decocms 4.329.0 → 4.329.2

package/dist/server/server.js

@@ -2980,7 +2980,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${G.join(`
 `)}`:Y}function jB6($){let Z=new Set;for(let Q of $)for(let X of Q.split(`
 `)){let Y=X.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var kd$=200,FB6=12,UB6,BB6=300,YQ1=3;var GQ1=D(()=>{Zw();gT0();UB6={aheadBy:0,behindBy:0,files:[]}});function PB6($){if(!$||$.includes(".."))return!1;return zB6.test($)}function Sd$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!PB6(Z))return null;let{__resolveType:Q,...X}=$;return{resolveType:Z,payload:X}}function Cd$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var zB6;var _d$=D(()=>{zB6=/^[\w./@-]+$/});function _s($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function vd$($,Z,Q,X){if(!X.connectionId)throw new fv("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new fv(H9);await uO({ctx:$,connectionId:X.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(H)=>{let U=H instanceof Error?H.message:H9;throw new fv(U)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await xK(X.connectionId,X.owner,X.name,$.db,$.vault).catch((H)=>{let{code:U,message:N}=C9$(H instanceof Error?H.message:String(H));throw U?new fv(N):H}),K=Gl($),F=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!F.ok){let H=await hO(F,AB6).catch(()=>F.statusText);throw Error(`Failed to refresh sandbox git credentials (${F.status}): ${H}`)}}var AB6=10485760,fv;var JQ1=D(()=>{FJ();MT0();Pn();ni0();ty();fv=class fv extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function RB6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!TB6.test(Z))throw Error(`Invalid branch name: ${$}`)}function bv($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(qB6)])}async function kB6($,Z){let Q=$.var.studioContext,X=WJ(Z.branch),Y=$.req.query("thread")??X,G=Y&&Y===X?Z.branchThread:Y?await Q.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=_C(J?.metadata?.runtime);if(W)return W;let K=OD0(Z.virtualMcpMetadata),F=K==="cms"?await u71(Q,{claimName:Z.claimName}):"alive",H=K==="cms"&&F!=="alive"?"cms":"sandbox",U=!!J&&(F==="gone"||F==="alive"&&K==="cms");if(U&&J)rn(Q,J.id,H);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:F,resolved:H,stamped:U});return H}async function VB6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await FX($.var.studioContext)}catch{return null}}function xv($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Hl($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),X=$.var.studioContext,Y=_s(Z,Q);if(!Y)throw new d4(404,"AUTH","repo","Project has no GitHub repository");let G=n(X);return kT0(X,G.id,Y)}function WQ1($,Z){if(Z instanceof SA0)return $.json({error:Z.message},429,{...R5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof d4){let X=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},X,R5)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},502,R5)}async function xd$($,Z,Q){let X;try{X=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await X.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:X.status,headers:{"content-type":X.headers.get("content-type")??"application/json"}})}async function yd$($){try{let Z=await Hl($),Q=await hT0(Z,$.get("vmClaim").branch);return $.json(Q,200,R5)}catch(Z){return WQ1($,Z)}}function vs($,Z){let X=(cT0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=X.catch(()=>{});return cT0.set($,Y),Y.finally(()=>{if(cT0.get($)===Y)cT0.delete($)}),X}async function eZ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,R5);let X=Q?.runner??xv($);if(X instanceof Response)return X;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=Q?.method??"POST",K=null,F=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,F.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),F.set("content-type","application/json");let H=Q?.signal,U={method:W,headers:F,body:K,...H?{signal:H}:{}},N=async()=>{let B=await X.proxyDaemonRequest(Y,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await X.adoptLiveClaim({userId:G,projectRef:J},Y))B=await X.proxyDaemonRequest(Y,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...R5}})}}let O=await B.text(),w=Q?.redactRepoDir?SB6(O):O,L=B.headers.get("content-type")??"application/json";return new Response(w,{status:B.status,headers:{"content-type":L,...R5}})};try{if(H){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((w,L)=>{if(H.aborted)return L(H.reason);H.addEventListener("abort",()=>L(H.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function SB6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function dT0($,Z,Q,X="GET",Y){let G=await $.proxyDaemonRequest(Z,Q,{method:X,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(Y,Z))G=await $.proxyDaemonRequest(Z,Q,{method:X,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function CB6($){return gd$.includes($)}var TB6,fd$=524288,IB6=65536,qB6=1e4,bd$=2000,MB6,cT0,R5,gd$,hd$=()=>{let $=new J1;$.use("/:virtualMcpId/:branch/*",MB6),$.post("/:virtualMcpId/:branch/write",(Q)=>eZ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>eZ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>eZ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>eZ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>eZ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>eZ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>eZ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:bv(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let X=Q.req.param("script");if(!X)return Q.json({error:"missing script name"},400);return eZ(Q,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let X=Q.req.param("script");if(!X)return Q.json({error:"missing script name"},400);return eZ(Q,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>eZ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>eZ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let X=Q.req.param("step");if(!X||!CB6(X))return Q.json({error:`step must be one of: ${gd$.join(", ")}`},400);let Y=Q.get("vmClaim"),G=await u71(Q.var.studioContext,{claimName:Y.claimName})==="gone"?null:await VB6(Q);if(!G)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,R5);if(X==="start"){let J=n(Q.var.studioContext),W=py(Y.virtualMcpMetadata);try{await v70({ctx:Q.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:W})}catch(K){let F=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${F}`},502)}}return eZ(Q,`/_sandbox/setup/${X}`,{signal:Q.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let X=Q.get("vmClaim");if(!X.runner)return QN(Q,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return hc$(Q,{ctx:Q.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return yd$(Q);return Z(Q)});let Z=(Q)=>eZ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(bd$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return yd$(Q);return eZ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(bd$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")try{let Y=await Q.req.json().catch(()=>({})),G=await Hl(Q),J=await uT0(G,X.branch,Y.base);return Q.json(J,200,R5)}catch(Y){return WQ1(Q,Y)}return eZ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,R5);let X=xv(Q);if(X instanceof Response)return X;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=Q.get("vmClaim"),W=Q.var.studioContext;return vs(Y,async()=>{try{await l71(W,X,Y);let K=_s(G,J);if(K)await vd$(W,X,Y,K)}catch(K){if(K instanceof fv)return Q.json({error:K.message},403,R5);let F=K instanceof Error?K.message:String(K);return Q.json({error:F},502,R5)}return eZ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")return vs(X.claimName,async()=>{let Y=await Q.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return Q.json({error:"filepaths is required"},400,R5);try{let J=await Hl(Q);return await Vd$(J,X.branch,G),Q.json({ok:!0},200,R5)}catch(J){let W=J instanceof d4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return Q.json({error:K},W,R5)}});return vs(X.claimName,()=>eZ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")return vs(X.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Hl(Q),F=W.base??await K.getDefaultBranch();return await lT0(K,X.branch,F),Q.json({ok:!0},200,R5)}catch(W){return WQ1(Q,W)}});let Y=xv(Q);if(Y instanceof Response)return Y;let{claimName:G}=Q.get("vmClaim"),J=Q.var.studioContext;return vs(G,async()=>{try{await l71(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,R5)}return eZ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",a5({maxSize:fd$,onError:(Q)=>Q.json({error:"Payload too large"},413,R5)}),async(Q)=>{let X=Q.get("vmClaim"),Y=null;if(X.runtime!=="cms"){let F=xv(Q);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=X,K=Q.var.studioContext;try{let F=await Q.req.json().catch(()=>({})),H=F.status,U=F.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=m71(H)&&N?[H,U]:Y?await Promise.all([dT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),dT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Hl(Q);return Promise.all([hT0(L,X.branch),uT0(L,X.branch)])})(),w=await mc$(K,B,O);return Q.json(w,200,R5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,R5);return Q.json({error:H},502,R5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",a5({maxSize:fd$,onError:(Q)=>Q.json({error:"Payload too large"},413,R5)}),async(Q)=>{let X=Q.get("vmClaim"),Y=null;if(X.runtime!=="cms"){let F=xv(Q);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=X,K=Q.var.studioContext;try{let F=await Q.req.json().catch(()=>({})),H=F.status,U=F.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=m71(H)&&N?[H,U]:Y?await Promise.all([dT0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),dT0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Hl(Q);return Promise.all([hT0(L,X.branch),uT0(L,X.branch)])})(),w=await pc$(K,B,O,typeof F.language==="string"?F.language:void 0);return Q.json(w,200,R5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,R5);return Q.json({error:H},502,R5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let X=xv(Q);if(X instanceof Response)return X;let{claimName:Y}=Q.get("vmClaim"),G=Q.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Q.json({error:"Path not allowed"},403);let J;try{J=await X.getPreviewUrl(Y)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,"");return xd$(Q,`${W}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",a5({maxSize:IB6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let X=xv(Q);if(X instanceof Response)return X;let{claimName:Y}=Q.get("vmClaim"),G;try{G=await X.getPreviewUrl(Y)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let J;try{J=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return Q.json({error:"Invalid JSON body"},400);let W=Sd$(J);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=Cd$(G,W.resolveType);return xd$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var ud$=D(()=>{d$();VF();Yl();h71();Dn();xc$();n3();Ug();yc$();s3();gc$();uc$();mi0();jn();n71();nc$();o71();Zw();GQ1();_d$();JQ1();TB6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;MB6=qT0(async($,Z)=>{let Q=$.var.studioContext;try{t(Q)}catch{return $.json({error:"Unauthorized"},401)}let X=t0(Q);if(!X)return $.json({error:"Unauthorized"},401);let Y;try{Y=n(Q)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{RB6(J)}catch(w){let L=w instanceof Error?w.message:String(w);return $.json({error:L},400)}let W=await Q.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Bn({orgId:Y.id,virtualMcpId:G,branch:J}),F=await gi0(Q,J),H=hi0(F,X),U=bc$({userId:H,projectRef:K}),N=W.metadata??null,B=await kB6($,{claimName:U,branch:J,virtualMcpId:G,sandboxUserId:H,virtualMcpMetadata:N,branchThread:F});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:X,runner:null,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((w)=>w.connection_id)??[],runtime:B}),Z();let O;try{O=await FX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:X,runner:O,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((w)=>w.connection_id)??[],runtime:B}),Z()});cT0=new Map;R5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};gd$=["clone","install","start"]});function ld$($,Z,Q){let X=KQ1.get($);if(!X)X={pending:null,running:!1},KQ1.set($,X);if(!X.pending)X.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=X.pending;Y.deps=Z;for(let[J,W]of Object.entries(Q.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of Q.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!X.running)vB6($,X);return G}async function vB6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let X=await fB6(Q);for(let Y of Q.resolvers)Y(X)}catch(X){for(let Y of Q.rejecters)Y(X)}}}finally{if(Z.running=!1,!Z.pending)KQ1.delete($)}}async function fB6($){let{client:Z,branch:Q,packagePath:X}=$.deps;for(let Y=0;;Y++){let G=await Fl(Z,Q),J=await Z.getCommitTreeSha(G),W=await Z.getDecofileTree(J,X),K=QQ1(W,X),F=[],H=new Map(K.map((O)=>[O.path,{stem:O.stem,sha:O.sha}]));for(let[O,w]of $.set){let L=XQ1(K,O),E=`${JSON.stringify(w,null,2)}
-`,j=await Z.createBlob(E);await Id$(Z.owner,Z.repo,j,E);let z=L[0]??`${yT0(X)}/${a71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let P=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:P,sha:j,content:E});for(let A of L.slice(1))F.push({path:A,mode:"100644",type:"blob",sha:null}),H.delete(A)}for(let O of $.del)for(let w of XQ1(K,O))F.push({path:w,mode:"100644",type:"blob",sha:null}),H.delete(w);if(F.length===0)return G;let U=X?`${X}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===U)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:w,skipped:L}=ks(O);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:Q,packagePath:X,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(w);F.push({path:U,mode:"100644",type:"blob",sha:E})}let N=await Z.createTree(J,F),B=await Z.createCommit({message:bB6($),treeSha:N,parentShas:[G]});try{return await Z.updateRef(Q,B),B}catch(O){if(!(O instanceof d4&&O.status===422)||Y>=_B6-1)throw O;await L$(Q7(2000,200,Y,2,0.5))}}}function bB6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let X=`chore(decofile): ${Q.join("; ")}`;return ki0(X,$.deps.coAuthor)}var _B6=3,KQ1;var cd$=D(()=>{k70();ST0();a8();Zw();gT0();KQ1=new Map});import{createHmac as dd$,randomBytes as xB6,timingSafeEqual as yB6}from"crypto";function md$(){if(mT0)return mT0;let $;try{let Z=V0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return mT0=$?Buffer.from($):xB6(32),mT0}function FQ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+gB6)/1000)},X=Buffer.from(JSON.stringify(Q)).toString("base64url"),Y=dd$("sha256",md$()).update(X).digest("base64url");return`${X}.${Y}`}function id$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let X=$.slice(0,Q),Y=Buffer.from($.slice(Q+1)),G=Buffer.from(dd$("sha256",md$()).update(X).digest("base64url"));if(Y.length!==G.length||!yB6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(X,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var gB6=21600000,mT0=null;var pd$=D(()=>{D$()});import{z as Ul}from"zod";function uB6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&hB6.test($)}function ad$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function fs($){let Z=$.get("decofileScope");return kT0($.var.studioContext,Z.organizationId,Z.githubRepo)}function bs($,Z){if(Z instanceof d4){let X=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},X)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},500)}function sd$(){let $=new J1;return $.use("/:virtualMcpId/:branch",rd$),$.use("/:virtualMcpId/:branch/*",rd$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await qd$(X,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=FQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ad$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(X){return bs(Z,X)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),X=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await fs(Z),G=await Y.getFileTextAtRef(Q.branch,X);if(G===null){let J=await Y.getDefaultBranch();if(J!==Q.branch)G=await Y.getFileTextAtRef(J,X)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return bs(Z,Y)}}),$.patch("/:virtualMcpId/:branch",cB6,async(Z)=>{let Q=Z.get("decofileScope"),X=Z.var.studioContext,Y=dB6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{VT0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(r71(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await fs(Z),W=await ld$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Gl(X)},G),K=FQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:ad$(Z)})}catch(J){return bs(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await X.mergeBranch(Y,Q.branch,G)}catch(W){if(!(W instanceof d4&&W.status===409))throw W;await lT0(X,Q.branch,Y),J=await X.mergeBranch(Y,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof d4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof d4&&J.status===405){let K=await X.findOpenPullRequest(Y,Q.branch)??await X.createPullRequest({base:Y,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(X){return bs(Z,X)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([X.compare(Y,Q.branch),X.getBranchHead(Q.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof d4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(X){return bs(Z,X)}}),$}var hB6,nd$=500,td$=1048576,od$=1024,lB6=8388608,cB6,dB6,rd$;var ed$=D(()=>{Nt0();ST0();d$();VF();h71();MT0();JQ1();o71();cd$();pd$();GQ1();Zw();gT0();hB6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;cB6=a5({maxSize:lB6,onError:($)=>$.json({error:"Payload too large"},413)}),dB6=Ul.object({set:Ul.record(Ul.string(),Ul.unknown()).optional(),delete:Ul.array(Ul.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=nd$,{message:`Patch cannot touch more than ${nd$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=td$),{message:`Each block must be at most ${td$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=od$),{message:`Each block key must be at most ${od$} characters`}),rd$=qT0(async($,Z)=>{let Q=$.var.studioContext,X=Q.organization;if(!X)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!uB6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!id$(B,{organizationId:X.