:Ig.object({columnKey:Ig.string(),role:Ig.string().nullable()}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await(await E5(Z,X)).columns();if(!Q.some((G)=>G.key===$.columnKey))throw Error(`This board has no column "${$.columnKey}" \u2014 it has ${Q.map((G)=>G.key).join(", ")||"none yet"}`);if(!await Z.storage.boardColumns.setRole(X,$.columnKey,$.role))throw Error("Only a board whose columns are the org's own can be given roles \u2014 "+"Studio's own lanes already mean what they say.");return{columnKey:$.columnKey,role:$.role}}})});import{z as $Y}from"zod";var wO$,ja0,za0,Pa0;var EO$=D(()=>{M0();aY();m3();wO$=$Y.object({columnKey:$Y.string(),prompt:$Y.string().nullable()}),ja0=u({name:"TASK_BOARD_AUTOMATION_LIST",description:"List what the board runs when a card lands in each of its columns. A "+"column with no rule is uneventful \u2014 nothing runs there.",inputSchema:$Y.object({}),outputSchema:$Y.object({automations:$Y.array(wO$)}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{automations:await Z.storage.columnAutomations.listByOrg(X)}}}),za0=u({name:"TASK_BOARD_AUTOMATION_UPSERT",description:"Run the agent on every card that lands in a column. Replaces the rule already on that column, if any. Omit `prompt` to use the agent's own instruction; give one to say what it should do there instead. The card's title and description are always included, so the prompt is the instruction, not the whole message.",inputSchema:$Y.object({columnKey:$Y.string().min(1).describe("A column of this board \u2014 see TASK_BOARD_ITEM_LIST."),prompt:$Y.string().max(VJ$).nullable().optional().describe("What to do with a card landing here; null for the default.")}),outputSchema:$Y.object({automation:wO$}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await(await E5(Z,X)).columns();if(!Q.some((G)=>G.key===$.columnKey))throw Error(`This board has no column "${$.columnKey}" \u2014 it has ${Q.map((G)=>G.key).join(", ")}`);let Y=$.prompt?.trim()?$.prompt.trim():null;return{automation:await Z.storage.columnAutomations.upsert(X,$.columnKey,Y)}}}),Pa0=u({name:"TASK_BOARD_AUTOMATION_DELETE",description:"Stop running the agent on cards landing in a column. Removing the rule IS the off switch, so a column cannot be configured-but-disabled.",inputSchema:$Y.object({columnKey:$Y.string().min(1)}),outputSchema:$Y.object({removed:$Y.boolean()}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{removed:await Z.storage.columnAutomations.remove(X,$.columnKey)}}})});import{z as sC}from"zod";var Aa0;var jO$=D(()=>{M0();Qg();j5();uO();Aa0=u({name:"TASK_BOARD_ITEM_PR_LINK",description:"Link the pull request you just opened to this run's task board item. Call this right after `gh pr create` succeeds, with the PR URL it printed. Reviewers (QA, code review) are dispatched from the linked PR, so a task whose PR is not linked never gets reviewed.",annotations:{title:"Link Pull Request to Task",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:sC.object({url:sC.string().describe("The pull request URL, e.g. https://github.com/owner/repo/pull/123")}),outputSchema:sC.object({url:sC.string(),prNumber:sC.number(),taskBoardItemIds:sC.array(sC.string())}),handler:async($,Z)=>{t(Z),await Z.access.check();let X=o(Z).id,{threadId:Q}=rO0(),Y=tO($.url);if(!Y)throw Error(`Not a GitHub pull request URL: ${$.url} (expected https://github.com/<owner>/<repo>/pull/<number>)`);let G=await VC(Z,X,Q);for(let J of G)await Z.storage.taskBoard.linkPr({taskBoardItemId:J,organizationId:X,url:Y.url,prNumber:Y.number,repoOwner:Y.owner,repoName:Y.repo}),await Z.storage.taskBoard.openReviewCycleIfInProgress(J,X),await Z.storage.taskBoard.clearSweepBudget(J,X);return{url:Y.url,prNumber:Y.number,taskBoardItemIds:G}}})});function PO$($){zO$=$}function Xw0($){zO$?.broadcast($)}var zO$=null;import{DBOS as Qw0}from"@dbos-inc/dbos-sdk";function GT4($,Z){let X=`thread-run:${Z}:`;if(!$.workflowID.startsWith(X))return null;let Q=$.input?.[0],Y=Q?.request;return{workflowId:$.workflowID,messageId:Y?.messageId??$.workflowID.slice(X.length),status:$.status==="PENDING"?"running":"queued",enqueuedAt:$.createdAt,...Q?.source!==void 0?{source:Q.source}:{}}}async function Ta0($){return(await Qw0.listWorkflows({workflow_id_prefix:`thread-run:${$}:`,status:["PENDING","ENQUEUED"],loadInput:!0,loadOutput:!1})).map((X)=>GT4(X,$)).filter((X)=>X!==null).sort((X,Q)=>X.enqueuedAt-Q.enqueuedAt)}async function AO$($,Z){if(!Z.startsWith(`thread-run:${$}:`))return!1;return await Qw0.cancelWorkflows([Z]),!0}async function qg($){let Z=await Qw0.listWorkflows({workflow_id_prefix:`thread-run:${$}:`,status:["PENDING"],loadInput:!1,loadOutput:!1});if(Z.length===0)return;await Qw0.cancelWorkflows(Z.map((X)=>X.workflowID))}var Yw0=()=>{};function KT4($){return/\b405\b/.test($)&&/not allowed on this repository/i.test($)}function HT4($,Z={}){if($==="failing")return!0;if($==="pending")return!Z.allowPendingChecks;return!1}async function NT4($,Z,X,Q,Y){if(FT4.has(Q))return;let J=(await $.storage.taskBoard.listActivity(X,Z).catch(()=>[])).at(-1);if(J?.action==="merge_failed"&&J.data?.reason===Q)return;await z6($,{taskBoardItemId:X,action:"merge_failed",actorId:null,data:{reason:Q,...Y?{detail:Y}:{}}})}function UT4($){if(!$?.isError)return{kind:"merged"};let Z=JSON.stringify($?.content)??"";if(KT4(Z))return{kind:"method_not_allowed",detail:Z};if(BL0(Z))return{kind:"rate_limited",detail:Z};return{kind:"refused",detail:Z}}async function BT4($,Z,X){let Q=await $.callTool({name:"merge_pull_request",arguments:{owner:Z.repoOwner,repo:Z.repoName,pullNumber:Z.number,merge_method:X}},void 0,{timeout:JT4});return UT4(Q)}async function Ct($,Z,X,Q={}){let Y=async(N,U)=>{return await NT4($,Z,X,N,U),{merged:!1,reason:N,...U?{detail:U}:{}}},G=await $.storage.taskBoard.listPrs(X,Z),J=await fC($,Z,G);if(!J)return console.warn(`[task-board] merge skipped \u2014 no linked PR on ${X}`),Y("no_pr");let W=await yF$($,Z,J);if(HT4(W,Q))return console.warn(`[task-board] merge blocked \u2014 checks ${W} on PR #${J.number}`),Y(W==="failing"?"checks_failing":"checks_pending");let K=`${J.repoOwner}/${J.repoName}`,F=await HN($,Z,J.connectionId,{owner:J.repoOwner,name:J.repoName});if(!F)return console.warn("[task-board] merge blocked \u2014 no active GitHub connection for "+`${K} (PR #${J.number})`),Y("no_connection",K);let H=await U5(F,$,!0);try{let N=null;for(let U of WT4){let B=await BT4(H,J,U);if(B.kind==="merged")return CF$(F.id),{merged:!0};if(B.kind==="rate_limited")return console.warn(`[task-board] merge rate-limited on PR #${J.number} \u2014 sweep retries`),Y("rate_limited",B.detail.slice(0,500));if(B.kind==="method_not_allowed"){console.warn(`[task-board] merge method '${U}' not allowed on ${K} \u2014 trying next`),N=B.detail;continue}return console.error(`[task-board] merge refused by GitHub on PR #${J.number}:`,B.detail),Y("refused",B.detail.slice(0,500))}return console.error(`[task-board] no merge method allowed on ${K} (PR #${J.number})`,N),Y("refused",N?.slice(0,500))}catch(N){let U=N instanceof Error?N.message:String(N);if(BL0(N))return Y("rate_limited",U);return console.error("[task-board] merge PR failed",N),Y("error",U)}finally{await H.close().catch(()=>{})}}async function _t($,Z,X){let Q=await $.storage.organizationSettings.get(Z),Y=vH(Q?.flags),G=await $.storage.taskBoard.listActivity(X,Z),J=await $.storage.taskBoard.getById(X,Z);return KO(G,Y,{cycleStartedAt:J?.reviewCycleStartedAt??null,verifiedOnly:!0})}async function OT4($,Z){let X=await $.storage.organizationSettings.get(Z.organizationId),Q=vH(X?.flags),Y=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId);if(!$0$(Y,Q,{cycleStartedAt:Z.reviewCycleStartedAt}))return;await gK($,Z,"every reviewer approved, but an approval could not be verified \u2014 "+"auto-merge is blocked and no reviewer can be re-dispatched this cycle")}function TO$($){return!$.merged&&$.reason==="refused"}function Ra0($,Z){if($!==null)return $;if(Z===null||!TO$(Z))return null;return(Z.detail??"").toLowerCase().includes("merge conflict")?!0:null}async function DT4($,Z,X){if(!TO$(X))return;let Q=Z.organizationId,Y=await $.storage.taskBoard.listPrs(Z.id,Q),G=await fC($,Q,Y);if(!G)return;await Hg($,Q,Z,{pr:{number:G.number,url:G.url},conflict:Ra0(await eO($,Q,G),X)}).catch((J)=>{console.error("[task-board] sweep conflict auto-resolve failed",J)})}async function RO$($,Z){let X=Z.organizationId;if(!aQ(Z))return!1;let Q=await $.storage.organizationSettings.get(X);if(Q?.flags?.auto_merge!==!0)return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,X))return!1;if(!await _t($,X,Z.id))return await OT4($,Z),!1;let Y=await Ct($,X,Z.id);if(!Y.merged)return await DT4($,Z,Y),!1;let G=DK(Q?.flags),J=await E5($,X),W=await $.storage.taskBoard.update(Z.id,X,KJ(J,G),Z.updatedBy);return await z6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G}}),b$(X,W),!0}var JT4=15000,WT4,FT4;var vt=D(()=>{qH();C6();KX();aY();Wt();XG();bK();j5();WT4=["merge","squash","rebase"];FT4=new Set(["checks_pending"])});import{z as Mg}from"zod";function wT4($){return $.threads.filter((Z)=>Z.status!==null&&!en.has(Z.status)).map((Z)=>Z.threadId)}async function ET4($,Z,X){let Q=(G)=>(J)=>console.error("[task-board] rerun takeover step failed",{threadId:Z,step:G,err:J});await $.storage.threads.setCancelRequested(Z,X).catch(Q("cancel-flag")),await jg(Z).catch(Q("background-jobs")),await qg(Z).catch(Q("gate-head"));let Y=await $.storage.threads.getRunFence(Z).catch(()=>null);if(Y)await aC(Z,Y).catch(Q("hosted-harness"));Xw0(Z)}function jT4($,Z){return $===!0&&So0(Z)}async function zT4($,Z,X){let Q=Z.organizationId,Y=await $.storage.taskBoard.listPrs(Z.id,Q).catch(()=>[]),G=await fC($,Q,Y).catch(()=>{return});if(!G)return!1;let J=await eO($,Q,G).catch(()=>null);return jT4(J,X)}function AT4($,Z,X){let Q=fH($,X),Y=0;for(let G of $){if(G.action!