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!BD0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],U=_s(K,H);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:X.id,virtualMcpId:Y,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var $m$=($)=>{let Z=new J1;if(Z.use("*",Av),Z.route("/",uA0()),Z.route("/",wh$()),Z.route("/",Ac$()),Z.route("/",jc$()),Z.route("/",TT0()),Z.route("/tools",Vc$()),Z.route("/",qc$()),Z.route("/",sl$({kvStorage:$.kvStorage})),Z.route("/",rl$()),Z.route("/fs",Nc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",hd$()),Z.route("/decofile",sd$()),Z.route("/",wc$()),Z.route("/deco-sites",cA0()),Z.route("/hosting",Gh$()),Z.route("/monitor",Nh$()),Z.route("/sso",fA0()),Z.route("/",RT0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",$h$()),$.mountDevAssets)Z.route("/dev-assets",pA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Tx$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Oc$()),Z.route("/mcp",dL0()),Z.route("/mcp/self",AT0()),Z.route("/mcp",pL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var Zm$=D(()=>{d$();kA0();Zh$();FZ1();Jh$();Bh$();nA0();$s();YZ1();al$();el$();Bc$();Zo();s91();nL0();_71();Dc$();Lc$();zc$();Tc$();Mc$();f71();Sc$();b71();mL0();ud$();ed$()});function mB6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var iB6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Qm$=()=>{let $=new J1;return $.use("*",iB6),$.get("/",async(Z)=>{let Q=V0(),X=Q.decoSupabaseUrl,Y=Q.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let G=await PY(X,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:mB6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Xm$=D(()=>{d$();D$();yP0()});import{z as q1}from"zod";function bF($,Z="invalid_request_error",Q=null,X=null){return{error:{message:$,type:Z,param:Q,code:X}}}function ZO6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),X=$.substring(Z+1);if(!Q||!X)return null;return{credentialId:Q,modelId:X}}function QO6($,Z,Q){try{return JSON.parse($)}catch{throw new Jm$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function XO6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let X of Q.tool_calls)Z[X.id]=X.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:QO6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let X=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:X,output:{type:"text",value:Q.content}}]}}})}function YO6($){let Z=$.map((Q)=>{let X=Q.function.parameters?eY(Q.function.parameters):eY({type:"object",properties:{}});return[Q.function.name,V$({description:Q.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function GO6($){if(!$)return;return{openai:{response_format:$}}}function JO6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Ym$($,Z,Q,X,Y,G){let J={model:$,messages:Z,tools:Q,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Gm$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var pB6=256,nB6,tB6,oB6,rB6,aB6,sB6,eB6,$O6,Jm$,Wm$,Km$;var Fm$=D(()=>{g4();d$();Yl();fU();nB6=q1.object({type:q1.literal("function"),function:q1.object({name:q1.string(),description:q1.string().optional(),parameters:q1.record(q1.string(),q1.unknown()).optional()})}),tB6=q1.object({id:q1.string(),type:q1.literal("function"),function:q1.object({name:q1.string(),arguments:q1.string()})}),oB6=q1.discriminatedUnion("role",[q1.object({role:q1.literal("system"),content:q1.string(),name:q1.string().optional()}),q1.object({role:q1.literal("user"),content:q1.union([q1.string(),q1.array(q1.union([q1.object({type:q1.literal("text"),text:q1.string()}),q1.object({type:q1.literal("image_url"),image_url:q1.object({url:q1.string(),detail:q1.string().optional()})})]))]),name:q1.string().optional()}),q1.object({role:q1.literal("assistant"),content:q1.string().nullable().optional(),name:q1.string().optional(),tool_calls:q1.array(tB6).optional()}),q1.object({role:q1.literal("tool"),content:q1.string(),tool_call_id:q1.string()})]),rB6=q1.object({type:q1.literal("text")}),aB6=q1.object({type:q1.literal("json_object")}),sB6=q1.object({type:q1.literal("json_schema"),json_schema:q1.object({name:q1.string(),description:q1.string().optional(),schema:q1.record(q1.string(),q1.unknown()),strict:q1.boolean().optional()})}),eB6=q1.union([rB6,aB6,sB6]),$O6=q1.object({model:q1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:q1.array(oB6),stream:q1.boolean().optional().default(!1),temperature:q1.number().min(0).max(2).optional(),max_tokens:q1.number().positive().optional(),top_p:q1.number().min(0).max(1).optional(),frequency_penalty:q1.number().min(-2).max(2).optional(),presence_penalty:q1.number().min(-2).max(2).optional(),stop:q1.union([q1.string(),q1.array(q1.string())]).optional(),tools:q1.array(nB6).optional(),tool_choice:q1.union([q1.literal("auto"),q1.literal("none"),q1.literal("required"),q1.object({type:q1.literal("function"),function:q1.object({name:q1.string()})})]).optional(),response_format:eB6.optional(),user:q1.string().optional()});Jm$=class Jm$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Wm$=new J1;Wm$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(bF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=$O6.safeParse(X);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=ZO6(G.model);if(!J)return $.json(bF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>EL(j.providerId));if(!E)return $.json(bF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),U=XO6(G.messages),N=G.tools?YO6(G.tools):void 0,B=GO6(G.response_format),O=JO6(),w=Math.floor(Date.now()/1000);if(G.stream)return QN($,async(L)=>{let E=Ym$(H,U,N,G,B,$.req.raw.signal);try{let j=fO(E),z=!1,P=0,A="",I=async()=>{if(A.length===0)return;let k=A;A="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=pB6)await I()}else if(k.type==="tool-call"){await I();let M=P++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{},finish_reason:Gm$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Ym$(H,U,N,G,B,$.req.raw.signal),E=await _O(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:w,model:G.model,choices:[{index:0,message:j,finish_reason:Gm$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(bF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bF(Y.message,"server_error"),500)}});Km$=Wm$});function WO6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Hm$(){let $=new J1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),X=t0(Q);if(!X)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!sQ(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",X).execute(),W=[];for(let F of J){if(!F.slug||m9(F))continue;let H=await Q.storage.virtualMcps.list(F.id);for(let U of H){if(ee1(U)!==G)continue;if(!WO6(U.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Um$=D(()=>{d$();cH()});var Bm$;var Nm$=D(()=>{Bm$={name:"decocms",version:"4.329.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function HO6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??FO6}}var Om$,FO6="https://ph.studio.decocms.com",Dm$;var wm$=D(()=>{d$();W90();G_();u5();D$();u91();Nm$();Om$=new J1;Om$.get("/",($)=>{let Z={version:Bm$.version,theme:Dp1(),...bH().logo&&{logo:bH().logo},...PU()&&{internalUrl:l_1()},...V0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!V0().firecrawlApiKey,hostingEnabled:!!V0().controlplaneRestUrl&&!!V0().controlplaneServiceToken,hostingControlPlaneGa:V0().hostingControlPlaneGa,monitorEnabled:!!V0().clickhouseAnalyticsUrl&&!!V0().clickhouseAnalyticsPassword,monitorGa:V0().monitorGa,auth:Gg$(),posthog:HO6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:ds()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Dm$=Om$});function Nl($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function HQ1($){return(Nl($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Em$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Nl($))}&sz=${Z}`}function Lm$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let X=Q.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function jm$($){let{brand:Z,domain:Q,score:X,verdict:Y}=$,G=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Lm$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Lm$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var yv,UO6,NO6,BO6,OO6,zm$;var Pm$=D(()=>{yv=l0.enum(["good","bad","neutral"]),UO6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:yv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),NO6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(UO6)),BO6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},OO6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:yv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:yv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:yv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:yv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(NO6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:yv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:yv.optional()})).min(1)})]),zm$=l0.object({...BO6,template:OO6})});function iT0($){let Z=[],Q=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=zm$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),X=Q.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:X},slides:Q},drops:Z}}var UQ1=D(()=>{Pm$()});import{join as Am$}from"path";async function wO6($){try{let Z=await fetch(`${LK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(DO6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:X}=iT0(Q);if(!X.slides.length)return null;let Y=X.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:X.meta.brand?.trim()||HQ1($),score:X.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function RG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function LO6($,Z){let Q=Nl($),X=Z?.brand?.trim()||HQ1(Q),Y=Em$(Q,128),J=`${(V0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=jm$({brand:X,domain:Q,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${X} commerce report by decocms`;return[`<title>${RG(W)}</title>`,`<meta name="description" content="${RG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${RG(W)}" />`,`<meta property="og:description" content="${RG(K)}" />`,`<meta property="og:url" content="${RG(J)}" />`,`<meta property="og:image" content="${RG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${RG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${RG(W)}" />`,`<meta name="twitter:description" content="${RG(K)}" />`,`<meta name="twitter:image" content="${RG(F)}" />`,`<meta name="twitter:image:alt" content="${RG(H)}" />`,`<link rel="canonical" href="${RG(J)}" />`,`<link rel="icon" href="${RG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await Id$(Z.owner,Z.repo,j,E);let z=L[0]??`${yT0(X)}/${a71(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let P=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:P,sha:j,content:E});for(let A of L.slice(1))F.push({path:A,mode:"100644",type:"blob",sha:null}),H.delete(A)}for(let O of $.del)for(let w of XQ1(K,O))F.push({path:w,mode:"100644",type:"blob",sha:null}),H.delete(w);if(F.length===0)return G;let U=X?`${X}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===U)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:w,skipped:L}=ks(O);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:Q,packagePath:X,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(w);F.push({path:U,mode:"100644",type:"blob",sha:E})}let N=await Z.createTree(J,F),B=await Z.createCommit({message:bB6($),treeSha:N,parentShas:[G]});try{return await Z.updateRef(Q,B),B}catch(O){if(!(O instanceof d4&&O.status===422)||Y>=_B6-1)throw O;await L$(Q7(2000,200,Y,2,0.5))}}}function bB6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let X=`chore(decofile): ${Q.join("; ")}`;return ki0(X,$.deps.coAuthor)}var _B6=3,KQ1;var cd$=D(()=>{k70();ST0();a8();Zw();gT0();KQ1=new Map});import{createHmac as dd$,randomBytes as xB6,timingSafeEqual as yB6}from"crypto";function md$(){if(mT0)return mT0;let $;try{let Z=V0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return mT0=$?Buffer.from($):xB6(32),mT0}function FQ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+gB6)/1000)},X=Buffer.from(JSON.stringify(Q)).toString("base64url"),Y=dd$("sha256",md$()).update(X).digest("base64url");return`${X}.${Y}`}function id$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let X=$.slice(0,Q),Y=Buffer.from($.slice(Q+1)),G=Buffer.from(dd$("sha256",md$()).update(X).digest("base64url"));if(Y.length!==G.length||!yB6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(X,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var gB6=21600000,mT0=null;var pd$=D(()=>{D$()});import{z as Ul}from"zod";function uB6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&hB6.test($)}function ad$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function fs($){let Z=$.get("decofileScope");return kT0($.var.studioContext,Z.organizationId,Z.githubRepo)}function bs($,Z){if(Z instanceof d4){let X=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},X)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},500)}function sd$(){let $=new J1;return $.use("/:virtualMcpId/:branch",rd$),$.use("/:virtualMcpId/:branch/*",rd$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await qd$(X,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=FQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ad$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(X){return bs(Z,X)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),X=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await fs(Z),G=await Y.getFileTextAtRef(Q.branch,X);if(G===null){let J=await Y.getDefaultBranch();if(J!==Q.branch)G=await Y.getFileTextAtRef(J,X)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return bs(Z,Y)}}),$.patch("/:virtualMcpId/:branch",cB6,async(Z)=>{let Q=Z.get("decofileScope"),X=Z.var.studioContext,Y=dB6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{VT0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(r71(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await fs(Z),W=await ld$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Gl(X)},G),K=FQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:ad$(Z)})}catch(J){return bs(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await X.mergeBranch(Y,Q.branch,G)}catch(W){if(!(W instanceof d4&&W.status===409))throw W;await lT0(X,Q.branch,Y),J=await X.mergeBranch(Y,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof d4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof d4&&J.status===405){let K=await X.findOpenPullRequest(Y,Q.branch)??await X.createPullRequest({base:Y,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(X){return bs(Z,X)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await fs(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([X.compare(Y,Q.branch),X.getBranchHead(Q.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof d4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(X){return bs(Z,X)}}),$}var hB6,nd$=500,td$=1048576,od$=1024,lB6=8388608,cB6,dB6,rd$;var ed$=D(()=>{Nt0();ST0();d$();VF();h71();MT0();JQ1();o71();cd$();pd$();GQ1();Zw();gT0();hB6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;cB6=a5({maxSize:lB6,onError:($)=>$.json({error:"Payload too large"},413)}),dB6=Ul.object({set:Ul.record(Ul.string(),Ul.unknown()).optional(),delete:Ul.array(Ul.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=nd$,{message:`Patch cannot touch more than ${nd$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=td$),{message:`Each block must be at most ${td$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=od$),{message:`Each block key must be at most ${od$} characters`}),rd$=qT0(async($,Z)=>{let Q=$.var.studioContext,X=Q.organization;if(!X)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!uB6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!id$(B,{organizationId:X.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!BD0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],U=_s(K,H);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:X.id,virtualMcpId:Y,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var $m$=($)=>{let Z=new J1;if(Z.use("*",Av),Z.route("/",uA0()),Z.route("/",wh$()),Z.route("/",Ac$()),Z.route("/",jc$()),Z.route("/",TT0()),Z.route("/tools",Vc$()),Z.route("/",qc$()),Z.route("/",sl$({kvStorage:$.kvStorage})),Z.route("/",rl$()),Z.route("/fs",Nc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",hd$()),Z.route("/decofile",sd$()),Z.route("/",wc$()),Z.route("/deco-sites",cA0()),Z.route("/hosting",Gh$()),Z.route("/monitor",Nh$()),Z.route("/sso",fA0()),Z.route("/",RT0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",$h$()),$.mountDevAssets)Z.route("/dev-assets",pA0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Tx$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Oc$()),Z.route("/mcp",dL0()),Z.route("/mcp/self",AT0()),Z.route("/mcp",pL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var Zm$=D(()=>{d$();kA0();Zh$();FZ1();Jh$();Bh$();nA0();$s();YZ1();al$();el$();Bc$();Zo();s91();nL0();_71();Dc$();Lc$();zc$();Tc$();Mc$();f71();Sc$();b71();mL0();ud$();ed$()});function mB6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var iB6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Qm$=()=>{let $=new J1;return $.use("*",iB6),$.get("/",async(Z)=>{let Q=V0(),X=Q.decoSupabaseUrl,Y=Q.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let G=await PY(X,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:mB6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Xm$=D(()=>{d$();D$();yP0()});import{z as q1}from"zod";function bF($,Z="invalid_request_error",Q=null,X=null){return{error:{message:$,type:Z,param:Q,code:X}}}function ZO6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),X=$.substring(Z+1);if(!Q||!X)return null;return{credentialId:Q,modelId:X}}function QO6($,Z,Q){try{return JSON.parse($)}catch{throw new Jm$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function XO6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let X of Q.tool_calls)Z[X.id]=X.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:QO6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let X=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:X,output:{type:"text",value:Q.content}}]}}})}function YO6($){let Z=$.map((Q)=>{let X=Q.function.parameters?eY(Q.function.parameters):eY({type:"object",properties:{}});return[Q.function.name,V$({description:Q.