=="review_approved")continue;let J=new Date(G.occurredAt).getTime();if(J>=Q)Y=Math.max(Y,J)}return Z-Y>=PT4}async function TT4($,Z){if(!aQ(Z))return;if((await $.storage.organizationSettings.get(Z.organizationId))?.flags?.auto_merge!==!0)return;if(!await _t($,Z.organizationId,Z.id))return;let Y=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId).catch(()=>[]);if(AT4(Y,Date.now(),Z.reviewCycleStartedAt))return;if(await zT4($,Z,Y))return;throw Error("Every reviewer approved this task and its merge is retrying \u2014 re-running "+"would throw that away and start a new review cycle. Wait for the merge, or use the ship button if the PR needs a nudge.")}var LT4="Superseded by a manual re-run of this task",PT4=900000,Ia0;var IO$=D(()=>{M0();C6();fK();bK();JN();Yw0();zg();KX();j5();WN();vt();XG();Wt();eG();Ia0=u({name:"TASK_BOARD_ITEM_RERUN",description:"Re-run a task board item with the Super Agent, whatever lane it is in. Use this to retry a task that stalled, finished without doing the job, or is already assigned to the Super Agent (in which case re-assigning it does nothing). Fails any run still holding the task open, moves it to In Progress, and queues a fresh run.",annotations:{title:"Re-run Task",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!0},inputSchema:Mg.object({id:Mg.string().describe("The task board item to re-run.")}),outputSchema:Mg.object({status:Mg.string().describe("The task's lane after the re-run was queued."),supersededThreadIds:Mg.array(Mg.string()).describe("Runs that were failed to make room for this one.")}),handler:async({id:$},Z)=>{t(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.taskBoard.getById($,X);if(!Q)throw Error(`Task board item not found: ${$}`);if(Q.assigneeId!==X8)throw Error("Only a task assigned to the Super Agent can be re-run. Assign it to "+"the Super Agent instead \u2014 that queues a run by itself.");await TT4(Z,Q),await Fy(Z,Q,NO());let Y=[];for(let J of wT4(Q)){if(!await Z.storage.threads.failIfNotTerminal(J,LT4,"superseded"))continue;Y.push(J),await ET4(Z,J,X)}await Z.storage.taskBoard.closeReviewCycle($,X);let G=await Z.storage.taskBoard.update($,X,{status:"in_progress"},o0(Z));return await z6(Z,{taskBoardItemId:$,action:"status_changed",actorId:o0(Z),data:{from:Q.status,to:"in_progress",reason:"rerun"}}),b$(X,G),await FN(Z,G,{userInitiated:!0}),{status:G.status,supersededThreadIds:Y}}})});import{z as ft}from"zod";var qa0;var qO$=D(()=>{M0();eG();KX();j5();WN();XG();qa0=u({name:"TASK_BOARD_RESOLVE_CONFLICT",description:"Hand a task's pull request back to the Super Agent to resolve a merge conflict with its base branch. Use when a reviewed PR can't be shipped because it conflicts. Bounces the task to In Progress and queues a run that checks out the existing PR's branch, merges the base, resolves the conflicts, and pushes to the same PR.",annotations:{title:"Resolve Merge Conflict",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!0},inputSchema:ft.object({id:ft.string().describe("The task board item whose PR conflicts."),prNumber:ft.number().describe("The conflicting pull request's number, linked to this task.")}),outputSchema:ft.object({status:ft.string().describe("The task's lane after the resolution run was queued.")}),handler:async({id:$,prNumber:Z},X)=>{t(X),await X.access.check();let Q=X.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await X.storage.taskBoard.getById($,Q);if(!Y)throw Error(`Task board item not found: ${$}`);let J=(await X.storage.taskBoard.listPrs($,Q)).find((F)=>F.number===Z);if(!J)throw Error(`Pull request #${Z} is not linked to this task.`);if(await eO(X,Q,J).catch(()=>null)!==!0)throw Error("This pull request no longer has a merge conflict \u2014 refresh and try again.");await Fy(X,Y,NO());let K=await X.storage.taskBoard.claimConflictResolution($,Q,o0(X));if(!K)throw Error("Couldn't start conflict resolution \u2014 the task may have moved, been "+"reassigned, or already be resolving. Refresh and try again.");b$(Q,K);try{await FN(X,K,{pr:{number:J.number,url:J.url},resolveConflict:!0,runClass:"retry",userInitiated:!0})}catch(F){throw await X.storage.taskBoard.update(K.id,Q,{status:"in_review"},"system").then((H)=>b$(Q,H)).catch((H)=>console.error("[task-board] resolve-conflict status revert failed",H)),F}return await z6(X,{taskBoardItemId:$,action:"merge_conflict_resolution",actorId:null,data:{prNumber:J.number}}),{status:K.status}}})});function IT4($,Z){let X=$.filter((Q)=>Q.threadId===Z&&Q.body.trim().length>=RT4);if(X.length===0)return"missing";return X.some((Q)=>MO$(Q.body))?null:"no_screenshots"}function MO$($){return $.includes("![")||$.includes(Mp)}function qT4($){return MO$($)?null:"no_screenshots"}function MT4($,Z,X){let Q=Z==="approve"?"approved":"requested changes";return`**${OK[$]}** ${Q}:
 
 ${X.trim()}`}function kT4($){return[`Your ${OK[$]} comment carries no screenshots and does not declare the change free of any visual surface. One of the two is required \u2014 a pass on a visual change nobody can SEE is not a pass.`,"","Do exactly ONE thing in this run and then stop:","- Post a comment with `TASK_BOARD_COMMENT_CREATE` carrying the before/after screenshots you captured, embedded as markdown images referencing their `org/output/...` path, each pair in a two-column table.","- If the change genuinely has none, or you could not capture it (no deploy preview, the page would not render), write the exact words `"+Mp+"` in the comment instead, followed by one sentence naming why. That literal is what the check looks for \u2014 no paraphrase and no translation of it counts.","- Do NOT re-run the review, do NOT call `TASK_BOARD_REVIEW_DECISION` again (your verdict is already recorded), and do NOT change any code.","- If you have already posted such a comment, do nothing and say so."].join(`
@@ -2877,7 +2877,7 @@ Respond with the structured verdict and a short reason.`,dc$;var ic$=D(()=>{l4()
 ${G.join(`
 `)}`:Y}function LN6($){let Z=new Set;for(let X of $)for(let Q of X.split(`
 `)){let Y=Q.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var ql$=200,JN6=12,KN6,HN6=300,E71=3;var j71=D(()=>{dD();KT0();KN6={aheadBy:0,behindBy:0,files:[]}});function EN6($){if(!$||$.includes(".."))return!1;return wN6.test($)}function kl$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!EN6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Vl$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var wN6;var Sl$=D(()=>{wN6=/^[\w./@-]+$/});function Us($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Cl$($,Z,X,Q){if(!Q.connectionId)throw new Uv("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new Uv(J9);await kO({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(H)=>{let N=H instanceof Error?H.message:J9;throw new Uv(N)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await RK(Q.connectionId,Q.owner,Q.name,$.db,$.vault).catch((H)=>{let{code:N,message:U}=z5$(H instanceof Error?H.message:String(H));throw N?new Uv(U):H}),K=hu($),F=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!F.ok){let H=await MO(F,jN6).catch(()=>F.statusText);throw Error(`Failed to refresh sandbox git credentials (${F.status}): ${H}`)}}var jN6=10485760,Uv;var z71=D(()=>{YJ();aA0();Qn();Ui0();qy();Uv=class Uv extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function PN6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!zN6.test(Z))throw Error(`Invalid branch name: ${$}`)}function Bv($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(TN6)])}async function IN6($,Z){let X=$.var.studioContext,Q=XJ(Z.branch),Y=$.req.query("thread")??Q,G=Y&&Y===Q?Z.branchThread:Y?await X.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=LC(J?.metadata?.runtime);if(W)return W;let K=mO0(Z.virtualMcpMetadata),F=K==="cms"?await Z71(X,{claimName:Z.claimName}):"alive",H=K==="cms"&&F!=="alive"?"cms":"sandbox",N=!!J&&(F==="gone"||F==="alive"&&K==="cms");if(N&&J)_n(X,J.id,H);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:F,resolved:H,stamped:N});return H}async function qN6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await ZQ($.var.studioContext)}catch{return null}}function Ov($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function mu($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=Us(Z,X);if(!Y)throw new h4(404,"AUTH","repo","Project has no GitHub repository");let G=o(Q);return sA0(Q,G.id,Y)}function P71($,Z){if(Z instanceof QA0)return $.json({error:Z.message},429,{...A5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof h4){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,A5)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,A5)}async function fl$($,Z,X){let Q;try{Q=await fetch(Z,X)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await Q.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}async function bl$($){try{let Z=await mu($),X=await FT0(Z,$.get("vmClaim").branch);return $.json(X,200,A5)}catch(Z){return P71($,Z)}}function Bs($,Z){let Q=(UT0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return UT0.set($,Y),Y.finally(()=>{if(UT0.get($)===Y)UT0.delete($)}),Q}async function oZ($,Z,X){if(!X?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,A5);let Q=X?.runner??Ov($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,F=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,F.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),F.set("content-type","application/json");let H=X?.signal,N={method:W,headers:F,body:K,...H?{signal:H}:{}},U=async()=>{let B=await Q.proxyDaemonRequest(Y,Z,N);if(X?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Q.adoptLiveClaim({userId:G,projectRef:J},Y))B=await Q.proxyDaemonRequest(Y,Z,N);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...A5}})}}let O=await B.text(),L=X?.redactRepoDir?MN6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...A5}})};try{if(H){let B=U();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(H.aborted)return w(H.reason);H.addEventListener("abort",()=>w(H.reason),{once:!0})})])}return await U()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function MN6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function BT0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function kN6($){return xl$.includes($)}var zN6,_l$=524288,AN6=65536,TN6=1e4,vl$=2000,RN6,UT0,A5,xl$,yl$=()=>{let $=new H1;$.use("/:virtualMcpId/:branch/*",RN6),$.post("/:virtualMcpId/:branch/write",(X)=>oZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>oZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>oZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>oZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>oZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>oZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>oZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:Bv(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return oZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return oZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>oZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>oZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!kN6(Q))return X.json({error:`step must be one of: ${xl$.join(", ")}`},400);let Y=X.get("vmClaim"),G=await Z71(X.var.studioContext,{claimName:Y.claimName})==="gone"?null:await qN6(X);if(!G)return X.json({error:"sandbox not found: nothing is running at this ref"},404,A5);if(Q==="start"){let J=o(X.var.studioContext),W=Ry(Y.virtualMcpMetadata);try{await J70({ctx:X.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:W})}catch(K){let F=K instanceof Error?K.message:String(K);return X.json({error:`Failed to push env to daemon: ${F}`},502)}}return oZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return iN(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return yc$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return bl$(X);return Z(X)});let Z=(X)=>oZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(vl$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return bl$(X);return oZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(vl$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")try{let Y=await X.req.json().catch(()=>({})),G=await mu(X),J=await HT0(G,Q.branch,Y.base);return X.json(J,200,A5)}catch(Y){return P71(X,Y)}return oZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").runtime==="cms")return X.json({ok:!0},200,A5);let Q=Ov(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),W=X.var.studioContext;return Bs(Y,async()=>{try{await X71(W,Q,Y);let K=Us(G,J);if(K)await Cl$(W,Q,Y,K)}catch(K){if(K instanceof Uv)return X.json({error:K.message},403,A5);let F=K instanceof Error?K.message:String(K);return X.json({error:F},502,A5)}return oZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return Bs(Q.claimName,async()=>{let Y=await X.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return X.json({error:"filepaths is required"},400,A5);try{let J=await mu(X);return await Ml$(J,Q.branch,G),X.json({ok:!0},200,A5)}catch(J){let W=J instanceof h4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return X.json({error:K},W,A5)}});return Bs(Q.claimName,()=>oZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return Bs(Q.claimName,async()=>{try{let W=await X.req.json().catch(()=>({})),K=await mu(X),F=W.base??await K.getDefaultBranch();return await NT0(K,Q.branch,F),X.json({ok:!0},200,A5)}catch(W){return P71(X,W)}});let Y=Ov(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return Bs(G,async()=>{try{await X71(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:K},502,A5)}return oZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",n5({maxSize:_l$,onError:(X)=>X.json({error:"Payload too large"},413,A5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let F=Ov(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[B,O]=G71(H)&&U?[H,N]:Y?await Promise.all([BT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),BT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await mu(X);return Promise.all([FT0(w,Q.branch),HT0(w,Q.branch)])})(),L=await lc$(K,B,O);return X.json(L,200,A5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,A5);return X.json({error:H},502,A5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",n5({maxSize:_l$,onError:(X)=>X.json({error:"Payload too large"},413,A5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let F=Ov(X);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let F=await X.req.json().catch(()=>({})),H=F.status,N=F.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[B,O]=G71(H)&&U?[H,N]:Y?await Promise.all([BT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),BT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await mu(X);return Promise.all([FT0(w,Q.branch),HT0(w,Q.branch)])})(),L=await mc$(K,B,O,typeof F.language==="string"?F.language:void 0);return X.json(L,200,A5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,A5);return X.json({error:H},502,A5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=Ov(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,"");return fl$(X,`${W}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",n5({maxSize:AN6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=Ov(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let W=kl$(J);if(!W)return X.json({error:"Invalid or missing __resolveType"},400);let K=Vl$(G,W.resolveType);return fl$(X,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var gl$=D(()=>{U8();wF();gu();$71();sp();fc$();g3();dy();bc$();d3();xc$();gc$();Fi0();Zn();K71();ic$();H71();dD();j71();Sl$();z71();zN6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;RN6=rA0(async($,Z)=>{let X=$.var.studioContext;try{t(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=o0(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=o(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{PN6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=rp({orgId:Y.id,virtualMcpId:G,branch:J}),F=await Qi0(X,J),H=Yi0(F,Q),N=vc$({userId:H,projectRef:K}),U=W.metadata??null,B=await IN6($,{claimName:N,branch:J,virtualMcpId:G,sandboxUserId:H,virtualMcpMetadata:U,branchThread:F});if(B==="cms")return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await ZQ(X)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:O,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});UT0=new Map;A5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};xl$=["clone","install","start"]});function hl$($,Z,X){let Q=A71.get($);if(!Q)Q={pending:null,running:!1},A71.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,W]of Object.entries(X.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!Q.running)SN6($,Q);return G}async function SN6($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await CN6(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)A71.delete($)}}async function CN6($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await du(Z,X),J=await Z.getCommitTreeSha(G),W=await Z.getDecofileTree(J,Q),K=L71(W,Q),F=[],H=new Map(K.map((O)=>[O.path,{stem:O.stem,sha:O.sha}]));for(let[O,L]of $.set){let w=w71(K,O),E=`${JSON.stringify(L,null,2)}
-`,j=await Z.createBlob(E);await Tl$(Z.owner,Z.repo,j,E);let z=w[0]??`${WT0(Q)}/${N71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let O of $.del)for(let L of w71(K,O))F.push({path:L,mode:"100644",type:"blob",sha:null}),H.delete(L);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===N)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=Ks(O);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),B=await Z.createCommit({message:_N6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,B),B}catch(O){if(!(O instanceof h4&&O.status===422)||Y>=VN6-1)throw O;await L$(sZ(2000,200,Y,2,0.5))}}}function _N6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return am0(Q,$.deps.coAuthor)}var VN6=3,A71;var ul$=D(()=>{gO0();$T0();W4();dD();KT0();A71=new Map});import{createHmac as cl$,randomBytes as vN6,timingSafeEqual as fN6}from"crypto";function ll$(){if(OT0)return OT0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return OT0=$?Buffer.from($):vN6(32),OT0}function T71($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+bN6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=cl$("sha256",ll$()).update(Q).digest("base64url");return`${Q}.${Y}`}function dl$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(cl$("sha256",ll$()).update(Q).digest("base64url"));if(Y.length!==G.length||!fN6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var bN6=21600000,OT0=null;var ml$=D(()=>{R$()});import{z as iu}from"zod";function yN6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&xN6.test($)}function ol$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Os($){let Z=$.get("decofileScope");return sA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Ds($,Z){if(Z instanceof h4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function rl$(){let $=new H1;return $.use("/:virtualMcpId/:branch",tl$),$.use("/:virtualMcpId/:branch/*",tl$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Rl$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=T71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ol$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Ds(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await Os(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return Ds(Z,Y)}}),$.patch("/:virtualMcpId/:branch",hN6,async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=uN6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{eA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Os(Z),W=await hl$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:hu(Q)},G),K=T71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:ol$(Z)})}catch(J){return Ds(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof h4&&W.status===409))throw W;await NT0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof h4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof h4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return Ds(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Q.compare(Y,X.branch),Q.getBranchHead(X.