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function GO6($){if(!$)return;return{openai:{response_format:$}}}function JO6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Ym$($,Z,Q,X,Y,G){let J={model:$,messages:Z,tools:Q,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Gm$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var pB6=256,nB6,tB6,oB6,rB6,aB6,sB6,eB6,$O6,Jm$,Wm$,Km$;var Fm$=D(()=>{g4();d$();Yl();fU();nB6=q1.object({type:q1.literal("function"),function:q1.object({name:q1.string(),description:q1.string().optional(),parameters:q1.record(q1.string(),q1.unknown()).optional()})}),tB6=q1.object({id:q1.string(),type:q1.literal("function"),function:q1.object({name:q1.string(),arguments:q1.string()})}),oB6=q1.discriminatedUnion("role",[q1.object({role:q1.literal("system"),content:q1.string(),name:q1.string().optional()}),q1.object({role:q1.literal("user"),content:q1.union([q1.string(),q1.array(q1.union([q1.object({type:q1.literal("text"),text:q1.string()}),q1.object({type:q1.literal("image_url"),image_url:q1.object({url:q1.string(),detail:q1.string().optional()})})]))]),name:q1.string().optional()}),q1.object({role:q1.literal("assistant"),content:q1.string().nullable().optional(),name:q1.string().optional(),tool_calls:q1.array(tB6).optional()}),q1.object({role:q1.literal("tool"),content:q1.string(),tool_call_id:q1.string()})]),rB6=q1.object({type:q1.literal("text")}),aB6=q1.object({type:q1.literal("json_object")}),sB6=q1.object({type:q1.literal("json_schema"),json_schema:q1.object({name:q1.string(),description:q1.string().optional(),schema:q1.record(q1.string(),q1.unknown()),strict:q1.boolean().optional()})}),eB6=q1.union([rB6,aB6,sB6]),$O6=q1.object({model:q1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:q1.array(oB6),stream:q1.boolean().optional().default(!1),temperature:q1.number().min(0).max(2).optional(),max_tokens:q1.number().positive().optional(),top_p:q1.number().min(0).max(1).optional(),frequency_penalty:q1.number().min(-2).max(2).optional(),presence_penalty:q1.number().min(-2).max(2).optional(),stop:q1.union([q1.string(),q1.array(q1.string())]).optional(),tools:q1.array(nB6).optional(),tool_choice:q1.union([q1.literal("auto"),q1.literal("none"),q1.literal("required"),q1.object({type:q1.literal("function"),function:q1.object({name:q1.string()})})]).optional(),response_format:eB6.optional(),user:q1.string().optional()});Jm$=class Jm$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Wm$=new J1;Wm$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(bF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=$O6.safeParse(X);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=ZO6(G.model);if(!J)return $.json(bF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>EL(j.providerId));if(!E)return $.json(bF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),U=XO6(G.messages),N=G.tools?YO6(G.tools):void 0,B=GO6(G.response_format),O=JO6(),w=Math.floor(Date.now()/1000);if(G.stream)return QN($,async(L)=>{let E=Ym$(H,U,N,G,B,$.req.raw.signal);try{let j=fO(E),z=!1,P=0,A="",I=async()=>{if(A.length===0)return;let k=A;A="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=pB6)await I()}else if(k.type==="tool-call"){await I();let M=P++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await I(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{},finish_reason:Gm$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await I(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Ym$(H,U,N,G,B,$.req.raw.signal),E=await _O(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:w,model:G.model,choices:[{index:0,message:j,finish_reason:Gm$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(bF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bF(Y.message,"server_error"),500)}});Km$=Wm$});function WO6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Hm$(){let $=new J1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),X=t0(Q);if(!X)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!sQ(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",X).execute(),W=[];for(let F of J){if(!F.slug||m9(F))continue;let H=await Q.storage.virtualMcps.list(F.id);for(let U of H){if(ee1(U)!==G)continue;if(!WO6(U.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Um$=D(()=>{d$();cH()});var Bm$;var Nm$=D(()=>{Bm$={name:"decocms",version:"4.329.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function HO6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??FO6}}var Om$,FO6="https://ph.studio.decocms.com",Dm$;var wm$=D(()=>{d$();W90();G_();u5();D$();u91();Nm$();Om$=new J1;Om$.get("/",($)=>{let Z={version:Bm$.version,theme:Dp1(),...bH().logo&&{logo:bH().logo},...PU()&&{internalUrl:l_1()},...V0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!V0().firecrawlApiKey,hostingEnabled:!!V0().controlplaneRestUrl&&!!V0().controlplaneServiceToken,hostingControlPlaneGa:V0().hostingControlPlaneGa,monitorEnabled:!!V0().clickhouseAnalyticsUrl&&!!V0().clickhouseAnalyticsPassword,monitorGa:V0().monitorGa,auth:Gg$(),posthog:HO6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:ds()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Dm$=Om$});function Nl($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function HQ1($){return(Nl($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Em$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Nl($))}&sz=${Z}`}function Lm$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let X=Q.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function jm$($){let{brand:Z,domain:Q,score:X,verdict:Y}=$,G=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Lm$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Lm$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var yv,UO6,NO6,BO6,OO6,zm$;var Pm$=D(()=>{yv=l0.enum(["good","bad","neutral"]),UO6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:yv.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),NO6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(UO6)),BO6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},OO6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:yv.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:yv.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:yv.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:yv.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(NO6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:yv.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:yv.optional()})).min(1)})]),zm$=l0.object({...BO6,template:OO6})});function iT0($){let Z=[],Q=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=zm$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),X=Q.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:X},slides:Q},drops:Z}}var UQ1=D(()=>{Pm$()});import{join as Am$}from"path";async function wO6($){try{let Z=await fetch(`${LK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(DO6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:X}=iT0(Q);if(!X.slides.length)return null;let Y=X.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:X.meta.brand?.trim()||HQ1($),score:X.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function RG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function LO6($,Z){let Q=Nl($),X=Z?.brand?.trim()||HQ1(Q),Y=Em$(Q,128),J=`${(V0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=jm$({brand:X,domain:Q,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${X} commerce report by decocms`;return[`<title>${RG(W)}</title>`,`<meta name="description" content="${RG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${RG(W)}" />`,`<meta property="og:description" content="${RG(K)}" />`,`<meta property="og:url" content="${RG(J)}" />`,`<meta property="og:image" content="${RG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${RG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${RG(W)}" />`,`<meta name="twitter:description" content="${RG(K)}" />`,`<meta name="twitter:image" content="${RG(F)}" />`,`<meta name="twitter:image:alt" content="${RG(H)}" />`,`<link rel="canonical" href="${RG(J)}" />`,`<link rel="icon" href="${RG(Y)}" sizes="any" />`].join(`
     `)}function EO6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Tm$($){let Z=new J1;return Z.get("/:domain/og.png",async(Q)=>{let X=Nl(Q.req.param("domain")),Y=async()=>{let G=$?Bun.file(Am$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return Q.notFound();return Q.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${LK({})}/api/v2/public/diagnostics/${encodeURIComponent(X)}/og.png`,{signal:AbortSignal.timeout(jO6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return Q.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(Q)=>{let X=Q.req.param("domain"),Y=$?Am$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return Q.notFound();let J=await G.text();try{let W=await wO6(Nl(X)),K=LO6(X,W);return Q.html(EO6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(J)}}),Z}var DO6=2500,jO6=1e4;var Rm$=D(()=>{d$();UQ1();TE();D$()});function xs($,Z){return fetch(`${LK({})}${$}`,Z)}async function zO6($,Z,Q){let X=new URLSearchParams;if(Z)X.set("pw",Z);if(Q)X.set("lang",Q);let Y=X.toString()?`?${X.toString()}`:"",G=await xs(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=iT0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var PO6,YN,Im$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},qm$;var Mm$=D(()=>{d$();oY();TE();UQ1();PO6=new Set(["complete","errored","terminated","unknown"]),YN=new J1;YN.use("*",async($,Z)=>{let Q=await $8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});YN.use("/link-token/*",Im$);YN.use("/suggest",Im$);YN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),X=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await zO6(Z,X,Y);if($.header("Cache-Control","private, no-store"),Q||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});YN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let X=typeof Q.domain==="string"?Q.domain.trim():"";if(!X)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let J=await xs("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${AE({})}`},body:JSON.stringify({url:X,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});YN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await xs(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${AE({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let Y=(await Q.json()).status??"unknown",G={done:PO6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});YN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await xs(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});YN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await xs(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let X=await Q.json();return $.json({suggestions:Array.isArray(X.suggestions)?X.suggestions:[]})}catch{return $.json({suggestions:[]})}});qm$=YN});import{createHmac as AO6,timingSafeEqual as TO6}from"crypto";function Vm$($,Z,Q,X=Date.now()){if(!Z||!Q)return!1;let Y,G=[];for(let F of Z.split(",")){let H=F.indexOf("=");if(H<=0)continue;let U=F.slice(0,H).trim(),N=F.slice(H+1).trim();if(U==="t")Y=N;else if(U==="v1")G.push(N)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(X/1000-J)>RO6)return!1;let W=AO6("sha256",Q).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((F)=>{let H=Buffer.from(F,"hex");return K.length===H.length&&TO6(K,H)})}function Sm$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=mJ(Z),X=mJ(mJ(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!X)return null;return{id:xF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:X}}}function Cm$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function xF($){return typeof $==="string"?$:void 0}function mJ($){return typeof $==="object"&&$!==null?$:void 0}function pT0($){return typeof $==="number"?new Date($*1000):null}function OQ1($){return xF($)??xF(mJ($)?.id)}function IO6($){return OQ1($.subscription)??xF(mJ(mJ($.parent)?.subscription_details)?.subscription)}function qO6($){let Z=pT0($.current_period_end);if(Z)return Z;let Q=mJ($.items)?.data;if(!Array.isArray(Q))return null;let X=0;for(let Y of Q){let G=mJ(Y)?.current_period_end;if(typeof G==="number"&&G>X)X=G}return X>0?new Date(X*1000):null}function NQ1($,Z){let Q=pT0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function BQ1($,Z){let Q=pT0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function MO6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let X=xF(mJ(Q.metadata)?.orgId);if(!X)return{handled:!1,reason:"no orgId"};if(xF(mJ(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(xF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=xF(Q.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:X}),{handled:!1,reason:"topup session without id"};let W=Number(mJ(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:X,creditCents:mJ(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:X,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(xF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(X);if(!Y)return{handled:!1,reason:"unknown org"};let G=OQ1(Q.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:X,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(NQ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X,{stripeCustomerId:OQ1(Q.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:BQ1(Z,Y)}),{handled:!0,organizationId:X}}case"customer.subscription.updated":case"customer.subscription.deleted":{let X=xF(Q.id);if(!X)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(X);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&NQ1(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Cm$(Q.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:qO6(Q),...G&&{stripeSubscriptionId:null},lastStripeEventAt:BQ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let X=IO6(Q);if(!X)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(X);if(!Y)return{handled:!1,reason:"unknown subscription"};if(NQ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:pT0(Q.period_end),lastStripeEventAt:BQ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function kO6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Cm$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function km$($,Z){let Q=kO6($,Z);if(!Q)return;mY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:Tt1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function _m$($){let Z=new BK(B8().db),Q=await MO6(Z,$);if(!(Q.handled&&Q.topUp))km$($,Q);if(Q.handled&&Q.topUp)await oj$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),km$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await $1$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(X){if(!(X instanceof rY&&(X.status===400||X.status===404)))throw X}return Q}var RO6=300;var vm$=D(()=>{aG();v4();u50();bE();P11()});var VO6=1048576,DQ1;var fm$=D(()=>{d$();VF();D$();vm$();DQ1=new J1;DQ1.post("/webhook",a5({maxSize:VO6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=V0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!Vm$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=Sm$(Q);if(!Y)return $.json({error:"invalid payload"},400);let G=await _m$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as SO6}from"crypto";function _O6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let X=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==X.length)return!1;return SO6(Buffer.from(Y),Buffer.from(X))}var CO6=5242880,wQ1;var bm$=D(()=>{d$();VF();s3();wQ1=new J1;wQ1.post("/webhook",a5({maxSize:CO6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let Q=await $.req.text();if(!_O6(Q,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let X;try{X=JSON.parse(Q)}catch{return $.json({error:"invalid payload"},400)}let Y=X.ref,G=X.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await Ht0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function xm$($){let Z=new pU($.db,new hQ($.encryptionKey)),Q=new J1;return Q.get("/attachments/:token",async(X)=>{let Y=nK$(X.req.param("token"));if(!Y)return X.json({error:"Invalid or expired link"},404);let G=await Z.getByOrg(Y.organizationId);if(!G)return X.json({error:"Jira is not connected"},404);let W=await new WG(G.siteUrl,G.email,G.apiToken).downloadAttachment(Y.attachmentId);if(!W.ok||!W.body)return X.json({error:"Jira refused the download"},502);let K=new Headers;for(let F of["content-type","content-length","content-disposition"]){let H=W.headers.get(F);if(H)K.set(F,H)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var ym$=D(()=>{d$();tN();Wo0();dC()});function gm$($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,X=Z.issue?.key,Y=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof X!=="string"||typeof Y!=="string"&&typeof Y!=="number")return null;let G=Z.changelog?.items?.find((J)=>J.field==="status");if(!G||typeof G.toString!=="string")return null;return{issueId:String(Q),issueKey:X,toStatus:G.toString,changelogId:String(Y)}}function hm$($,Z,Q){let X=[];for(let Y of Z){if(new Date(Y.created).getTime()<Q.getTime())continue;let G=Y.items.find((J)=>J.field==="status");if(!G||typeof G.toString!=="string")continue;X.push({issueId:$.id,issueKey:$.key,toStatus:G.toString,changelogId:Y.id})}return X.sort((Y,G)=>Number(Y.changelogId)-Number(G.changelogId))}function bO6($){return`Jira ${$.key}: ${$.summary}`}async function nT0($,Z,Q){if(!Z.enabled)return"disabled";let X=Z.organizationId,Y=await $.storage.jiraIntegrations.getAutomation(X,Q.toStatus);if(!Y)return"no_rule";let G=new WG(Z.siteUrl,Z.email,Z.apiToken),J=await Jw0(G,Z.siteUrl,Q.issueId),W=await xO6($,Z,Q,J);if(!await $.storage.jiraIntegrations.claimTrigger(X,Q.issueId,Q.changelogId))return"duplicate";let F=await $.storage.taskBoard.update(W.id,X,{assigneeId:m$,assignedBy:Z.createdBy},Z.createdBy);try{await XW($,F,{instruction:Y.prompt??vO6,source:{kind:"jira",issueKey:J.key,title:bO6(J),body:`${Ww0(J)}
 
@@ -2988,5 +2988,5 @@ ${fO6}`}})}catch(H){throw await $.storage.taskBoard.unassignSuperAgent(W.id,X,Z.
 `)});function um$($){let Z=new pU($.db,new hQ($.encryptionKey));async function Q(Y,G){let J=gm$(G);if(!J)return;let W=await Z.getByWebhookSecret(Y);if(!W?.enabled)return;let K=await rK($.db,W.organizationId);if(!K)return;if(await nT0(K,W,J)==="started")console.log(`[jira-webhook] started a run for ${J.issueKey} entering "${J.toStatus}"`)}let X=new J1;return X.post("/webhook/:secret",a5({maxSize:yO6}),async(Y)=>{let G=Y.req.param("secret");if(!await Z.getByWebhookSecret(G))return Y.json({error:"Unknown webhook"},404);let W;try{W=await Y.req.json()}catch{return Y.json({error:"Body must be JSON"},400)}return Q(G,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),Y.body(null,202)}),X}var yO6=1048576;var lm$=D(()=>{d$();VF();tN();LQ1();Cg()});import{DBOS as tT0,SchedulerMode as gO6}from"@dbos-inc/dbos-sdk";function dm$($){jQ1=$}function mm$(){if(!jQ1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return jQ1}function im$(){let $=mm$();return new pU($.db,new hQ($.encryptionKey))}async function lO6($,Z){try{let Q=await im$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let X=await rK(mm$().db,Q.organizationId);if(!X)return{integrationId:$,started:0};if((await X.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let G=new WG(Q.siteUrl,Q.email,Q.apiToken),W=`(${await G.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${cm$}m"`,K=0,F;for(let H=0;H<uO6;H++){let U=await G.searchIssues({jql:W,nextPageToken:F,expandChangelog:!0});for(let N of U.issues){let B=hm$(N,N.changelog?.histories??[],Z);for(let O of B)if(await nT0(X,Q,O)==="started")K++}if(F=U.nextPageToken??void 0,!F)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function cO6($,Z){let Q=new Date($.getTime()-cm$*60000),X=await tT0.runStep(()=>im$().listEnabledIds(),{name:"loadJiraIntegrations"});if(X.length===0)return;let Y=await Promise.all(X.map((G)=>tT0.runStep(()=>lO6(G,Q),{name:`sweepJira:${G}`})));for(let G of Y)if(G.error)console.warn(`[jira-trigger] integration ${G.integrationId} failed: ${G.error}`);else if(G.started>0)console.log(`[jira-trigger] integration ${G.integrationId} started ${G.started} run(s) the webhook missed`)}function pm$(){if(EQ1)return;EQ1=tT0.registerWorkflow(cO6,{name:"jiraTriggerSweepWorkflow"}),tT0.registerScheduled(EQ1,{name:"jiraTriggerSweepWorkflow",crontab:hO6,mode:gO6.ExactlyOncePerIntervalWhenActive})}var hO6="7-59/10 * * * *",cm$=15,uO6=5,jQ1=null,EQ1=null;var nm$=D(()=>{tN();Cg();dC();LQ1()});function tm$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var om$,dO6,mO6,rm$;var am$=D(()=>{d$();V3();bg();SE();om$=new J1,dO6=["range","if-none-match","if-modified-since"],mO6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];om$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(yu($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Z$(401,{message:"Authentication required"})}if(!Q)throw new Z$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new Z$(400,{message:"Missing file key"});let Y=await It(X,Z);if(!Y)throw new Z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&gX()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Z$(500,{message:"Invalid data URL from storage"});let[,F,H]=K,U=Buffer.from(H,"base64"),N=new Headers({"Content-Type":F,"Cache-Control":"private, max-age=86400"});return tm$(N,F),new Response(U,{status:200,headers:N})}let G=new Headers;for(let K of dO6){let F=$.req.header(K);if(F)G.set(K,F)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new Z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of mO6){let F=J.headers.get(K);if(F)W.set(K,F)}return W.set("Cache-Control","private, max-age=86400"),tm$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});rm$=om$});var ys=_((gv)=>{var iO6=gv&&gv.__createBinding||(Object.create?function($,Z,Q,X){if(X===void 0)X=Q;var Y=Object.getOwnPropertyDescriptor(Z,Q);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,X,Y)}:function($,Z,Q,X){if(X===void 0)X=Q;$[X]=Z[Q]}),pO6=gv&&gv.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))iO6(Z,$,Q)};Object.defineProperty(gv,"__esModule",{value:!0});pO6(SY(),gv)});var $i$=_((sm$)=>{Object.defineProperty(sm$,"__esModule",{value:!0});sm$.version=void 0;sm$.version="3.4.0"});var Xi$=_((yF)=>{var nO6=yF&&yF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(yF,"__esModule",{value:!0});yF.NodeTransport=yF.VERSION=void 0;yF.nodeResolveHost=eO6;var Q5=ys(),tO6=P0("net"),zQ1=P0("tls"),oO6=P0("path"),Zi$=P0("fs"),rO6=nO6(P0("dns")),aO6=$i$();yF.VERSION=aO6.version;var sO6="nats.js";class Qi${socket;version;lang;yields=[];signal=(0,Q5.deferred)();closedNotification=(0,Q5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=sO6,this.version=yF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:X}=Q||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,Q5.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw Q5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new Q5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new Q5.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,Q5.deferred)(),Q,X=(0,tO6.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{Q=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(Q)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,Q5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let X=Q5.DataBuffer.concat(...this.yields),Y=(0,Q5.extractProtocolMessage)(X);if(Y!=="")try{let G=Q5.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,Q5.deferred)();try{if($=(0,oO6.resolve)($),!(0,Zi$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Zi$.readFile)($,(Q,X)=>{if(Q)return Z.reject(Q);Z.resolve(X)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:X,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Q=(0,Q5.extend)(Q,this.options.tls,Y)}catch(Y){return Promise.reject(new Q5.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,Q5.deferred)();try{let Y=(0,zQ1.connect)($.port,$.hostname,Q,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new Q5.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,Q5.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new Q5.errors.ConnectionError(X.message,{cause:X}))}let Q=(0,Q5.deferred)();try{let X=(0,zQ1.connect)(Z,()=>{X.removeAllListeners(),Q.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Q.reject($),X.removeAllListeners()})}catch(X){Q.reject(new Q5.errors.ConnectionError(X.message,{cause:X}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,Q5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Q5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof zQ1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,Q5.render)($)}`);let Z=(0,Q5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,Q5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,Q5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}yF.NodeTransport=Qi$;function eO6($){let Z=(0,Q5.deferred)();return rO6.default.lookup($,{all:!0},(Q,X)=>{if(Q){Z.reject(Q);return}let Y=[];for(let G of X)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Ki$=_((Wi$)=>{Object.defineProperty(Wi$,"__esModule",{value:!0});Wi$.connect=$D6;var Yi$=Xi$(),Gi$=ys(),Ji$=ys();function $D6($={}){if((0,Ji$.hasWsProtocol)($))return Promise.reject(Ji$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Gi$.setTransportFactory)({factory:()=>{return new Yi$.NodeTransport},dnsResolveFn:Yi$.nodeResolveHost}),Gi$.NatsConnectionImpl.connect($)}});var Fi$=_((GN)=>{var QD6=GN&&GN.__createBinding||(Object.create?function($,Z,Q,X){if(X===void 0)X=Q;var Y=Object.getOwnPropertyDescriptor(Z,Q);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,X,Y)}:function($,Z,Q,X){if(X===void 0)X=Q;$[X]=Z[Q]}),XD6=GN&&GN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))QD6(Z,$,Q)};Object.defineProperty(GN,"__esModule",{value:!0});GN.connect=void 0;var YD6=Ki$();Object.defineProperty(GN,"connect",{enumerable:!0,get:function(){return YD6.connect}});XD6(ys(),GN)});function Bi$($){let Z=$?.connectFn??KD6,Q=null,X=null,Y=!1,G=!1,J=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!J}function F(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function H(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,F()})().catch(()=>{})}async function U(N,B){let O=0;while(!G)try{Q=await Z({servers:N,timeout:WD6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),X=null,J=!1,H(Q),F();return}catch{O++;let w=Q7(JD6,GD6,O-1,2,0.5);await L$(w)}}return{init(N,B){if(Y)return;Y=!0,G=!1;let O=B?.creds?Hi$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!X)X=Ni$.jetstream(Q);return X},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(G=!0,Y=!1,X=null,J=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function KD6($){return Ui$.connect($)}var Hi$,Ui$,Ni$,GD6=100,JD6=3000,WD6=3000;var Oi$=D(()=>{a8();Hi$=V(yl(),1),Ui$=V(Fi$(),1),Ni$=V(nF(),1)});function PQ1($,Z){return`${$}.${Z}`}class AQ1{cache;constructor($){this.cache=Au({ttlMs:$?.ttlMs??FD6,maxSize:$?.maxSize??HD6})}async get($,Z){return this.cache.get(PQ1($,Z))??null}async set($,Z,Q){this.cache.set(PQ1($,Z),Q)}async invalidate($,Z){this.cache.delete(PQ1($,Z))}teardown(){this.cache.clear()}}var FD6=600000,HD6=5000;var Di$=()=>{};function oT0($,Z){return`${$}:${Z}`}function TQ1($){let Z=Au({ttlMs:$?.ttlMs??UD6,maxSize:$?.maxSize??ND6}),Q=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,F){let H=Q?.();if(!H)return;try{H.publish(wi$,Y.encode(JSON.stringify({organizationId:K,keyId:F,originId:X})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,F){return Z.get(oT0(K,F))},set(K,F,H){Z.set(oT0(K,F),H)},invalidate(K,F){Z.delete(oT0(K,F)),W(K,F)},start(){if(J)return;let K=Q?.();if(!K)return;J=K.subscribe(wi$),(async()=>{for await(let F of J)try{let H=JSON.parse(G.decode(F.data));if(H.originId===X)continue;Z.delete(oT0(H.organizationId,H.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var wi$="studio.ai-provider-keys.invalidate",UD6=30000,ND6=5000;var Li$=()=>{};class RQ1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,X=Z.subscribe("studio.decopilot.cancel");this.subscription=X,(async()=>{for await(let Y of X)try{let G=JSON.parse(Q.decode(Y.data));if(G.originId===this.originId)continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Ei$=($)=>{let Z;return()=>Z??=$()},IQ1,qQ1;var ji$=D(()=>{Q6();IQ1=Ei$(()=>$$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),qQ1=Ei$(()=>$$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function jD6($=Ai$){return{name:XF,subjects:[`${Ca0}.>`],storage:qW.StorageType.File,max_age:DD6,max_bytes:LD6,max_msgs_per_subject:ED6,discard:qW.DiscardPolicy.Old,retention:qW.RetentionPolicy.Limits,duplicate_window:wD6,num_replicas:$}}class Ti${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function zi$($){let Z=Pi$.headers();for(let[Q,X]of Object.entries($))Z.set(Q,X);return Z}function TD6($,Z){let Q=0;return{publish(X,Y,G,J){X.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(Q++,OD6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function RD6($,Z){return $.info?.cluster?Z:1}function ID6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class MQ1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(X,Y)=>{let G=jD6(Y);try{await X.streams.info(XF),await X.streams.update(XF,G)}catch(J){if(J instanceof Error&&J.message.includes("stream not found"))await X.streams.add(G),await X.streams.update(XF,G);else if(J instanceof Error&&/can ?not change.*storage|storage type/i.test(J.message))await X.streams.delete(XF),await X.streams.add(G);else throw J}},Q=await Z6(async()=>{let X=this.options.getJetStreamManager?await this.options.getJetStreamManager():await qW.jetstreamManager($),Y=RD6($,Ai$);try{await Z(X,Y)}catch(G){if(Y<=1||!ID6(G))throw G;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${Y} (${G.message}); falling back to an unreplicated stream`),await Z(X,1)}return X},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:pg});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,X){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=TD6(Z,X),J=!1,W=()=>{if(J)return;J=!0;let F=bO$(Z);Y.publish(F.subject,F.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(F)=>{let H=performance.now(),U=va0(F,{runId:Z}),N=performance.now()-H;IQ1().record(N),qQ1().add(1,{"org.id":X??"unknown"}),AD6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)G.publish(Y,B.subject,B.data,B.headers?zi$(B.headers):void 0)};return(async()=>{let F=$.getReader(),H=0,U=0,N;try{while(!0){let{done:B,value:O}=await F.read();if(B)break;if(K(O),U++,++H>=64)H=0,await new Promise((w)=>setImmediate(w))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(F.releaseLock(),W(),PD6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:G.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await Z6(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:zi$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pg}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let X=this.js;if(!X)return!1;let Y=performance.now(),G=va0(Z,{runId:$,dedup:Q});IQ1().record(performance.now()-Y),qQ1().add(1);for(let J of G)if(!await this.publishSerialized(X,J))return!1;return!0}async publishDone($,Z,Q){let X=this.js;if(!X)return!1;let Y=fO$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(X,Y)}async createTailStream($,Z,Q){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=Q?.deliverPolicy==="new"?qW.DeliverPolicy.New:qW.DeliverPolicy.All,G=Q?.closeOnDone??!1,J=LD($),W;try{W=await Z6(async()=>{return(await X.consumers.get(XF,{filter_subjects:J,deliver_policy:Y})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pg})}catch(w){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",w?.message??w),null}let H=TL0({messages:async function*(){try{for await(let w of W)yield{subject:w.subject,data:w.data,headers:w.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(jL0()).pipeThrough(zL0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{H.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),H.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(w){for(;;){let{done:L,value:E}=await H.read();if(L){O(),w.close();return}let j=E;if(j.kind==="done"){if(G){O(),w.close();return}continue}w.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(XF,{filter:LD($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var qW,Pi$,BD6=($)=>{let Z;return()=>Z??=$()},OD6,DD6=86400000000000,wD6=120000000000,LD6=4294967296,Ai$,ED6=500000,zD6,PD6,AD6;var Ri$=D(()=>{a8();fa0();RL0();PL0();Q6();ji$();qW=V(nF(),1),Pi$=V(yl(),1),OD6=BD6(()=>$$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Ai$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);zD6=process.env.STREAM_ENCODE_TRACE==="1",PD6=process.env.DECOPILOT_STREAM_TRACE==="1";AD6=zD6?new Ti$:null});function rT0($,Z,Q,X){if(!X)return!1;return $.emit(Z,rW(Q,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,harnessId:X.harness_id??void 0,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var Ii$=D(()=>{I8()});class kQ1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function qi$($,Z,Q){let X=Z.organizationId;if(!YY(Z))return!1;if(!oC(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,X))return!1;let Y=await $.storage.organizationSettings.get(X),G=MK(Y?.flags),J=await $.storage.taskBoard.update(Z.id,X,{status:G},Z.updatedBy);return await I6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G,reason:"pr_merged"}}),G8(X,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${G}`),!0}var Mi$=D(()=>{D4();UQ();Vg();QW();x5()});function _D6($){return $ instanceof QX}function vD6($,Z){return Z-$>=SD6}class VQ1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,X={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??qD6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??kD6,Q=this.options.itemIntervalMs??MD6,X=new Date(Date.now()-Q),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,X),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of Y)try{if(await this.reconcileItem(J,W,X))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-Zo0),Or0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-CD6));for(let{id:Q,organizationId:X,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await Ur0(this.taskBoard,Y,X),await Nr0(this.taskBoard,this.billing,Y,X)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,G)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:X,organizationId:Y,attempts:G}of Q)try{if(!await this.taskBoard.claimDueRetry(X,Y,new Date))continue;let J=await this.taskBoard.getById(X,Y);if(!J||J.status!