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof h4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Q){return Ds(Z,Q)}}),$}var xN6,il$=500,pl$=1048576,nl$=1024,gN6=8388608,hN6,uN6,tl$;var al$=D(()=>{vn0();$T0();U8();wF();$71();aA0();z71();H71();ul$();ml$();j71();dD();KT0();xN6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;hN6=n5({maxSize:gN6,onError:($)=>$.json({error:"Payload too large"},413)}),uN6=iu.object({set:iu.record(iu.string(),iu.unknown()).optional(),delete:iu.array(iu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=il$,{message:`Patch cannot touch more than ${il$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=pl$),{message:`Each block must be at most ${pl$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=nl$),{message:`Each block key must be at most ${nl$} characters`}),tl$=rA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!yN6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!dl$(B,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!dO0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],N=Us(K,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var sl$=($)=>{let Z=new H1;if(Z.use("*",Xv),Z.route("/",BA0()),Z.route("/",Og$()),Z.route("/",zc$()),Z.route("/",wc$()),Z.route("/",nA0()),Z.route("/tools",Mc$()),Z.route("/",Rc$()),Z.route("/",ru$({kvStorage:$.kvStorage})),Z.route("/",tu$()),Z.route("/fs",Hc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",yl$()),Z.route("/decofile",rl$()),Z.route("/",Oc$()),Z.route("/deco-sites",DA0()),Z.route("/sso",WA0()),Z.route("/",tA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Jg$()),$.mountDevAssets)Z.route("/dev-assets",LA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",qb$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Uc$()),Z.route("/mcp",ww0()),Z.route("/mcp/self",pA0()),Z.route("/mcp",zw0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var el$=D(()=>{U8();A91();Wg$();q91();wA0();fa();z91();ou$();au$();Nc$();ct();O91();Pw0();nZ1();Bc$();Dc$();Ec$();Pc$();Ic$();oZ1();kc$();rZ1();Ew0();gl$();al$()});function cN6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var lN6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},$d$=()=>{let $=new H1;return $.use("*",lN6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await tZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:cN6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Zd$=D(()=>{U8();R$();NP0()});import{z as M1}from"zod";function AF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function sN6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function eN6($,Z,X){try{return JSON.parse($)}catch{throw new Yd$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function $U6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:eN6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function ZU6($){let Z=$.map((X)=>{let Q=X.function.parameters?mY(X.function.parameters):mY({type:"object",properties:{}});return[X.function.name,h$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function XU6($){if(!$)return;return{openai:{response_format:$}}}function QU6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Xd$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Qd$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var dN6=256,mN6,iN6,pN6,nN6,tN6,oN6,rN6,aN6,Yd$,Gd$,Jd$;var Wd$=D(()=>{l4();U8();gu();RN();mN6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),iN6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),pN6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(iN6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),nN6=M1.object({type:M1.literal("text")}),tN6=M1.object({type:M1.literal("json_object")}),oN6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),rN6=M1.union([nN6,tN6,oN6]),aN6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(pN6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(mN6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:rN6.optional(),user:M1.string().optional()});Yd$=class Yd$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Gd$=new H1;Gd$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(AF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(AF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(AF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=aN6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(AF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=sN6(G.model);if(!J)return $.json(AF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>Ww(j.providerId));if(!E)return $.json(AF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(AF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),N=$U6(G.messages),U=G.tools?ZU6(G.tools):void 0,B=XU6(G.response_format),O=QU6(),L=Math.floor(Date.now()/1000);if(G.stream)return iN($,async(w)=>{let E=Xd$(H,N,U,G,B,$.req.raw.signal);try{let j=AO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let k=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=dN6)await I()}else if(k.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:Qd$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Xd$(H,N,U,G,B,$.req.raw.signal),E=await zO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:Qd$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(AF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(AF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(AF(Y.message,"server_error"),500)}});Jd$=Gd$});function YU6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function Kd$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=o0(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!aG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let F of J){if(!F.slug||fZ(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(es1(N)!==G)continue;if(!YU6(N.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Fd$=D(()=>{U8();XO()});var Nd$;var Hd$=D(()=>{Nd$={name:"decocms",version:"4.303.18",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function WU6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??JU6}}var Ud$,JU6="https://ph.studio.decocms.com",Bd$;var Od$=D(()=>{U8();h50();yC();Z9();R$();G91();Hd$();Ud$=new H1;Ud$.get("/",($)=>{let Z={version:Nd$.version,theme:Ti1(),...TH().logo&&{logo:TH().logo},...NN()&&{internalUrl:sC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Ly$(),posthog:WU6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:Ts()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Bd$=Ud$});function pu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function R71($){return(pu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Ld$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(pu($))}&sz=${Z}`}function Dd$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function wd$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Dd$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Dd$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var Dv,KU6,FU6,HU6,NU6,Ed$;var jd$=D(()=>{Dv=l0.enum(["good","bad","neutral"]),KU6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:Dv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),FU6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(KU6)),HU6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},NU6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:Dv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:Dv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:Dv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:Dv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(FU6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:Dv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:Dv.optional()})).min(1)})]),Ed$=l0.object({...HU6,template:NU6})});function DT0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Ed$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var I71=D(()=>{jd$()});import{join as zd$}from"path";async function BU6($){try{let Z=await fetch(`${GK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(UU6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=DT0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||R71($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function wG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function OU6($,Z){let X=pu($),Q=Z?.brand?.trim()||R71(X),Y=Ld$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=wd$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${wG(W)}</title>`,`<meta name="description" content="${wG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${wG(W)}" />`,`<meta property="og:description" content="${wG(K)}" />`,`<meta property="og:url" content="${wG(J)}" />`,`<meta property="og:image" content="${wG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${wG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${wG(W)}" />`,`<meta name="twitter:description" content="${wG(K)}" />`,`<meta name="twitter:image" content="${wG(F)}" />`,`<meta name="twitter:image:alt" content="${wG(H)}" />`,`<link rel="canonical" href="${wG(J)}" />`,`<link rel="icon" href="${wG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await Tl$(Z.owner,Z.repo,j,E);let z=w[0]??`${WT0(Q)}/${N71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))F.push({path:P,mode:"100644",type:"blob",sha:null}),H.delete(P)}for(let O of $.del)for(let L of w71(K,O))F.push({path:L,mode:"100644",type:"blob",sha:null}),H.delete(L);if(F.