==j$.progress||J.assigneeId!==m$)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await XW(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${X} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${X} failed`,J),_D6(J)){await this.returnToTodo(X,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(X,Y,G,new Date(Date.now()+VD6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${X} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let X=await this.taskBoard.getById($,Z);if(!X||X.status!==j$.progress)return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,X.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),G8(Z,Y)}catch(X){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,X)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!vD6(nH(Q,Z.reviewCycleStartedAt),Date.now()))return;await tK($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(!YY(X))return!1;let Y=X.assigneeId===m$,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,X);return!1}let W=await Promise.all(G.map(async(K)=>({...K,...await _g(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await qi$(J,X,W))return!0;if(await qD$(J,X))return!0;if(await this.resolveConflictFromSweep(J,X,W))return!0;if(!Y)return!1;if(!Fr0(W))return!1;return await kw0(J,X,{previewMatchesHead:Hr0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let X=Q.find((Y)=>Y.state!=="closed"&&Y.conflict===!0);if(!X)return!1;return await JD($,Z.organizationId,Z,{pr:{number:X.number,url:X.url},conflict:!0}).catch((Y)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",Y),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var qD6=60000,MD6=300000,kD6=50,VD6=60000,SD6=900000,CD6=120000;var ki$=D(()=>{D4();ao0();oK();nt();QW();Mi$();x5();YJ();Dr0();EZ();At();Sg()});import{readdir as fD6,rm as aT0}from"fs/promises";import{join as sT0}from"path";async function eT0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-bD6),Z.setUTCHours(0,0,0,0);let Q=0;try{let X=await hv($);for(let Y of X)if(/^\d{4}$/.test(Y))Q+=await Vi$($,Y,Z);else if(!Y.startsWith(".")){let G=sT0($,Y),J=await hv(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;Q+=await Vi$(G,K,Z)}if((await hv(G)).length===0)await aT0(G,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return Q}async function Vi$($,Z,Q){let X=0,Y=sT0($,Z),G=await hv(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=sT0(Y,W),F=await hv(K);for(let U of F){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=sT0(K,U);await aT0(B,{recursive:!0,force:!0}),X++}}if((await hv(K)).length===0)await aT0(K,{recursive:!0,force:!0})}if((await hv(Y)).length===0)await aT0(Y,{recursive:!0,force:!0});return X}async function hv($){try{return(await fD6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var bD6=30;var SQ1=()=>{};import{DBOS as CQ1,SchedulerMode as xD6}from"@dbos-inc/dbos-sdk";async function gD6(){let $=[pJ(),uv(),uF()],Z=0;for(let Q of $)try{Z+=await eT0(Q)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function hD6($,Z){await CQ1.runStep(()=>gD6(),{name:"monitoringRetention"})}function Ci$(){if(Si$)return;Si$=!0;let $=CQ1.registerWorkflow(hD6,{name:"monitoringRetentionWorkflow"});CQ1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:yD6,mode:xD6.ExactlyOncePerIntervalWhenActive})}var yD6="23 4 * * *",Si$=!1;var _i$=D(()=>{qY();SQ1()});function vi$($){return async(Z,Q)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let Y=await EJ.create();Y.auth.user={id:Q,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let G=await Vt($.db,Z,X.role);return Y.boundAuth=T91({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:G,userId:Q}),Y.access=new WE(Q,void 0,Y.boundAuth,X.role,"self"),WD(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var fi$=D(()=>{iB();KD()});function uD6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function lD6(){return{services:uD6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function dD6(){for(let $ of cD6)$()}function bi$($){let Z=[..._Q1.logs,$];_Q1={..._Q1,logs:Z.length>500?Z.slice(-500):Z},dD6()}function vQ1(){return mD6}var _Q1,cD6,mD6=!1;var fQ1=D(()=>{_Q1=lD6(),cD6=new Set});import{EventEmitter as iD6}from"events";var bQ1;var xi$=D(()=>{fQ1();bQ1=new iD6;bQ1.on("request",($)=>{bi$($)})});function yi$(){return async($,Z)=>{let Q=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Bl(N.params.name),O=N.params.arguments||{},w=Object.keys(O).map((E)=>Bl(E)),L=w.length>0?w.slice(0,3).join(",")+(w.length>3?"\u2026":""):"";G=`${U5.tool}${B}${U5.dim}(${L})${U5.reset}`}else if(N.method)G=`${U5.dim}${Bl(N.method)}${U5.reset}`}}catch{}}let W=Bl(Y);if(Y.startsWith("/mcp/conn_")){let H=Y.split("/")[2]??"";W=`/mcp/${U5.mcp}${Bl(H.slice(0,12))}\u2026${U5.reset}`}else if(Y==="/mcp")W=`${U5.mcp}/mcp${U5.reset}`;else if(Y==="/mcp/registry")W=`${U5.mcp}/mcp/registry${U5.reset}`;let K=nD6(X),F=J?"\u25C0":"\u2190";if(!vQ1())console.log(`${U5.dim}${F}${U5.reset} ${K}${X}${U5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let H=Date.now()-Q,U=$.res.status,N=pD6(U),B=H<1000?`${H}ms`:`${(H/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!vQ1())console.log(`${U5.dim}${O}${U5.reset} ${K}${X}${U5.reset} ${W}${G?` ${G}`:""} ${N}${U}${U5.reset} ${U5.duration}${B}${U5.reset}`);bQ1.emit("request",{method:X,path:Bl(Y),status:U,duration:H,timestamp:new Date})}}}var U5,pD6=($)=>{if($>=500)return U5.serverError;if($>=400)return U5.clientError;if($>=300)return U5.redirect;return U5.ok},nD6=($)=>{return U5[$]||U5.reset},Bl=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var gi$=D(()=>{fQ1();xi$();U5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as ci$}from"crypto";import{mkdir as tD6,readdir as oD6,rm as hi$,stat as di$}from"fs/promises";import{join as yQ1,relative as rD6}from"path";import{z as R$}from"zod";function ii$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return yQ1(aD6,Z)}function pi$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function xQ1($,Z){let Q=ii$($),X=pi$(Z);return yQ1(Q,X)}function sD6($,Z,Q,X){let Y=V0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${X}`;return ci$("sha256",Y).update(G).digest("hex")}function li$($,Z,Q,X,Y){let G=Math.floor(Date.now()/1000)+X,J=sD6(Z,Q,G,Y),W=new URL(`/api/dev-assets/${Z}/${pi$(Q)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function ni$($,Z,Q){let X=`${$}:${Z.getTime()}:${Q}`;return`"${ci$("md5","etag").update(X).digest("hex")}"`}async function ti$($,Z,Q,X,Y){try{let G=await oD6($,{withFileTypes:!0});for(let J of G){let W=yQ1($,J.name),F=rD6(Z,W).replace(/\\/g,"/");if(Q&&!F.startsWith(Q))continue;if(J.isDirectory())if(X){let H=F+"/";if(!Q||H.startsWith(Q)){if(!(Q?F.slice(Q.length):F).includes("/"))Y.commonPrefixes.add(H)}}else await ti$(W,Z,Q,X,Y);else if(J.isFile()){if(X&&Q){let H=F.slice(Q.length);if(H.includes(X)){let U=H.indexOf(X),N=Q+H.slice(0,U+1);Y.commonPrefixes.add(N);continue}}try{let H=await di$(W);Y.objects.push({key:F,size:H.size,lastModified:H.mtime.toISOString(),etag:ni$(W,H.mtime,H.size)})}catch{}}}}catch{}}function oi$($,Z){let X=n($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:R$.object({prefix:R$.string().optional(),maxKeys:R$.number().optional().default(1000),continuationToken:R$.string().optional(),delimiter:R$.string().optional()}),outputSchema:R$.object({objects:R$.array(R$.object({key:R$.string(),size:R$.number(),lastModified:R$.string(),etag:R$.string()})),nextContinuationToken:R$.string().optional(),isTruncated:R$.boolean(),commonPrefixes:R$.array(R$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,F=G.continuationToken,H=ii$(X);await tD6(H,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await ti$(H,H,J,K,U),U.objects.sort((L,E)=>L.key.localeCompare(E.key));let N=0;if(F){if(N=U.objects.findIndex((L)=>L.key>F),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,w=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:w,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:R$.object({key:R$.string()}),outputSchema:R$.object({contentType:R$.string().optional(),contentLength:R$.number(),lastModified:R$.string(),etag:R$.string(),metadata:R$.record(R$.string(),R$.string()).optional()}),handler:async(Y)=>{let G=Y,J=xQ1(X,G.key),W=await di$(J);return{contentType:BZ1(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:ni$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:R$.object({key:R$.string(),expiresIn:R$.number().optional()}),outputSchema:R$.object({url:R$.string(),expiresIn:R$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??ui$;return{url:li$(Z,X,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:R$.object({key:R$.string(),expiresIn:R$.number().optional(),contentType:R$.string().optional()}),outputSchema:R$.object({url:R$.string(),expiresIn:R$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??ui$;return{url:li$(Z,X,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:R$.object({key:R$.string()}),outputSchema:R$.object({success:R$.boolean(),key:R$.string()}),handler:async(Y)=>{let G=Y,J=xQ1(X,G.key);try{return await hi$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:R$.object({keys:R$.array(R$.string()).max(1000)}),outputSchema:R$.object({deleted:R$.array(R$.string()),errors:R$.array(R$.object({key:R$.string(),message:R$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let F=xQ1(X,K);try{await hi$(F),J.push(K)}catch(H){W.push({key:K,message:H instanceof Error?H.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function gQ1($,Z,Q){let X=oi$(Z,Q),Y=new XK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:w5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:R$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:R$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(F)=>{try{let H=await J.handler(F);return{content:[{type:"text",text:JSON.stringify(H)}],structuredContent:H}}catch(H){return{content:[{type:"text",text:`Error: ${H.message}`}],isError:!0}}})}let G=new HX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),MJ(Y,G,$,"mcp:dev-assets")}async function ri$($,Z,Q,X){let G=oi$(Q,X).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var aD6="./data/assets",ui$=3600,mi$,ai$;var si$=D(()=>{D$();sg();d$();Jm();T_();mQ();nA0();mi$=new J1;mi$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),X=`${Q.protocol}//${Q.host}`;return gQ1($.req.raw,Z,X)});ai$=mi$});var ei$={};j4(ei$,{mountDevRoutes:()=>eD6});function eD6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("studioContext"),G=new URL(X.req.url),J=`${G.protocol}//${G.host}`;return gQ1(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("studioContext"),G=new URL(X.req.url),J=`${G.protocol}//${G.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),F=await ri$(W,K,Y,J);if(F.isError)return X.json(F.content,500);return X.json(F.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ai$);let Q=new J1;Q.use("*",RW({mountPath:"/api/dev-assets"})),Q.route("/",pA0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var $p$=D(()=>{d$();GZ1();nA0();si$()});import{sql as $w6}from"kysely";import{randomUUID as Zp$}from"crypto";import{z as Zw6}from"zod";async function Xw6($){let Z=new Date().toISOString(),Q=Zp$(),X=f8.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:Zp$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await $w6`SELECT
       pg_notify('studio_events', ${Q}),
       pg_notify('mesh_events', ${Q})
-    `.execute($.db)}catch{}}async function Yw6($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function Gw6($,Z){let Q=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",jv).execute();for(let X of Q){let Y=X.settings,G=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(G.acceptPublishRequests===!0){let J=G.rateLimitWindow==="minute"?"minute":"hour",W=G.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):Xp$;return{acceptPublishRequests:!0,requireApiToken:G.requireApiToken===!0,rateLimitEnabled:G.rateLimitEnabled===void 0?Qp$:G.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:Qp$,rateLimitWindow:Qw6,rateLimitMax:Xp$}}async function Jw6($,Z,Q){let X=Q==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),G=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(G?.count??0)}async function Ww6($,Z,Q,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((G)=>G.or([G("id","=",Q),G("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function Yp$($){let{db:Z,db:Q}=$,X=new ex(Q),Y=new $y(Q);return async(G)=>{let J=G.req.param("orgRef")??G.req.param("org");if(!J)return G.json({error:"Organization not found"},404);let W=await Yw6(Z,J);if(!W)return G.json({error:"Organization not found"},404);let K=await Gw6(Z,W);if(!K.acceptPublishRequests)return G.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let B=G.req.header("Authorization"),O=B?.startsWith("Bearer ")?B.slice(7).trim():null;if(!O)return G.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,O))return G.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await Jw6(Q,W,K.rateLimitWindow)>=K.rateLimitMax)return G.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let F;try{F=await G.req.json()}catch{return G.json({error:"Invalid JSON body"},400)}let H=Mv$.safeParse(F);if(!H.success)return G.json({error:"Invalid publish request payload",details:Zw6.treeifyError(H.error)},400);let U=await Ww6(Q,W,H.data.data.id,H.data.data.title);if(U)return G.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:U},409);let N=await X.createOrUpdate({organization_id:W,requested_id:H.data.data.id,title:H.data.data.title,description:H.data.data.description??null,_meta:H.data.data._meta,server:H.data.data.server,requester_name:H.data.requester?.name??null,requester_email:H.data.requester?.email??null});try{await Xw6({db:Z,organizationId:W,request:N})}catch(B){console.warn("[private-registry] failed to emit publish-request event:",B)}return _1.capture({distinctId:H.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:N.id,requested_id:N.requested_id,title:H.data.data.title,requester_email:H.data.requester?.email??null}}),G.json({id:N.id,requested_id:N.requested_id,status:N.status},201)}}var Qp$=!0,Qw6="hour",Xp$=100;var Gp$=D(()=>{v4();I8();Ru();_u0();vu0();j9()});var Jp$={};j4(Jp$,{createPublishRequestHandler:()=>Yp$,createPublicMCPHandler:()=>vv$});var Wp$=D(()=>{Tu();Gp$()});var Lp$={};j4(Lp$,{watchHandler:()=>wp$,resolveCorsOrigin:()=>Op$,isSsoExemptPath:()=>Np$,isAllowedOAuthRedirectUri:()=>Dp$,createApp:()=>jw6});import{readFileSync as Kw6}from"fs";import{PrometheusSerializer as Fw6}from"@opentelemetry/exporter-prometheus";import{DBOS as Kw}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Ow6,oAuthProtectedResourceMetadata as Dw6}from"better-auth/plugins";async function Hw6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,Fp$(Kp$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),Fp$(Kp$)]),Q.release(),!0}catch{return Q.release(!0),!1}}function Fp$($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}async function Uw6($,Z){let{items:Q}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${Vy$}%`},limit:1}),X=Q[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function Nw6($){let Z=new URLSearchParams;if($){let[Q,X]=$.split("/");if(Q)Z.set("workspace_hint",Q);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}function Np$($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${t91}/`)}function Bp$($){return $==="local.studio.decocms.com"}function Op$($,{baseUrl:Z,requestOrigin:Q}){let X;try{X=new URL($).hostname}catch{return null}if(X==="localhost"||X==="127.0.0.1")return $;if(Bp$(X))return $;let Y=Z??Q;try{if(new URL(Y).origin===$)return $}catch{}return null}function Dp$($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||Bp$($.hostname)}async function jw6($={}){let Z=$.database??B8(),Q=!1;b5.stop().catch((L0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",L0)});let X,Y,G,J,W=new AQ1,K,F,H,U=null;if($.disableNats)K=TQ1(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=null,G=null,J=new $o,F={start:async()=>{},broadcast:()=>{},stop:async()=>{}},H={init:async()=>{},pump:(L0)=>{return(async()=>{let Y0=L0.getReader();try{while(!0){let{done:a0}=await Y0.read();if(a0)break}}catch{}finally{Y0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=Bi$();let L0=V0().natsCredsPath,Y0;if(L0)try{Y0=Kw6(L0,"utf8")}catch(i){console.error(`[app] failed to read NATS_CREDS at ${L0}; connecting anonymously`,i)}U.init(V0().natsUrls,Y0?{creds:Y0}:void 0);let a0=ac0()?new bc0({getJetStream:()=>U.getJetStream()}):null;a0?.init().catch(()=>{}),X=a0;let P1=new Rt0({getJetStream:()=>U.getJetStream()});P1.init().catch(()=>{}),Y=P1;let x$=new vg(Xr0,{getJetStream:()=>U.getJetStream()}),p4=new vg(Yr0,{getJetStream:()=>U.getJetStream()});x$.init().catch(()=>{}),p4.init().catch(()=>{}),G={reads:x$,cards:p4};let X5=new ts0({getJetStream:()=>U.getJetStream()});X5.init().catch(()=>{}),J=X5,K=TQ1({getConnection:()=>U.getConnection()}),F=new RQ1({getConnection:()=>U.getConnection()}),H=new MQ1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),hy$(U),U.onReady(()=>{a0?.init().catch((i)=>{console.error("[McpListCache] Deferred init failed:",i)}),P1.init().catch((i)=>{console.error("[SkillCatalogCache] Deferred init failed:",i)}),x$.init().catch((i)=>{console.error("[PrReadCache] Deferred init failed:",i)}),p4.init().catch((i)=>{console.error("[PrCardCache] Deferred init failed:",i)}),X5.init().catch((i)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",i)}),K.start(),be1(()=>U.getConnection()),H.init().catch((i)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",i)})})}if(Fw)await Fw();xc0(X),qt0(Y),Gr0(G),os0(J);let B={storage:new Mg(Z.db),sseHub:b5,onThreadFinished:async(L0,Y0)=>fg(new KG(Z.db),L0,Y0,new BK(Z.db))},O=new ua0(B),w=new da(Z.db),L=new kQ1(w);L.start(),TD$(F),F.start((L0)=>{KL0(L0),O.execute({type:"CANCEL",taskId:L0}).catch((Y0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",Y0)})}).catch((L0)=>{console.error("[Decopilot] CancelBroadcast start failed:",L0)}),U?.onReady(()=>{F.start().catch((L0)=>{console.error("[CancelBroadcast] Deferred start failed:",L0)})});let E=()=>U?.getConnection()??null;ZZ1(E),U?.onReady(()=>ZZ1(E)),H.init().catch((L0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",L0)}),Fw=async()=>{await O.stopAll(),O.dispose(),L.dispose(),F.stop().catch(()=>{}),lg$(),H.teardown(),X?.teardown(),Y?.teardown(),G?.reads.teardown(),G?.cards.teardown(),W.teardown(),K.teardown(),xe1(),J.teardown(),xc0(null),qt0(null),Gr0(null),os0(null)};let j=new J1;if(j.use("*",is0({enabled:(L0)=>xu(L0,"debug")==="1"})),j.use("*",z20),j.use("/*",fy$({origin:(L0,Y0)=>Op$(L0,{baseUrl:V0().baseUrl,requestOrigin:new URL(Y0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),j.use("*",async(L0,Y0)=>{if(await Y0(),L0.req.path.includes("/files/"))return;if(L0.req.path.includes("/fs/")&&L0.req.path.endsWith("/read"))return;L0.header("X-Frame-Options","DENY"),L0.header("Content-Security-Policy","frame-ancestors 'none'")}),!V0().noTui)j.use("*",yi$());j.use("*",async(L0,Y0)=>{if(await Y0(),El(L0.req.path))return;if(L0.res.status>=500){let P1=await L0.res.clone().text();console.error(`[5xx Response] ${L0.req.method} ${L0.req.path} - ${L0.res.status}:`,P1)}}),j.get(kQ.HEALTH,(L0)=>{if(Q)return L0.json({status:"shutting_down"},503);return L0.json({status:"ok"})}),j.get(kQ.HEALTH_LIVE,(L0)=>{return L0.json({status:"ok"})}),j.get(kQ.HEALTH_READY,async(L0)=>{if(Q)return L0.json({status:"shutting_down"},503);let Y0={};if(Y0.postgres={status:await Hw6(Z.pool)?"up":"down"},U)Y0.nats=U.isConnected()?{status:"up"}:{status:"down"};else Y0.nats={status:"down"};let a0=Y0.postgres.status==="up",P1=a0?200:503;return L0.json({status:a0?"ready":"not_ready",services:Y0},P1)}),j.get(kQ.METRICS,async(L0)=>{try{let Y0=await R20.collect(),a0=Bw6.serialize(Y0.resourceMetrics);return L0.text(a0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(Y0){return console.error("Failed to collect metrics:",Y0),L0.text("# Error collecting metrics",500)}}),j.get(`${kQ.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(L0)=>{let Y0=L0.req.param("queueName");if(!ww6.has(Y0))return L0.json({error:`Unknown queue: ${Y0}`},404);let a0=await Kw.listQueuedWorkflows({queueName:Y0,status:"ENQUEUED"});return L0.json({queue_length:a0.length})}),j.route("/api/config",Dm$),j.route("/api/_reports",qm$),j.route("/api/_stripe",DQ1),j.route("/api/_github",wQ1);let z={db:Z.db,encryptionKey:V0().encryptionKey};j.route("/api/_jira",um$(z)),j.route("/api/_jira",xm$(z)),j.route("/report",Tm$($.clientDir)),j.route("/api/auth/custom",Jg$),j.route("/api/auth/desktop",Hg$),j.all("/api/auth/admin/*",Mg$),j.all("/api/auth/*",async(L0)=>{return await $8.handler(L0.req.raw)});let P=Ax$();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",Rv),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",Rv),j.route("/",P),j.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",ha),j.route("/",Mx$()),j.use("/oauth-proxy/:connectionId/*",Rv),j.all("/oauth-proxy/:connectionId/*",Hp$);let A=async(L0)=>{let a0=await Lw6()(L0.req.raw),P1=await a0.json();return Response.json(P1,a0)};j.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",Rv),j.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let I=async(L0)=>{let a0=await Ew6()(L0.req.raw),P1=await a0.json();return Response.json(P1,a0)};j.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",I);let k=xy$({ttlMs:120000}),M=await Oy$({db:Z.db,auth:$8,encryption:{key:V0().encryptionKey},observability:{tracer:WN,meter:$$},modelListCache:W,providerKeyCache:K,memberRoleCache:k});EJ.set(M);let S=new hQ(V0().encryptionKey);S_1({db:Z.db,baseUrl:G9()}),Dy$({db:Z.db}),jy$({db:Z.db}),dm$({db:Z.db,encryptionKey:V0().encryptionKey}),yF$({db:Z.db}),Iy$({db:Z.db}),HH$({db:Z.db});let m=q50(Z.db),f=new Vi(Z.db),b=vi$({db:Z.db});ls0({storage:m,studioContextFactory:b}),ra0({studioContextFactory:b,deps:{runRegistry:O,cancelBroadcast:F,streamBuffer:H,sseHub:b5}}),da0({dispatchRunFn:MO$,studioContextFactory:b,deps:{runRegistry:O,cancelBroadcast:F,streamBuffer:H,sseHub:b5}});let p=new Mg(Z.db),l=new KG(Z.db),o=new BK(Z.db),N0=new VQ1(l,b,o);if(V0().taskBoardReviewSweeperEnabled){N0.start();let L0=Fw;Fw=async()=>{await L0?.(),N0.dispose()}}tO$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let L0=U?.getConnection();return L0?await Up$.jetstreamManager(L0):null},messageParts:p.messageParts(),resolveRun:async(L0)=>{let Y0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",L0).executeTakeFirst();return Y0?{orgId:Y0.organization_id,createdBy:Y0.created_by,version:Y0.message_storage_version??1,status:Y0.status,runFenceToken:Y0.run_fence_token,title:Y0.title??null}:null},completeRunIfNotCompleted:async(L0,Y0)=>{let a0=await p.completeRunIfNotCompleted(L0,Y0);if(rT0(b5,Y0,L0,a0),a0)await fg(l,L0,Y0,o);return a0},markRunRequiresAction:async(L0,Y0)=>{let a0=await p.requiresActionIfInProgress(L0,Y0);return rT0(b5,Y0,L0,a0),a0},markRunFailed:async(L0,Y0,a0,P1)=>{let x$=await p.markRunFailed(L0,Y0,a0,P1);if(rT0(b5,Y0,L0,x$),x$)await fg(l,L0,Y0,o);return x$},clearSynthesizedError:async(L0,Y0)=>{await p.messageParts().replaceMessageParts(L0,wD(L0,Y0),[])},persistTitle:(L0,Y0,a0)=>p.update(L0,Y0,{title:a0}),onTitleUpdated:async({runId:L0,orgId:Y0,title:a0})=>{let P1=await p.get(L0,Y0).catch(()=>null);b5.emit(Y0,rW(L0,P1?.status??"in_progress",{title:a0,virtualMcpId:P1?.virtual_mcp_id??void 0,createdBy:P1?.created_by,triggerId:P1?.trigger_id,branch:P1?.branch??null,harnessId:P1?.harness_id??void 0,createdAt:P1?.created_at,updatedAt:P1?.updated_at}))},bumpProgress:async({runId:L0,orgId:Y0})=>{await p.bumpProgress(L0,Y0)},recordCompleted:async({runId:L0,orgId:Y0,distinctId:a0,usage:P1})=>{_1.capture({distinctId:a0,event:"chat_message_completed",groups:{organization:Y0},properties:{organization_id:Y0,thread_id:L0,transport:"projector",input_tokens:P1.inputTokens,output_tokens:P1.outputTokens,total_tokens:P1.totalTokens}})},recordFailed:async({runId:L0,orgId:Y0,distinctId:a0,reason:P1,kind:x$})=>{_1.capture({distinctId:a0,event:"chat_message_failed",groups:{organization:Y0},properties:{organization_id:Y0,thread_id:L0,transport:"projector",error_category:x$,error_message:P1}})},purgeRun:async(L0)=>{H.purge(L0)}}),eB$({studioContextFactory:b,systemDatabaseUrl:St1(V0().databaseUrl,V0().databasePgSsl),streamBuffer:H}),Ci$(),C_1(),Ly$(),Py$(),pm$(),cF$(),My$(),UH$();let j0=async(L0,Y0,a0)=>{let P1=await m.findById(L0,Y0);if(!P1)throw Error("Automation not found");return ms0({automationId:P1.id,organizationId:P1.organization_id,triggerId:null})},a=new hu(m,({automation:L0,trigger:Y0,contextMessages:a0,idempotencyKey:P1})=>et({automationId:L0.id,organizationId:L0.organization_id,triggerId:Y0.id,contextMessages:a0},{idempotencyKey:P1})),r=[pJ(),uv(),uF()];for(let L0 of r)eT0(L0).then(()=>{}).catch((Y0)=>console.error("[monitoring] Retention cleanup failed:",Y0));let T0=()=>$8.api.deleteAllExpiredApiKeys().catch((L0)=>console.error("[auth] Expired API key cleanup failed:",L0));T0(),setInterval(T0,86400000).unref(),j.use("*",async(L0,Y0)=>{if(E20(L0.req.path))return Y0();let a0={measure:async(x$,p4)=>{qJ(L0,x$);try{return await p4()}finally{BG(L0,x$)}}},P1=await EJ.create(L0.req.raw,{timings:a0});P1.automationRunner=j0,L0.set("studioContext",P1);try{await Y0()}finally{let x$=P1.pendingRevalidations;if(x$.length>0)Promise.race([Promise.allSettled(x$),L$(30000)]).catch((X5)=>console.error("[studio] revalidation cleanup error:",X5))}}),j.use("/api/:org/decopilot/*",Av),j.use("/api/:org/v1/*",Av),j.use("/api/:org/files/*",Av),j.use("*",async(L0,Y0)=>{if(Np$(L0.req.path))return Y0();let a0=L0.get("studioContext");if(!a0?.organization?.id||!a0?.auth?.user?.id)return Y0();if(!(await a0.storage.orgSsoConfig.getByOrgId(a0.organization.id))?.enforced)return Y0();if(!await a0.storage.orgSsoSessions.isValid(a0.auth.user.id,a0.organization.id))return L0.json({error:"SSO authentication required for this organization"},403);return Y0()});let Z0=new J1;Z0.use("*",RW({mountPath:"/api/org-sso"})),Z0.route("/",fA0()),j.route("/api/org-sso",Z0),j.get("/api/tools/management",(L0)=>{return L0.json({tools:xu0,grouped:JE()})}),j.use("/mcp/*",async(L0,Y0)=>{qJ(L0,"mcp");try{return await Y0()}finally{BG(L0,"mcp")}});let z0=async(L0,Y0)=>{let a0=L0.var.studioContext;if(!a0.auth.user?.id&&!a0.auth.apiKey?.id){let P1=new URL(L0.req.url),x$=L0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),p4=x$?`${x$}://${P1.host}`:P1.origin;return L0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${p4}${P1.pathname}/.well-known/oauth-protected-resource"`}})}return await Y0()};if(j.use("/mcp/:connectionId?",z0),j.use("/mcp/gateway/:virtualMcpId?",z0),j.use("/mcp/virtual-mcp/:virtualMcpId?",z0),j.use("/mcp/self",z0),gX()){let{mountDevRoutes:L0}=($p$(),G20(ei$));L0(j,z0)}let y0=new J1;y0.use("*",RW({mountPath:"/mcp"})),y0.route("/",dL0()),j.route("/mcp",y0);let I0=new J1;I0.use("*",RW({mountPath:"/mcp/self"})),I0.route("/",AT0()),j.route("/mcp/self",I0);let u0=new J1;u0.use("*",RW({mountPath:"/mcp"})),u0.route("/",pL0()),j.route("/mcp",u0),j.use("/api/:org/models/*",async(L0,Y0)=>{qJ(L0,"llm_models");try{return await Y0()}finally{BG(L0,"llm_models")}});let X0=dg$({cancelBroadcast:F,streamBuffer:H,runRegistry:O});j.route("/api",X0),j.use("/api/:org/files/*",Av),j.route("/api",rm$);let O0=new J1;O0.use("*",RW({mountPath:"/api"})),O0.route("/",TT0()),j.route("/api",O0),j.route("/api",Km$);let w0=new J1;w0.use("*",RW({mountPath:"/api"})),w0.route("/",RT0({tokenStorage:f,automationEventDispatcher:a})),j.route("/api",w0);let M0=new Ci(Z.db),e=new J1;e.use("*",RW({mountPath:"/api"})),e.route("/",uA0()),j.route("/api",e),j.route("/api/deco-sites",Xh$()),j.route("/api/deco-apps",Qm$());let Q0=new J1;Q0.use("*",RW({mountPath:"/api/deco-sites"})),Q0.route("/",cA0()),j.route("/api/deco-sites",Q0);let{createPublishRequestHandler:k0,createPublicMCPHandler:K0}=await Promise.resolve().then(() => (Wp$(),Jp$)),U0={db:Z.db,vault:{encrypt:(L0)=>S.encrypt(L0),decrypt:(L0)=>S.decrypt(L0)}},L1=k0(U0),C0=K0(U0);j.use("/org/:orgRef/registry/publish-request",Rv),j.post("/org/:orgRef/registry/publish-request",L1),j.use("/org/:orgSlug/registry/*",Rv),j.all("/org/:orgSlug/registry/*",C0),j.post("/api/:org/registry/publish-request",L1),j.all("/api/:org/registry/*",C0),j.route(t91,kg$()),j.route("/api/_editor-resolve",Hm$()),j.route(Ng$,Bg$());let i0=$m$({kvStorage:M0,runRegistry:O,streamBuffer:H,sseHub:b5,cancelBroadcast:F,tokenStorage:f,automationEventDispatcher:a,mountDevAssets:gX(),mcpAuth:z0,oauthProxyHandler:Hp$,watchHandler:wp$,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return j.route("/api/:org",i0),j.notFound((L0)=>{return L0.json({error:"Not Found",path:L0.req.path},404)}),j.onError(pg$),Object.assign(j,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([b5.stop(),Fw?Promise.resolve(Fw()).finally(()=>{Fw=null}):Promise.resolve()]),U)await U.drain().catch((L0)=>console.error("[shutdown] NATS drain error:",L0));console.log("[shutdown] Flushing telemetry..."),await DX().catch((L0)=>console.error("[shutdown] Telemetry flush error:",L0)),console.log("[shutdown] Closing database..."),await _t1(Z).catch((L0)=>console.error("[shutdown] Database close error:",L0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Kw.registerQueue(MG,{partitionQueue:!0,concurrency:gs0,minPollingIntervalMs:hs0}),await Kw.registerQueue(iJ,{partitionQueue:!0,concurrency:ta0,priorityEnabled:!0}),await Kw.registerQueue(gF,{workerConcurrency:V0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await Kw.registerQueue(hF,{workerConcurrency:V0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await Kw.registerQueue(JN,{partitionQueue:!0,concurrency:sB$}),await Kw.registerQueue(Hw,FH$),await JZ1(m),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((L0)=>Kw.deleteQueue(L0))),await us0(Z.pool),va1().catch((L0)=>{console.error("[studio-pack-backfill] failed:",L0)}),__1().catch((L0)=>{console.error("[org-fs] public-sets boot sync kick failed:",L0)})}})}var Up$,Kp$=5000,Fw=null,Hp$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),X=Q[Q.length-1],Y=$.get("studioContext");if(!Y)Y=await EJ.create($.req.raw),$.set("studioContext",Y);let G=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,G);if(!J?.connection_url)return $.json({error:"Connection not found"},404);if(X==="register"&&J.oauth_config?.clientId)return $.json({client_id:J.oauth_config.clientId,...J.oauth_config.clientSecret?{client_secret:J.oauth_config.clientSecret}:{},client_secret_expires_at:0});let W=await vu(J.connection_url),K,F=new URL(J.connection_url),U=(typeof J.metadata?.oauthResource==="string"&&J.metadata.oauthResource.length>0?J.metadata.oauthResource:void 0)??J.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=F.origin;let N=await ua(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(X==="authorize")O=B.authorization_endpoint;else if(X==="token")O=B.token_endpoint;else if(X==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let w=qx$(O);if(w)return w;let L=new URL(O),E=new URL($.req.url);if(L.search=E.search,X==="authorize"){let f=L.searchParams.get("redirect_uri");if(f){let b=V0().baseUrl??E.origin;try{if(!Dp$(new URL(f),b))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}L.searchParams.set("redirect_uri",f)}if(L.searchParams.has("resource"))L.searchParams.set("resource",U);if(Sy$(J.connection_url))try{let b=await Uw6(Y,J.organization_id),p=Nw6(b);for(let[l,o]of p)L.searchParams.set(l,o)}catch(b){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",b)}return $.redirect(L.toString(),302)}let j={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)j["Content-Type"]=z;let P=$.req.header("Authorization");if(P)j.Authorization=P;let A,I=null,k=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&z?.includes("application/x-www-form-urlencoded")){if(P?.toLowerCase().startsWith("basic "))try{let o=atob(P.slice(6).trim()),N0=o.indexOf(":");if(N0!==-1){let j0=decodeURIComponent(o.slice(0,N0)),a=decodeURIComponent(o.slice(N0+1));I=j0||null,k=a||null}}catch{}let f=await $.req.formData();if(f.has("resource"))f.set("resource",U);let b=f.get("client_id"),p=f.get("client_secret");if(typeof b==="string"&&b)I=b;if(typeof p==="string"&&p)k=p;let l=new URLSearchParams;for(let[o,N0]of f.entries())l.append(o,N0.toString());A=l.toString()}else if(X==="register"&&z?.toLowerCase().includes("application/json")){let f=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),b=await $.req.text(),p={};try{p=b?JSON.parse(b):{}}catch{A=b}let l=typeof p==="object"&&p!==null&&!Array.isArray(p);if(A===void 0&&!l)A=b;if(A===void 0){let o=p,N0=o.metadata&&typeof o.metadata==="object"?o.metadata:{};o.metadata={...N0,organization_id:J.organization_id,...f?.slug?{organization_slug:f.slug}:{},...f?.name?