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===N)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=Ks(O);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);F.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,F),B=await Z.createCommit({message:_N6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,B),B}catch(O){if(!(O instanceof h4&&O.status===422)||Y>=VN6-1)throw O;await L$(sZ(2000,200,Y,2,0.5))}}}function _N6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return am0(Q,$.deps.coAuthor)}var VN6=3,A71;var ul$=D(()=>{gO0();$T0();W4();dD();KT0();A71=new Map});import{createHmac as cl$,randomBytes as vN6,timingSafeEqual as fN6}from"crypto";function ll$(){if(OT0)return OT0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return OT0=$?Buffer.from($):vN6(32),OT0}function T71($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+bN6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=cl$("sha256",ll$()).update(Q).digest("base64url");return`${Q}.${Y}`}function dl$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(cl$("sha256",ll$()).update(Q).digest("base64url"));if(Y.length!==G.length||!fN6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var bN6=21600000,OT0=null;var ml$=D(()=>{R$()});import{z as iu}from"zod";function yN6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&xN6.test($)}function ol$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Os($){let Z=$.get("decofileScope");return sA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Ds($,Z){if(Z instanceof h4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function rl$(){let $=new H1;return $.use("/:virtualMcpId/:branch",tl$),$.use("/:virtualMcpId/:branch/*",tl$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Rl$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=T71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ol$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Ds(Z,Q)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let X=Z.get("decofileScope"),Q=X.packagePath?`${X.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await Os(Z),G=await Y.getFileTextAtRef(X.branch,Q);if(G===null){let J=await Y.getDefaultBranch();if(J!==X.branch)G=await Y.getFileTextAtRef(J,Q)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return Ds(Z,Y)}}),$.patch("/:virtualMcpId/:branch",hN6,async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=uN6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{eA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Os(Z),W=await hl$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:hu(Q)},G),K=T71({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:ol$(Z)})}catch(J){return Ds(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof h4&&W.status===409))throw W;await NT0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof h4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof h4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return Ds(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Os(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Q.compare(Y,X.branch),Q.getBranchHead(X.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof h4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Q){return Ds(Z,Q)}}),$}var xN6,il$=500,pl$=1048576,nl$=1024,gN6=8388608,hN6,uN6,tl$;var al$=D(()=>{vn0();$T0();U8();wF();$71();aA0();z71();H71();ul$();ml$();j71();dD();KT0();xN6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;hN6=n5({maxSize:gN6,onError:($)=>$.json({error:"Payload too large"},413)}),uN6=iu.object({set:iu.record(iu.string(),iu.unknown()).optional(),delete:iu.array(iu.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=il$,{message:`Patch cannot touch more than ${il$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=pl$),{message:`Each block must be at most ${pl$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=nl$),{message:`Each block key must be at most ${nl$} characters`}),tl$=rA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!yN6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!dl$(B,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!dO0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],N=Us(K,H);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var sl$=($)=>{let Z=new H1;if(Z.use("*",Xv),Z.route("/",BA0()),Z.route("/",Og$()),Z.route("/",zc$()),Z.route("/",wc$()),Z.route("/",nA0()),Z.route("/tools",Mc$()),Z.route("/",Rc$()),Z.route("/",ru$({kvStorage:$.kvStorage})),Z.route("/",tu$()),Z.route("/fs",Hc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",yl$()),Z.route("/decofile",rl$()),Z.route("/",Oc$()),Z.route("/deco-sites",DA0()),Z.route("/sso",WA0()),Z.route("/",tA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Jg$()),$.mountDevAssets)Z.route("/dev-assets",LA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",qb$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Uc$()),Z.route("/mcp",ww0()),Z.route("/mcp/self",pA0()),Z.route("/mcp",zw0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var el$=D(()=>{U8();A91();Wg$();q91();wA0();fa();z91();ou$();au$();Nc$();ct();O91();Pw0();nZ1();Bc$();Dc$();Ec$();Pc$();Ic$();oZ1();kc$();rZ1();Ew0();gl$();al$()});function cN6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var lN6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},$d$=()=>{let $=new H1;return $.use("*",lN6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await tZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:cN6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Zd$=D(()=>{U8();R$();NP0()});import{z as M1}from"zod";function AF($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function sN6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function eN6($,Z,X){try{return JSON.parse($)}catch{throw new Yd$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function $U6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:eN6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function ZU6($){let Z=$.map((X)=>{let Q=X.function.parameters?mY(X.function.parameters):mY({type:"object",properties:{}});return[X.function.name,h$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function XU6($){if(!$)return;return{openai:{response_format:$}}}function QU6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Xd$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Qd$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var dN6=256,mN6,iN6,pN6,nN6,tN6,oN6,rN6,aN6,Yd$,Gd$,Jd$;var Wd$=D(()=>{l4();U8();gu();RN();mN6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),iN6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),pN6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(iN6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),nN6=M1.object({type:M1.literal("text")}),tN6=M1.object({type:M1.literal("json_object")}),oN6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),rN6=M1.union([nN6,tN6,oN6]),aN6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(pN6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(mN6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:rN6.optional(),user:M1.string().optional()});Yd$=class Yd$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Gd$=new H1;Gd$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(AF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(AF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(AF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=aN6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(AF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=sN6(G.model);if(!J)return $.json(AF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>Ww(j.providerId));if(!E)return $.json(AF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(AF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),N=$U6(G.messages),U=G.tools?ZU6(G.tools):void 0,B=XU6(G.response_format),O=QU6(),L=Math.floor(Date.now()/1000);if(G.stream)return iN($,async(w)=>{let E=Xd$(H,N,U,G,B,$.req.raw.signal);try{let j=AO(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let k=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=dN6)await I()}else if(k.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:Qd$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Xd$(H,N,U,G,B,$.req.raw.signal),E=await zO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:Qd$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(AF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(AF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(AF(Y.message,"server_error"),500)}});Jd$=Gd$});function YU6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function Kd$(){let $=new H1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=o0(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!aG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let F of J){if(!F.slug||fZ(F))continue;let H=await X.storage.virtualMcps.list(F.id);for(let N of H){if(es1(N)!==G)continue;if(!YU6(N.