{organization_name:f.name}:{}},A=JSON.stringify(o),j["Content-Type"]="application/json"}}else A=$.req.raw.body??void 0;let M=await fetch(L.toString(),{method:$.req.method,headers:j,body:A,duplex:"half",redirect:"manual"}),S=new Headers,m=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[f,b]of M.headers.entries())if(!m.includes(f.toLowerCase()))S.set(f,b);if(X==="token"&&M.ok){let f=await M.text();try{let b=JSON.parse(f);if(typeof b.access_token==="string"&&b.access_token){let p=typeof b.expires_in==="number"?new Date(Date.now()+b.expires_in*1000):null,l=null;try{l=await fu(J.connection_url)??O}catch{l=O}let o={connectionId:Z,accessToken:b.access_token,refreshToken:typeof b.refresh_token==="string"?b.refresh_token:null,scope:typeof b.scope==="string"?b.scope:null,expiresAt:p,clientId:I,clientSecret:k,tokenEndpoint:l};await new t6(Y.db,Y.vault).upsert(o)}}catch(b){console.error("[oauth-proxy] failed to persist downstream token:",b)}return new Response(f,{status:M.status,statusText:M.statusText,headers:S})}return new Response(M.body,{status:M.status,statusText:M.statusText,headers:S})},wp$=async($)=>{let Z=$.var.studioContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),G=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return QN($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:G,connectedAt:new Date().toISOString()})}),!b5.add({id:J,organizationId:X,typePatterns:G?.length?G:null,push:(H)=>{W.writeSSE({id:H.id,event:H.type,data:JSON.stringify(H)}).catch(()=>{b5.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let F=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(F)})},30000);await new Promise((H)=>{W.onAbort(()=>{clearInterval(F),b5.remove(X,J),H()})})})},Bw6,ww6,Lw6=()=>Dw6($8),Ew6=()=>Ow6($8);var Ep$=D(()=>{a8();D$();v_1();Ey$();Ay$();go0();ky$();At();u5();SE();I8();d$();qA0();by$();ps0();oY();KD();v91();aG();Q6();v4();u91();Ug$();Og$();Vg$();s91();mg$();YZ1();ZJ();OA0();GZ1();ng$();kA0();Zm$();FZ1();Xm$();mL0();Zo();Fm$();nL0();b71();Um$();wm$();Rm$();Mm$();fm$();bm$();ym$();lm$();nm$();am$();f71();_71();os();tN();Oi$();yX();CD0();Kr0();Cp();vp();as0();Di$();Li$();QZ1();Ri$();la0();Ii$();Lw0();u50();jU();x5();U91();ki$();_i$();o90();SQ1();qY();WZ1();EU();ga0();o90();EL0();Au0();Tu0();fi$();Zy();gi$();Yl();v91();dg();FL0();Up$=V(nF(),1);Bw6=new Fw6,ww6=new Set([MG,iJ,gF,hF,JN,Hw])});var Ap$={};j4(Ap$,{resolveClientDir:()=>qw6,resolveAssetPathWithTraversalCheck:()=>Pp$,isPathWithinDirectory:()=>zp$,createAssetHandler:()=>Mw6});import{resolve as gs,dirname as zw6,join as Pw6,extname as Aw6,basename as Tw6,sep as jp$}from"path";function Rw6($,Z){if($===Z||Tw6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${jp$}assets${jp$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function zp$($,Z){let Q=gs(Z),X=gs($);return X===Q||X.startsWith(Q+"/")}function Pp$({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,X=gs(Z,Q);if(!zp$(X,Z))return null;return X}function qw6($,Z="../client"){let Q=new URL($),X=zw6(Q.pathname);return gs(X,Z)}function Mw6($={}){let{env:Z="production",clientDir:Q=Iw6,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(G){return null};return async function(G){if(G.method!=="GET")return null;let J=new URL(G.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=Pp$({requestPath:W,clientDir:Q});if(!K)return null;let F=Pw6(K,"index.html"),H=gs(Q,"index.html"),U=G.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Aw6(K))?[F,H]:[];for(let O of[K,...B])try{let w=Bun.file(O);if(await w.exists())return new Response(w,{headers:Rw6(O,H)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var Iw6="./dist/client";var Tp$=()=>{};var Rp$={};j4(Rp$,{tryUpgradePreviewWs:()=>fw6,tryHandlePreviewHttp:()=>vw6,previewWebSocketHandler:()=>bw6,parsePreviewBaseDomain:()=>_w6,isPreviewWsData:()=>$20,extractHandleFromHost:()=>hQ1});function Sw6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function Cw6(){return new Response(Vw6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function _w6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let X=Q.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function hQ1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),X=(Q>=0?$.slice(0,Q):$).toLowerCase(),G=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(G))return null;let J=X.slice(0,X.length-G.length);if(!J||J.includes("."))return null;return J}async function vw6($,Z){let Q=hQ1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let X=await Z.getRunner();if(!X)return us(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(Q,$);if(Y.headers.get(CC)&&Sw6($))return Cw6();return Y.headers.delete(CC),Y}function us($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function $20($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function fw6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=hQ1($.headers.get("host"),Q.baseDomain);if(!X)return null;let Y=await Q.getRunner();if(!Y)return us(503,"preview proxy not configured");let G=await Y.resolvePreviewUpstreamUrl(X);if(!G)return us(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox"))return us(404,"not found");let W=`${G.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),F=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],H={kind:"preview",upstreamUrl:W,upstreamProtocols:F,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:H}))return us(426,"upgrade failed");return}function hs($,Z,Q,X){if(Z.closed)return;Z.closed=!0;try{$.close(Q,X)}catch{}try{Z.upstream?.close()}catch{}}var kw6=256,Vw6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',bw6;var Ip$=D(()=>{Gt0();bw6={open($){let Z=$.data;if(!$20(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),hs($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)Q.send(X)}}),Q.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),Q.addEventListener("close",(X)=>{hs($,Z,X.code||1000,X.reason||"")}),Q.addEventListener("error",()=>{hs($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!$20(Q))return;let X=Q.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(Q.pending.length>=kw6){hs($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!$20(Z))return;hs($,Z,1000,"")}}});var Vp$={};j4(Vp$,{printBanner:()=>yw6,bannerLines:()=>kp$,BANNER_LINES:()=>qp$,BANNER_GRADIENT:()=>Mp$});function xw6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function kp$($){let Z=qp$.map((Q,X)=>{let[Y,G,J]=xw6(Mp$[X]);return`\x1B[38;2;${Y};${G};${J}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function yw6($){console.log("");for(let Z of kp$($))console.log(Z);console.log("")}var qp$,Mp$;var Sp$=D(()=>{qp$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],Mp$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a8();var aQ1="11";function sQ1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:aQ1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a8();import np$ from"pg";var eQ1=8314027461559302n,tp$=600000,op$=500;async function $X1($,Z){let{databaseUrl:Q,lockTimeoutMs:X=tp$}=$,Y=$.log??((K)=>console.log(K)),G=new np$.Client({connectionString:Q});await G.connect();let J=Date.now(),W=!1;try{while(!W){if(W=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[eQ1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-J>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await L$(op$)}let K=Date.now()-J;if(K>1000)Y(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await G.query("SELECT pg_advisory_unlock($1)",[eQ1.toString()])}catch{}await G.end().catch(()=>{})}}D$();F20();Q6();function pn$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function M20($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function xX1(){let $=pn$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:M20($,"--cpu-prof-dir")??process.cwd(),name:M20($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(M20($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}S20();var ss;function iX1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Bw();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),ss=setInterval(()=>void Z().catch(()=>{}),$),ss.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(ss)clearInterval(ss)}}import*as on$ from"bun:jsc";var{startSamplingProfiler:rn$,samplingProfilerStackTraces:an$}=on$;function pX1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{rn$()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-X;X=G+Z;let W=[];try{W=an$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let H of W){let U=H.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??H.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let F=[...K.entries()].sort((H,U)=>U[1]-H[1]).slice(0,8).map(([H,U])=>({frame:H,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:F}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function nX1(){xX1();let $=[iX1(),mX1(),pX1()];return()=>{for(let Z of $)Z()}}import{existsSync as iw6}from"fs";var IY=V0();vX1();var{DBOS:ls,DBOSClient:gw6}=await import("@dbos-inc/dbos-sdk");function iQ1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var hw6=[MG,iJ,gF,hF,JN,Hw],uw6=IY.dispatchRole==="worker"?hw6:IY.dispatchRole==="api"?[]:void 0;ls.setConfig(sQ1({systemDatabaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl),poolSize:IY.dbosPoolSize,executorID:IY.podName,listenQueues:uw6}));var{createApp:lw6}=await Promise.resolve().then(() => (Ep$(),Lp$)),{isServerPath:cw6}=await Promise.resolve().then(() => (os(),wX1)),{createAssetHandler:dw6,resolveClientDir:bp$}=await Promise.resolve().then(() => (Tp$(),Ap$)),mw6=IY.port,Cp$=bp$(import.meta.url,"../client"),xp$=iw6(Cp$)?Cp$:bp$(import.meta.url,"../dist/client"),pw6=dw6({clientDir:xp$,isServerPath:cw6}),nw6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function tw6($){let Z=new Headers($.headers);for(let[Q,X]of Object.entries(nw6))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:ow6,tryHandlePreviewHttp:rw6,tryUpgradePreviewWs:aw6,previewWebSocketHandler:uQ1,isPreviewWsData:lQ1}=await Promise.resolve().then(() => (Ip$(),Rp$)),{getOrInitSharedRunner:yp$}=await Promise.resolve().then(() => (s3(),W3$)),gp$=ow6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),_p$={baseDomain:gp$??"",getRunner:yp$};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())yp$().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var Z20=await lw6({clientDir:xp$}),cQ1=process.env.DBOS_CONDUCTOR_KEY?.trim(),vp$=process.env.DBOS_CONDUCTOR_URL?.trim();await $X1({databaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl)},()=>ls.launch({...cQ1?{conductorKey:cQ1}:{},...cQ1&&vp$?{conductorURL:vp$}:{}}));console.log(`[dbos] application version: ${ls.applicationVersion}`);var dQ1=5,mQ1=0;await Z6(async()=>{mQ1++;try{return await Z20.initDbos()}catch($){let Z=mQ1>=dQ1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${mQ1}/${dQ1} failed, ${Z}`,$),$}},{maxAttempts:dQ1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!IY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (Sp$(),Vp$));console.log("");for(let Z of $())console.log(Z)}var sw6=Bun.serve({idleTimeout:0,port:mw6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(gp$){let X=await aw6($,Z,_p$);if(X===void 0)return;if(X)return X;let Y=await rw6($,_p$);if(Y)return Y}let Q=await pw6($);if(Q)return tw6(Q);return Z20.fetch($,{server:Z})},websocket:{open($){if(lQ1($.data))uQ1.open($)},message($,Z){if(lQ1($.data))uQ1.message($,Z)},close($){if(lQ1($.data))uQ1.close($)}},development:!1}),ew6=nX1();if(IY.localMode)Promise.resolve().then(() => (G_(),dw0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let X=await Q();if(X>0)console.log(`[local-mode] cleared ${X} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let Y=await $()}catch(X){console.error("Failed to seed local mode:",X)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (G_(),dw0));Z()}catch{}});var fp$=!1;async function $L6($){let Z;try{Z=await gw6.create({systemDatabaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:iJ,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=Q.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:iJ}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function Q20($){if(fp$)return;fp$=!0,console.log(`
+    `.execute($.db)}catch{}}async function Yw6($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function Gw6($,Z){let Q=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",jv).execute();for(let X of Q){let Y=X.settings,G=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(G.acceptPublishRequests===!0){let J=G.rateLimitWindow==="minute"?"minute":"hour",W=G.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):Xp$;return{acceptPublishRequests:!0,requireApiToken:G.requireApiToken===!0,rateLimitEnabled:G.rateLimitEnabled===void 0?Qp$:G.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:Qp$,rateLimitWindow:Qw6,rateLimitMax:Xp$}}async function Jw6($,Z,Q){let X=Q==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),G=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(G?.count??0)}async function Ww6($,Z,Q,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((G)=>G.or([G("id","=",Q),G("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function Yp$($){let{db:Z,db:Q}=$,X=new ex(Q),Y=new $y(Q);return async(G)=>{let J=G.req.param("orgRef")??G.req.param("org");if(!J)return G.json({error:"Organization not found"},404);let W=await Yw6(Z,J);if(!W)return G.json({error:"Organization not found"},404);let K=await Gw6(Z,W);if(!K.acceptPublishRequests)return G.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let B=G.req.header("Authorization"),O=B?.startsWith("Bearer ")?B.slice(7).trim():null;if(!O)return G.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,O))return G.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await Jw6(Q,W,K.rateLimitWindow)>=K.rateLimitMax)return G.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let F;try{F=await G.req.json()}catch{return G.json({error:"Invalid JSON body"},400)}let H=Mv$.safeParse(F);if(!H.success)return G.json({error:"Invalid publish request payload",details:Zw6.treeifyError(H.error)},400);let U=await Ww6(Q,W,H.data.data.id,H.data.data.title);if(U)return G.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:U},409);let N=await X.createOrUpdate({organization_id:W,requested_id:H.data.data.id,title:H.data.data.title,description:H.data.data.description??null,_meta:H.data.data._meta,server:H.data.data.server,requester_name:H.data.requester?.name??null,requester_email:H.data.requester?.email??null});try{await Xw6({db:Z,organizationId:W,request:N})}catch(B){console.warn("[private-registry] failed to emit publish-request event:",B)}return _1.capture({distinctId:H.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:N.id,requested_id:N.requested_id,title:H.data.data.title,requester_email:H.data.requester?.email??null}}),G.json({id:N.id,requested_id:N.requested_id,status:N.status},201)}}var Qp$=!0,Qw6="hour",Xp$=100;var Gp$=D(()=>{v4();I8();Ru();_u0();vu0();j9()});var Jp$={};j4(Jp$,{createPublishRequestHandler:()=>Yp$,createPublicMCPHandler:()=>vv$});var Wp$=D(()=>{Tu();Gp$()});var Lp$={};j4(Lp$,{watchHandler:()=>wp$,resolveCorsOrigin:()=>Op$,isSsoExemptPath:()=>Np$,isAllowedOAuthRedirectUri:()=>Dp$,createApp:()=>jw6});import{readFileSync as Kw6}from"fs";import{PrometheusSerializer as Fw6}from"@opentelemetry/exporter-prometheus";import{DBOS as Kw}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Ow6,oAuthProtectedResourceMetadata as Dw6}from"better-auth/plugins";async function Hw6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,Fp$(Kp$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),Fp$(Kp$)]),Q.release(),!0}catch{return Q.release(!0),!1}}function Fp$($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}async function Uw6($,Z){let{items:Q}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${Vy$}%`},limit:1}),X=Q[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function Nw6($){let Z=new URLSearchParams;if($){let[Q,X]=$.split("/");if(Q)Z.set("workspace_hint",Q);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}function Np$($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${t91}/`)}function Bp$($){return $==="local.studio.decocms.com"}function Op$($,{baseUrl:Z,requestOrigin:Q}){let X;try{X=new URL($).hostname}catch{return null}if(X==="localhost"||X==="127.0.0.1")return $;if(Bp$(X))return $;let Y=Z??Q;try{if(new URL(Y).origin===$)return $}catch{}return null}function Dp$($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||Bp$($.hostname)}async function jw6($={}){let Z=$.database??B8(),Q=!1;b5.stop().catch((L0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",L0)});let X,Y,G,J,W=new AQ1,K,F,H,U=null;if($.disableNats)K=TQ1(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=null,G=null,J=new $o,F={start:async()=>{},broadcast:()=>{},stop:async()=>{}},H={init:async()=>{},pump:(L0)=>{return(async()=>{let Y0=L0.getReader();try{while(!0){let{done:a0}=await Y0.read();if(a0)break}}catch{}finally{Y0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=Bi$();let L0=V0().natsCredsPath,Y0;if(L0)try{Y0=Kw6(L0,"utf8")}catch(i){console.error(`[app] failed to read NATS_CREDS at ${L0}; connecting anonymously`,i)}U.init(V0().natsUrls,Y0?