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Fd$=D(()=>{U8();XO()});var Nd$;var Hd$=D(()=>{Nd$={name:"decocms",version:"4.303.19",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function WU6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??JU6}}var Ud$,JU6="https://ph.studio.decocms.com",Bd$;var Od$=D(()=>{U8();h50();yC();Z9();R$();G91();Hd$();Ud$=new H1;Ud$.get("/",($)=>{let Z={version:Nd$.version,theme:Ti1(),...TH().logo&&{logo:TH().logo},...NN()&&{internalUrl:sC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Ly$(),posthog:WU6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:Ts()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Bd$=Ud$});function pu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function R71($){return(pu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Ld$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(pu($))}&sz=${Z}`}function Dd$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function wd$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Dd$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Dd$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var Dv,KU6,FU6,HU6,NU6,Ed$;var jd$=D(()=>{Dv=l0.enum(["good","bad","neutral"]),KU6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:Dv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),FU6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(KU6)),HU6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},NU6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:Dv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:Dv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:Dv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:Dv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(FU6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:Dv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:Dv.optional()})).min(1)})]),Ed$=l0.object({...HU6,template:NU6})});function DT0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Ed$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var I71=D(()=>{jd$()});import{join as zd$}from"path";async function BU6($){try{let Z=await fetch(`${GK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(UU6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=DT0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||R71($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function wG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function OU6($,Z){let X=pu($),Q=Z?.brand?.trim()||R71(X),Y=Ld$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=wd$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${Q} commerce report by decocms`;return[`<title>${wG(W)}</title>`,`<meta name="description" content="${wG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${wG(W)}" />`,`<meta property="og:description" content="${wG(K)}" />`,`<meta property="og:url" content="${wG(J)}" />`,`<meta property="og:image" content="${wG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${wG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${wG(W)}" />`,`<meta name="twitter:description" content="${wG(K)}" />`,`<meta name="twitter:image" content="${wG(F)}" />`,`<meta name="twitter:image:alt" content="${wG(H)}" />`,`<link rel="canonical" href="${wG(J)}" />`,`<link rel="icon" href="${wG(Y)}" sizes="any" />`].join(`
     `)}function DU6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Pd$($){let Z=new H1;return Z.get("/:domain/og.png",async(X)=>{let Q=pu(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(zd$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${GK({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(LU6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?zd$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await BU6(pu(Q)),K=OU6(Q,W);return X.html(DU6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var UU6=2500,LU6=1e4;var Ad$=D(()=>{U8();I71();NE();R$()});function Ls($,Z){return fetch(`${GK({})}${$}`,Z)}async function wU6($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await Ls(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=DT0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var EU6,nN,Td$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Rd$;var Id$=D(()=>{U8();uY();NE();I71();EU6=new Set(["complete","errored","terminated","unknown"]),nN=new H1;nN.use("*",async($,Z)=>{let X=await s$.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});nN.use("/link-token/*",Td$);nN.use("/suggest",Td$);nN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await wU6(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});nN.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Ls("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${HE({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});nN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Ls(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${HE({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:EU6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});nN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Ls(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});nN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Ls(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});Rd$=nN});import{createHmac as jU6,timingSafeEqual as zU6}from"crypto";function Md$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let F of Z.split(",")){let H=F.indexOf("=");if(H<=0)continue;let N=F.slice(0,H).trim(),U=F.slice(H+1).trim();if(N==="t")Y=U;else if(N==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>PU6)return!1;let W=jU6("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((F)=>{let H=Buffer.from(F,"hex");return K.length===H.length&&zU6(K,H)})}function kd$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=yJ(Z),Q=yJ(yJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:TF(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function Vd$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function TF($){return typeof $==="string"?$:void 0}function yJ($){return typeof $==="object"&&$!==null?$:void 0}function LT0($){return typeof $==="number"?new Date($*1000):null}function k71($){return TF($)??TF(yJ($)?.id)}function AU6($){return k71($.subscription)??TF(yJ(yJ($.parent)?.subscription_details)?.subscription)}function TU6($){let Z=LT0($.current_period_end);if(Z)return Z;let X=yJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=yJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function q71($,Z){let X=LT0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function M71($,Z){let X=LT0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function RU6($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=TF(yJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(TF(yJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(TF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=TF(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(yJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:yJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(TF(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=k71(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(q71(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:k71(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:M71(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=TF(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&q71(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Vd$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:TU6(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:M71(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=AU6(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(q71(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:LT0(X.period_end),lastStripeEventAt:M71(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function IU6($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Vd$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function qd$($,Z){let X=IU6($,Z);if(!X)return;xY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:Cn1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Sd$($){let Z=new ZK(r8().db),X=await RU6(Z,$);if(!(X.handled&&X.topUp))qd$($,X);if(X.handled&&X.topUp)await nE$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),qd$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await re1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof cY&&(Q.status===400||Q.status===404)))throw Q}return X}var PU6=300;var Cd$=D(()=>{iG();S4();E50();zE();g01()});var qU6=1048576,V71;var _d$=D(()=>{U8();wF();R$();Cd$();V71=new H1;V71.post("/webhook",n5({maxSize:qU6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=b0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!Md$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=kd$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Sd$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as MU6}from"crypto";function VU6($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return MU6(Buffer.from(Y),Buffer.from(Q))}var kU6=5242880,S71;var vd$=D(()=>{U8();wF();d3();S71=new H1;S71.post("/webhook",n5({maxSize:kU6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!VU6(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await Cn0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function fd$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var bd$,SU6,CU6,xd$;var yd$=D(()=>{U8();P3();Ug();Xy();bd$=new H1,SU6=["range","if-none-match","if-modified-since"],CU6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];bd$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(ju($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Z$(401,{message:"Authentication required"})}if(!X)throw new Z$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Z$(400,{message:"Missing file key"});let Y=await Ut(Q,Z);if(!Y)throw new Z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&oG()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Z$(500,{message:"Invalid data URL from storage"});let[,F,H]=K,N=Buffer.from(H,"base64"),U=new Headers({"Content-Type":F,"Cache-Control":"private, max-age=86400"});return fd$(U,F),new Response(N,{status:200,headers:U})}let G=new Headers;for(let K of SU6){let F=$.req.header(K);if(F)G.set(K,F)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of CU6){let F=J.headers.get(K);if(F)W.set(K,F)}return W.set("Cache-Control","private, max-age=86400"),fd$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});xd$=bd$});var ws=_((Lv)=>{var _U6=Lv&&Lv.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),vU6=Lv&&Lv.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))_U6(Z,$,X)};Object.defineProperty(Lv,"__esModule",{value:!0});vU6(PY(),Lv)});var ud$=_((gd$)=>{Object.defineProperty(gd$,"__esModule",{value:!0});gd$.version=void 0;gd$.version="3.4.0"});var dd$=_((RF)=>{var fU6=RF&&RF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(RF,"__esModule",{value:!0});RF.NodeTransport=RF.VERSION=void 0;RF.nodeResolveHost=uU6;var s6=ws(),bU6=z0("net"),C71=z0("tls"),xU6=z0("path"),cd$=z0("fs"),yU6=fU6(z0("dns")),gU6=ud$();RF.VERSION=gU6.version;var hU6="nats.js";class ld${socket;version;lang;yields=[];signal=(0,s6.deferred)();closedNotification=(0,s6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=hU6,this.version=RF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,s6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw s6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new s6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new s6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,s6.deferred)(),X,Q=(0,bU6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=s6.DataBuffer.concat(...this.yields),Y=(0,s6.extractProtocolMessage)(Q);if(Y!=="")try{let G=s6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s6.deferred)();try{if($=(0,xU6.resolve)($),!(0,cd$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,cd$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,s6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new s6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s6.deferred)();try{let Y=(0,C71.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new s6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,s6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new s6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,s6.deferred)();try{let Q=(0,C71.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new s6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof C71.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s6.render)($)}`);let Z=(0,s6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,s6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,s6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}RF.NodeTransport=ld$;function uU6($){let Z=(0,s6.deferred)();return yU6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var td$=_((nd$)=>{Object.defineProperty(nd$,"__esModule",{value:!0});nd$.connect=cU6;var md$=dd$(),id$=ws(),pd$=ws();function cU6($={}){if((0,pd$.hasWsProtocol)($))return Promise.reject(pd$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,id$.setTransportFactory)({factory:()=>{return new md$.NodeTransport},dnsResolveFn:md$.nodeResolveHost}),id$.NatsConnectionImpl.connect($)}});var od$=_((tN)=>{var dU6=tN&&tN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),mU6=tN&&tN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))dU6(Z,$,X)};Object.defineProperty(tN,"__esModule",{value:!0});tN.connect=void 0;var iU6=td$();Object.defineProperty(tN,"connect",{enumerable:!0,get:function(){return iU6.connect}});mU6(ws(),tN)});function ed$($){let Z=$?.connectFn??oU6,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function F(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function H(U){(async()=>{for await(let B of U.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,F()})().catch(()=>{})}async function N(U,B){let O=0;while(!G)try{X=await Z({servers:U,timeout:tU6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,H(X),F();return}catch{O++;let L=sZ(nU6,pU6,O-1,2,0.5);await L$(L)}}return{init(U,B){if(Y)return;Y=!0,G=!1;let O=B?.creds?rd$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;N(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=sd$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function oU6($){return ad$.connect($)}var rd$,ad$,sd$,pU6=100,nU6=3000,tU6=3000;var $m$=D(()=>{W4();rd$=V(wc(),1),ad$=V(od$(),1),sd$=V(OL(),1)});function _71($,Z){return`${$}.${Z}`}class v71{cache;constructor($){this.cache=$u({ttlMs:$?.ttlMs??rU6,maxSize:$?.maxSize??aU6})}async get($,Z){return this.cache.get(_71($,Z))??null}async set($,Z,X){this.cache.set(_71($,Z),X)}async invalidate($,Z){this.cache.delete(_71($,Z))}teardown(){this.cache.clear()}}var rU6=600000,aU6=5000;var Zm$=()=>{};function wT0($,Z){return`${$}:${Z}`}function f71($){let Z=$u({ttlMs:$?.ttlMs??sU6,maxSize:$?.maxSize??eU6}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,F){let H=X?.();if(!H)return;try{H.publish(Xm$,Y.encode(JSON.stringify({organizationId:K,keyId:F,originId:Q})))}catch(N){console.warn("[ProviderKeyCache] Publish failed (non-critical):",N)}}return{get(K,F){return Z.get(wT0(K,F))},set(K,F,H){Z.set(wT0(K,F),H)},invalidate(K,F){Z.delete(wT0(K,F)),W(K,F)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(Xm$),(async()=>{for await(let F of J)try{let H=JSON.parse(G.decode(F.data));if(H.originId===Q)continue;Z.delete(wT0(H.organizationId,H.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Xm$="studio.ai-provider-keys.invalidate",sU6=30000,eU6=5000;var Qm$=()=>{};class b71{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder,Q=Z.subscribe("studio.decopilot.cancel");this.subscription=Q,(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Ym$=($)=>{let Z;return()=>Z??=$()},x71,y71;var Gm$=D(()=>{I6();x71=Ym$(()=>w$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),y71=Ym$(()=>w$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function JB6($=Km$){return{name:mK,subjects:[`${sr0}.>`],storage:DW.StorageType.File,max_age:XB6,max_bytes:YB6,max_msgs_per_subject:GB6,discard:DW.DiscardPolicy.Old,retention:DW.RetentionPolicy.Limits,duplicate_window:QB6,num_replicas:$}}class Fm${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Jm$($){let Z=Wm$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function HB6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,ZB6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function NB6($,Z){return $.info?.cluster?Z:1}function UB6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class g71{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Q,Y)=>{let G=JB6(Y);try{await Q.streams.info(mK),await Q.streams.update(mK,G)}catch(J){if(J instanceof Error&&J.message.includes("stream not found"))await Q.streams.add(G),await Q.streams.update(mK,G);else if(J instanceof Error&&/can ?not change.*storage|storage type/i.test(J.message))await Q.streams.delete(mK),await Q.streams.add(G);else throw J}},X=await g6(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await DW.jetstreamManager($),Y=NB6($,Km$);try{await Z(Q,Y)}catch(G){if(Y<=1||!UB6(G))throw G;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${Y} (${G.message}); falling back to an unreplicated stream`),await Z(Q,1)}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Tg});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=HB6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let F=bB$(Z);Y.publish(F.subject,F.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(F)=>{let H=performance.now(),N=$a0(F,{runId:Z}),U=performance.now()-H;x71().record(U),y71().add(1,{"org.id":Q??"unknown"}),FB6?.record(U,N.reduce((B,O)=>B+O.data.length,0));for(let B of N)G.publish(Y,B.subject,B.data,B.headers?Jm$(B.headers):void 0)};return(async()=>{let F=$.getReader(),H=0,N=0,U;try{while(!0){let{done:B,value:O}=await F.read();if(B)break;if(K(O),N++,++H>=64)H=0,await new Promise((L)=>setImmediate(L))}}catch(B){U=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(F.releaseLock(),W(),KB6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:N,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishSerialized($,Z){try{return await g6(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Jm$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Tg}),!0}catch(X){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,X),!1}}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=$a0(Z,{runId:$,dedup:X});x71().record(performance.now()-Y),y71().add(1);for(let J of G)if(!await this.publishSerialized(Q,J))return!1;return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=fB$({runId:$,fenceToken:Z,finalSeq:X});return await this.publishSerialized(Q,Y)}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?DW.DeliverPolicy.New:DW.DeliverPolicy.All,G=X?.closeOnDone??!1,J=GD($),W;try{W=await g6(async()=>{return(await Q.consumers.get(mK,{filter_subjects:J,deliver_policy:Y})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Tg})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let H=aL0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(nL0()).pipeThrough(tL0()).getReader(),N=!1,U=()=>{if(N)return;N=!0;try{H.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),H.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await H.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(G){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(mK,{filter:GD($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var DW,Wm$,$B6=($)=>{let Z;return()=>Z??