{creds:Y0}:void 0);let a0=ac0()?new bc0({getJetStream:()=>U.getJetStream()}):null;a0?.init().catch(()=>{}),X=a0;let P1=new Rt0({getJetStream:()=>U.getJetStream()});P1.init().catch(()=>{}),Y=P1;let x$=new vg(Xr0,{getJetStream:()=>U.getJetStream()}),p4=new vg(Yr0,{getJetStream:()=>U.getJetStream()});x$.init().catch(()=>{}),p4.init().catch(()=>{}),G={reads:x$,cards:p4};let X5=new ts0({getJetStream:()=>U.getJetStream()});X5.init().catch(()=>{}),J=X5,K=TQ1({getConnection:()=>U.getConnection()}),F=new RQ1({getConnection:()=>U.getConnection()}),H=new MQ1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),hy$(U),U.onReady(()=>{a0?.init().catch((i)=>{console.error("[McpListCache] Deferred init failed:",i)}),P1.init().catch((i)=>{console.error("[SkillCatalogCache] Deferred init failed:",i)}),x$.init().catch((i)=>{console.error("[PrReadCache] Deferred init failed:",i)}),p4.init().catch((i)=>{console.error("[PrCardCache] Deferred init failed:",i)}),X5.init().catch((i)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",i)}),K.start(),be1(()=>U.getConnection()),H.init().catch((i)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",i)})})}if(Fw)await Fw();xc0(X),qt0(Y),Gr0(G),os0(J);let B={storage:new Mg(Z.db),sseHub:b5,onThreadFinished:async(L0,Y0)=>fg(new KG(Z.db),L0,Y0,new BK(Z.db))},O=new ua0(B),w=new da(Z.db),L=new kQ1(w);L.start(),TD$(F),F.start((L0)=>{KL0(L0),O.execute({type:"CANCEL",taskId:L0}).catch((Y0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",Y0)})}).catch((L0)=>{console.error("[Decopilot] CancelBroadcast start failed:",L0)}),U?.onReady(()=>{F.start().catch((L0)=>{console.error("[CancelBroadcast] Deferred start failed:",L0)})});let E=()=>U?.getConnection()??null;ZZ1(E),U?.onReady(()=>ZZ1(E)),H.init().catch((L0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",L0)}),Fw=async()=>{await O.stopAll(),O.dispose(),L.dispose(),F.stop().catch(()=>{}),lg$(),H.teardown(),X?.teardown(),Y?.teardown(),G?.reads.teardown(),G?.cards.teardown(),W.teardown(),K.teardown(),xe1(),J.teardown(),xc0(null),qt0(null),Gr0(null),os0(null)};let j=new J1;if(j.use("*",is0({enabled:(L0)=>xu(L0,"debug")==="1"})),j.use("*",z20),j.use("/*",fy$({origin:(L0,Y0)=>Op$(L0,{baseUrl:V0().baseUrl,requestOrigin:new URL(Y0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),j.use("*",async(L0,Y0)=>{if(await Y0(),L0.req.path.includes("/files/"))return;if(L0.req.path.includes("/fs/")&&L0.req.path.endsWith("/read"))return;L0.header("X-Frame-Options","DENY"),L0.header("Content-Security-Policy","frame-ancestors 'none'")}),!V0().noTui)j.use("*",yi$());j.use("*",async(L0,Y0)=>{if(await Y0(),El(L0.req.path))return;if(L0.res.status>=500){let P1=await L0.res.clone().text();console.error(`[5xx Response] ${L0.req.method} ${L0.req.path} - ${L0.res.status}:`,P1)}}),j.get(kQ.HEALTH,(L0)=>{if(Q)return L0.json({status:"shutting_down"},503);return L0.json({status:"ok"})}),j.get(kQ.HEALTH_LIVE,(L0)=>{return L0.json({status:"ok"})}),j.get(kQ.HEALTH_READY,async(L0)=>{if(Q)return L0.json({status:"shutting_down"},503);let Y0={};if(Y0.postgres={status:await Hw6(Z.pool)?"up":"down"},U)Y0.nats=U.isConnected()?{status:"up"}:{status:"down"};else Y0.nats={status:"down"};let a0=Y0.postgres.status==="up",P1=a0?200:503;return L0.json({status:a0?"ready":"not_ready",services:Y0},P1)}),j.get(kQ.METRICS,async(L0)=>{try{let Y0=await R20.collect(),a0=Bw6.serialize(Y0.resourceMetrics);return L0.text(a0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(Y0){return console.error("Failed to collect metrics:",Y0),L0.text("# Error collecting metrics",500)}}),j.get(`${kQ.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(L0)=>{let Y0=L0.req.param("queueName");if(!ww6.has(Y0))return L0.json({error:`Unknown queue: ${Y0}`},404);let a0=await Kw.listQueuedWorkflows({queueName:Y0,status:"ENQUEUED"});return L0.json({queue_length:a0.length})}),j.route("/api/config",Dm$),j.route("/api/_reports",qm$),j.route("/api/_stripe",DQ1),j.route("/api/_github",wQ1);let z={db:Z.db,encryptionKey:V0().encryptionKey};j.route("/api/_jira",um$(z)),j.route("/api/_jira",xm$(z)),j.route("/report",Tm$($.clientDir)),j.route("/api/auth/custom",Jg$),j.route("/api/auth/desktop",Hg$),j.all("/api/auth/admin/*",Mg$),j.all("/api/auth/*",async(L0)=>{return await $8.handler(L0.req.raw)});let P=Ax$();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",Rv),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",Rv),j.route("/",P),j.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",ha),j.route("/",Mx$()),j.use("/oauth-proxy/:connectionId/*",Rv),j.all("/oauth-proxy/:connectionId/*",Hp$);let A=async(L0)=>{let a0=await Lw6()(L0.req.raw),P1=await a0.json();return Response.json(P1,a0)};j.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",Rv),j.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let I=async(L0)=>{let a0=await Ew6()(L0.req.raw),P1=await a0.json();return Response.json(P1,a0)};j.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",I);let k=xy$({ttlMs:120000}),M=await Oy$({db:Z.db,auth:$8,encryption:{key:V0().encryptionKey},observability:{tracer:WN,meter:$$},modelListCache:W,providerKeyCache:K,memberRoleCache:k});EJ.set(M);let S=new hQ(V0().encryptionKey);S_1({db:Z.db,baseUrl:G9()}),Dy$({db:Z.db}),jy$({db:Z.db}),dm$({db:Z.db,encryptionKey:V0().encryptionKey}),yF$({db:Z.db}),Iy$({db:Z.db}),HH$({db:Z.db});let m=q50(Z.db),f=new Vi(Z.db),b=vi$({db:Z.db});ls0({storage:m,studioContextFactory:b}),ra0({studioContextFactory:b,deps:{runRegistry:O,cancelBroadcast:F,streamBuffer:H,sseHub:b5}}),da0({dispatchRunFn:MO$,studioContextFactory:b,deps:{runRegistry:O,cancelBroadcast:F,streamBuffer:H,sseHub:b5}});let p=new Mg(Z.db),l=new KG(Z.db),o=new BK(Z.db),N0=new VQ1(l,b,o);if(V0().taskBoardReviewSweeperEnabled){N0.start();let L0=Fw;Fw=async()=>{await L0?.(),N0.dispose()}}tO$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let L0=U?.getConnection();return L0?await Up$.jetstreamManager(L0):null},messageParts:p.messageParts(),resolveRun:async(L0)=>{let Y0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",L0).executeTakeFirst();return Y0?{orgId:Y0.organization_id,createdBy:Y0.created_by,version:Y0.message_storage_version??1,status:Y0.status,runFenceToken:Y0.run_fence_token,title:Y0.title??null}:null},completeRunIfNotCompleted:async(L0,Y0)=>{let a0=await p.completeRunIfNotCompleted(L0,Y0);if(rT0(b5,Y0,L0,a0),a0)await fg(l,L0,Y0,o);return a0},markRunRequiresAction:async(L0,Y0)=>{let a0=await p.requiresActionIfInProgress(L0,Y0);return rT0(b5,Y0,L0,a0),a0},markRunFailed:async(L0,Y0,a0,P1)=>{let x$=await p.markRunFailed(L0,Y0,a0,P1);if(rT0(b5,Y0,L0,x$),x$)await fg(l,L0,Y0,o);return x$},clearSynthesizedError:async(L0,Y0)=>{await p.messageParts().replaceMessageParts(L0,wD(L0,Y0),[])},persistTitle:(L0,Y0,a0)=>p.update(L0,Y0,{title:a0}),onTitleUpdated:async({runId:L0,orgId:Y0,title:a0})=>{let P1=await p.get(L0,Y0).catch(()=>null);b5.emit(Y0,rW(L0,P1?.status??"in_progress",{title:a0,virtualMcpId:P1?.virtual_mcp_id??void 0,createdBy:P1?.created_by,triggerId:P1?.trigger_id,branch:P1?.branch??null,harnessId:P1?.harness_id??void 0,createdAt:P1?.created_at,updatedAt:P1?.updated_at}))},bumpProgress:async({runId:L0,orgId:Y0})=>{await p.bumpProgress(L0,Y0)},recordCompleted:async({runId:L0,orgId:Y0,distinctId:a0,usage:P1})=>{_1.capture({distinctId:a0,event:"chat_message_completed",groups:{organization:Y0},properties:{organization_id:Y0,thread_id:L0,transport:"projector",input_tokens:P1.inputTokens,output_tokens:P1.outputTokens,total_tokens:P1.totalTokens}})},recordFailed:async({runId:L0,orgId:Y0,distinctId:a0,reason:P1,kind:x$})=>{_1.capture({distinctId:a0,event:"chat_message_failed",groups:{organization:Y0},properties:{organization_id:Y0,thread_id:L0,transport:"projector",error_category:x$,error_message:P1}})},purgeRun:async(L0)=>{H.purge(L0)}}),eB$({studioContextFactory:b,systemDatabaseUrl:St1(V0().databaseUrl,V0().databasePgSsl),streamBuffer:H}),Ci$(),C_1(),Ly$(),Py$(),pm$(),cF$(),My$(),UH$();let j0=async(L0,Y0,a0)=>{let P1=await m.findById(L0,Y0);if(!P1)throw Error("Automation not found");return ms0({automationId:P1.id,organizationId:P1.organization_id,triggerId:null})},a=new hu(m,({automation:L0,trigger:Y0,contextMessages:a0,idempotencyKey:P1})=>et({automationId:L0.id,organizationId:L0.organization_id,triggerId:Y0.id,contextMessages:a0},{idempotencyKey:P1})),r=[pJ(),uv(),uF()];for(let L0 of r)eT0(L0).then(()=>{}).catch((Y0)=>console.error("[monitoring] Retention cleanup failed:",Y0));let T0=()=>$8.api.deleteAllExpiredApiKeys().catch((L0)=>console.error("[auth] Expired API key cleanup failed:",L0));T0(),setInterval(T0,86400000).unref(),j.use("*",async(L0,Y0)=>{if(E20(L0.req.path))return Y0();let a0={measure:async(x$,p4)=>{qJ(L0,x$);try{return await p4()}finally{BG(L0,x$)}}},P1=await EJ.create(L0.req.raw,{timings:a0});P1.automationRunner=j0,L0.set("studioContext",P1);try{await Y0()}finally{let x$=P1.pendingRevalidations;if(x$.length>0)Promise.race([Promise.allSettled(x$),L$(30000)]).catch((X5)=>console.error("[studio] revalidation cleanup error:",X5))}}),j.use("/api/:org/decopilot/*",Av),j.use("/api/:org/v1/*",Av),j.use("/api/:org/files/*",Av),j.use("*",async(L0,Y0)=>{if(Np$(L0.req.path))return Y0();let a0=L0.get("studioContext");if(!a0?.organization?.id||!a0?.auth?.user?.id)return Y0();if(!(await a0.storage.orgSsoConfig.getByOrgId(a0.organization.id))?.enforced)return Y0();if(!await a0.storage.orgSsoSessions.isValid(a0.auth.user.id,a0.organization.id))return L0.json({error:"SSO authentication required for this organization"},403);return Y0()});let Z0=new J1;Z0.use("*",RW({mountPath:"/api/org-sso"})),Z0.route("/",fA0()),j.route("/api/org-sso",Z0),j.get("/api/tools/management",(L0)=>{return L0.json({tools:xu0,grouped:JE()})}),j.use("/mcp/*",async(L0,Y0)=>{qJ(L0,"mcp");try{return await Y0()}finally{BG(L0,"mcp")}});let z0=async(L0,Y0)=>{let a0=L0.var.studioContext;if(!a0.auth.user?.id&&!a0.auth.apiKey?.id){let P1=new URL(L0.req.url),x$=L0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),p4=x$?`${x$}://${P1.host}`:P1.origin;return L0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${p4}${P1.pathname}/.well-known/oauth-protected-resource"`}})}return await Y0()};if(j.use("/mcp/:connectionId?",z0),j.use("/mcp/gateway/:virtualMcpId?",z0),j.use("/mcp/virtual-mcp/:virtualMcpId?",z0),j.use("/mcp/self",z0),gX()){let{mountDevRoutes:L0}=($p$(),G20(ei$));L0(j,z0)}let y0=new J1;y0.use("*",RW({mountPath:"/mcp"})),y0.route("/",dL0()),j.route("/mcp",y0);let I0=new J1;I0.use("*",RW({mountPath:"/mcp/self"})),I0.route("/",AT0()),j.route("/mcp/self",I0);let u0=new J1;u0.use("*",RW({mountPath:"/mcp"})),u0.route("/",pL0()),j.route("/mcp",u0),j.use("/api/:org/models/*",async(L0,Y0)=>{qJ(L0,"llm_models");try{return await Y0()}finally{BG(L0,"llm_models")}});let X0=dg$({cancelBroadcast:F,streamBuffer:H,runRegistry:O});j.route("/api",X0),j.use("/api/:org/files/*",Av),j.route("/api",rm$);let O0=new J1;O0.use("*",RW({mountPath:"/api"})),O0.route("/",TT0()),j.route("/api",O0),j.route("/api",Km$);let w0=new J1;w0.use("*",RW({mountPath:"/api"})),w0.route("/",RT0({tokenStorage:f,automationEventDispatcher:a})),j.route("/api",w0);let M0=new Ci(Z.db),e=new J1;e.use("*",RW({mountPath:"/api"})),e.route("/",uA0()),j.route("/api",e),j.route("/api/deco-sites",Xh$()),j.route("/api/deco-apps",Qm$());let Q0=new J1;Q0.use("*",RW({mountPath:"/api/deco-sites"})),Q0.route("/",cA0()),j.route("/api/deco-sites",Q0);let{createPublishRequestHandler:k0,createPublicMCPHandler:K0}=await Promise.resolve().then(() => (Wp$(),Jp$)),U0={db:Z.db,vault:{encrypt:(L0)=>S.encrypt(L0),decrypt:(L0)=>S.decrypt(L0)}},L1=k0(U0),C0=K0(U0);j.use("/org/:orgRef/registry/publish-request",Rv),j.post("/org/:orgRef/registry/publish-request",L1),j.use("/org/:orgSlug/registry/*",Rv),j.all("/org/:orgSlug/registry/*",C0),j.post("/api/:org/registry/publish-request",L1),j.all("/api/:org/registry/*",C0),j.route(t91,kg$()),j.route("/api/_editor-resolve",Hm$()),j.route(Ng$,Bg$());let i0=$m$({kvStorage:M0,runRegistry:O,streamBuffer:H,sseHub:b5,cancelBroadcast:F,tokenStorage:f,automationEventDispatcher:a,mountDevAssets:gX(),mcpAuth:z0,oauthProxyHandler:Hp$,watchHandler:wp$,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return j.route("/api/:org",i0),j.notFound((L0)=>{return L0.json({error:"Not Found",path:L0.req.path},404)}),j.onError(pg$),Object.assign(j,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([b5.stop(),Fw?Promise.resolve(Fw()).finally(()=>{Fw=null}):Promise.resolve()]),U)await U.drain().catch((L0)=>console.error("[shutdown] NATS drain error:",L0));console.log("[shutdown] Flushing telemetry..."),await DX().catch((L0)=>console.error("[shutdown] Telemetry flush error:",L0)),console.log("[shutdown] Closing database..."),await _t1(Z).catch((L0)=>console.error("[shutdown] Database close error:",L0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Kw.registerQueue(MG,{partitionQueue:!0,concurrency:gs0,minPollingIntervalMs:hs0}),await Kw.registerQueue(iJ,{partitionQueue:!0,concurrency:ta0,priorityEnabled:!0}),await Kw.registerQueue(gF,{workerConcurrency:V0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await Kw.registerQueue(hF,{workerConcurrency:V0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await Kw.registerQueue(JN,{partitionQueue:!0,concurrency:sB$}),await Kw.registerQueue(Hw,FH$),await JZ1(m),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((L0)=>Kw.deleteQueue(L0))),await us0(Z.pool),va1().catch((L0)=>{console.error("[studio-pack-backfill] failed:",L0)}),__1().catch((L0)=>{console.error("[org-fs] public-sets boot sync kick failed:",L0)})}})}var Up$,Kp$=5000,Fw=null,Hp$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),X=Q[Q.length-1],Y=$.get("studioContext");if(!Y)Y=await EJ.create($.req.raw),$.set("studioContext",Y);let G=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,G);if(!J?.connection_url)return $.json({error:"Connection not found"},404);if(X==="register"&&J.oauth_config?.clientId){let f=await $.req.json().catch(()=>({}));return $.json({...typeof f==="object"&&f!==null?f:{},client_id:J.oauth_config.clientId,...J.oauth_config.clientSecret?{client_secret:J.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await vu(J.connection_url),K,F=new URL(J.connection_url),U=(typeof J.metadata?.oauthResource==="string"&&J.metadata.oauthResource.length>0?J.metadata.oauthResource:void 0)??J.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=F.origin;let N=await ua(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(X==="authorize")O=B.authorization_endpoint;else if(X==="token")O=B.token_endpoint;else if(X==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let w=qx$(O);if(w)return w;let L=new URL(O),E=new URL($.req.url);if(L.search=E.search,X==="authorize"){let f=L.searchParams.get("redirect_uri");if(f){let b=V0().baseUrl??E.origin;try{if(!Dp$(new URL(f),b))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}L.searchParams.set("redirect_uri",f)}if(L.searchParams.has("resource"))L.searchParams.set("resource",U);if(Sy$(J.connection_url))try{let b=await Uw6(Y,J.organization_id),p=Nw6(b);for(let[l,o]of p)L.searchParams.set(l,o)}catch(b){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",b)}return $.redirect(L.toString(),302)}let j={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)j["Content-Type"]=z;let P=$.req.header("Authorization");if(P)j.Authorization=P;let A,I=null,k=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&z?.includes("application/x-www-form-urlencoded")){if(P?.toLowerCase().startsWith("basic "))try{let o=atob(