=$()},ZB6,XB6=86400000000000,QB6=120000000000,YB6=4294967296,Km$,GB6=500000,WB6,KB6,FB6;var Hm$=D(()=>{W4();Za0();sL0();oL0();I6();Gm$();DW=V(OL(),1),Wm$=V(wc(),1),ZB6=$B6(()=>w$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Km$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);WB6=process.env.STREAM_ENCODE_TRACE==="1",KB6=process.env.DECOPILOT_STREAM_TRACE==="1";FB6=WB6?new Fm$:null});function ET0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,gW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Nm$=D(()=>{_8()});class h71{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function Um$($,Z,X){let Q=Z.organizationId;if(!aQ(Z))return!1;if(!vC(X))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Q))return!1;let Y=await $.storage.organizationSettings.get(Q),G=DK(Y?.flags),J=await E5($,Q),W=await $.storage.taskBoard.update(Z.id,Q,KJ(J,G),Z.updatedBy);return await z6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G,reason:"pr_merged"}}),b$(Q,W),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${G}`),!0}var Bm$=D(()=>{C6();KX();Fg();aY();bK();j5()});function jB6($){return $ instanceof tX}function zB6($,Z){return Z-$>=wB6}class u71{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??BB6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??DB6,X=this.options.itemIntervalMs??OB6,Q=new Date(Date.now()-X),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Q),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of Y)try{if(await this.reconcileItem(J,W,Q))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-jt0),wo0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-EB6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Oo0(this.taskBoard,Y,Q),await Do0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==X8)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await FN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),jB6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+LB6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),b$(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!zB6(fH(X,Z.reviewCycleStartedAt),Date.now()))return;await gK($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,X){if(!await this.taskBoard.claimSweep($,Z,X))return!1;let Q=await this.taskBoard.getById($,Z);if(!Q)return!1;if(!aQ(Q))return!1;let Y=Q.assigneeId===X8,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Q.assignedBy??Q.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,Q);return!1}let W=await Promise.all(G.map(async(K)=>({...K,...await Ng(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Um$(J,Q,W))return!0;if(await RO$(J,Q))return!0;if(!Y)return!1;if(!yo0(W))return!1;return await FL0(J,Q,{previewMatchesHead:go0(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var BB6=60000,OB6=300000,DB6=50,LB6=60000,wB6=900000,EB6=120000;var Om$=D(()=>{C6();ko0();WN();vt();bK();Bm$();j5();eG();Eo0();XG();Kt()});import{readdir as PB6,rm as jT0}from"fs/promises";import{join as zT0}from"path";async function PT0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-AB6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await wv($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Dm$($,Y,Z);else if(!Y.startsWith(".")){let G=zT0($,Y),J=await wv(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Dm$(G,K,Z)}if((await wv(G)).length===0)await jT0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Dm$($,Z,X){let Q=0,Y=zT0($,Z),G=await wv(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=zT0(Y,W),F=await wv(K);for(let N of F){if(!/^\d{2}$/.test(N))continue;let U=new Date(`${Z}-${W}-${N}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let B=zT0(K,N);await jT0(B,{recursive:!0,force:!0}),Q++}}if((await wv(K)).length===0)await jT0(K,{recursive:!0,force:!0})}if((await wv(Y)).length===0)await jT0(Y,{recursive:!0,force:!0});return Q}async function wv($){try{return(await PB6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var AB6=30;var c71=()=>{};import{DBOS as l71,SchedulerMode as TB6}from"@dbos-inc/dbos-sdk";async function IB6(){let $=[hJ(),Ev(),kF()],Z=0;for(let X of $)try{Z+=await PT0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function qB6($,Z){await l71.runStep(()=>IB6(),{name:"monitoringRetention"})}function wm$(){if(Lm$)return;Lm$=!0;let $=l71.registerWorkflow(qB6,{name:"monitoringRetentionWorkflow"});l71.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:RB6,mode:TB6.ExactlyOncePerIntervalWhenActive})}var RB6="23 4 * * *",Lm$=!1;var Em$=D(()=>{wY();c71()});function jm$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await UJ.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await Lt($.db,Z,Q.role);return Y.boundAuth=l51({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new tw(X,void 0,Y.boundAuth,Q.role,"self"),oO(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var zm$=D(()=>{ow();rO()});function MB6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function kB6(){return{services:MB6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function SB6(){for(let $ of VB6)$()}function Pm$($){let Z=[...d71.logs,$];d71={...d71,logs:Z.length>500?Z.slice(-500):Z},SB6()}function m71(){return CB6}var d71,VB6,CB6=!1;var i71=D(()=>{d71=kB6(),VB6=new Set});import{EventEmitter as _B6}from"events";var p71;var Am$=D(()=>{i71();p71=new _B6;p71.on("request",($)=>{Pm$($)})});function Tm$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let B=nu(U.params.name),O=U.params.arguments||{},L=Object.keys(O).map((E)=>nu(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${J5.tool}${B}${J5.dim}(${w})${J5.reset}`}else if(U.method)G=`${J5.dim}${nu(U.method)}${J5.reset}`}}catch{}}let W=nu(Y);if(Y.startsWith("/mcp/conn_")){let H=Y.split("/")[2]??"";W=`/mcp/${J5.mcp}${nu(H.slice(0,12))}\u2026${J5.reset}`}else if(Y==="/mcp")W=`${J5.mcp}/mcp${J5.reset}`;else if(Y==="/mcp/registry")W=`${J5.mcp}/mcp/registry${J5.reset}`;let K=fB6(Q),F=J?"\u25C0":"\u2190";if(!m71())console.log(`${J5.dim}${F}${J5.reset} ${K}${Q}${J5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let H=Date.now()-X,N=$.res.status,U=vB6(N),B=H<1000?`${H}ms`:`${(H/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!m71())console.log(`${J5.dim}${O}${J5.reset} ${K}${Q}${J5.reset} ${W}${G?` ${G}`:""} ${U}${N}${J5.reset} ${J5.duration}${B}${J5.reset}`);p71.emit("request",{method:Q,path:nu(Y),status:N,duration:H,timestamp:new Date})}}}var J5,vB6=($)=>{if($>=500)return J5.serverError;if($>=400)return J5.clientError;if($>=300)return J5.redirect;return J5.ok},fB6=($)=>{return J5[$]||J5.reset},nu=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Rm$=D(()=>{i71();Am$();J5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as km$}from"crypto";import{mkdir as bB6,readdir as xB6,rm as Im$,stat as Vm$}from"fs/promises";import{join as t71,relative as yB6}from"path";import{z as P$}from"zod";function Cm$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return t71(gB6,Z)}function _m$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function n71($,Z){let X=Cm$($),Q=_m$(Z);return t71(X,Q)}function hB6($,Z,X,Q){let Y=b0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return km$("sha256",Y).update(G).digest("hex")}function Mm$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=hB6(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${_m$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function vm$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${km$("md5","etag").update(Q).digest("hex")}"`}async function fm$($,Z,X,Q,Y){try{let G=await xB6($,{withFileTypes:!0});for(let J of G){let W=t71($,J.name),F=yB6(Z,W).replace(/\\/g,"/");if(X&&!F.startsWith(X))continue;if(J.isDirectory())if(Q){let H=F+"/";if(!X||H.startsWith(X)){if(!(X?F.slice(X.length):F).includes("/"))Y.commonPrefixes.add(H)}}else await fm$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let H=F.slice(X.length);if(H.includes(Q)){let N=H.indexOf(Q),U=X+H.slice(0,N+1);Y.commonPrefixes.add(U);continue}}try{let H=await Vm$(W);Y.objects.push({key:F,size:H.size,lastModified:H.mtime.toISOString(),etag:vm$(W,H.mtime,H.size)})}catch{}}}}catch{}}function bm$($,Z){let Q=o($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,F=G.continuationToken,H=Cm$(Q);await bB6(H,{recursive:!0});let N={objects:[],commonPrefixes:new Set};await fm$(H,H,J,K,N),N.objects.sort((w,E)=>w.key.localeCompare(E.key));let U=0;if(F){if(U=N.objects.findIndex((w)=>w.key>F),U===-1)U=N.objects.length}let B=N.objects.slice(U,U+W),O=U+W<N.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(N.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let G=Y,J=n71(Q,G.key),W=await Vm$(J);return{contentType:k91(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:vm$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??qm$;return{url:Mm$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??qm$;return{url:Mm$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let G=Y,J=n71(Q,G.key);try{return await Im$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let F=n71(Q,K);try{await Im$(F),J.push(K)}catch(H){W.push({key:K,message:H instanceof Error?H.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function o71($,Z,X){let Q=bm$(Z,X),Y=new iW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:N5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(F)=>{try{let H=await J.handler(F);return{content:[{type:"text",text:JSON.stringify(H)}],structuredContent:H}}catch(H){return{content:[{type:"text",text:`Error: ${H.message}`}],isError:!0}}})}let G=new YQ({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),PJ(Y,G,$,"mcp:dev-assets")}async function xm$($,Z,X,Q){let G=bm$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var gB6="./data/assets",qm$=3600,Sm$,ym$;var gm$=D(()=>{R$();Sg();U8();ud();Z_();hX();wA0();Sm$=new H1;Sm$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return o71($.req.raw,Z,Q)});ym$=Sm$});var hm$={};J4(hm$,{mountDevRoutes:()=>uB6});function uB6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return o71(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),F=await xm$(W,K,Y,J);if(F.isError)return Q.json(F.content,500);return Q.json(F.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ym$);let X=new H1;X.use("*",BW({mountPath:"/api/dev-assets"})),X.route("/",LA0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var um$=D(()=>{U8();P91();wA0();gm$()});import{sql as cB6}from"kysely";import{randomUUID as cm$}from"crypto";import{z as lB6}from"zod";async function mB6($){let Z=new Date().toISOString(),X=cm$(),Q=C8.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:cm$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await cB6`SELECT
       pg_notify('studio_events', ${X}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.303.18",
+  "version": "4.303.19",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {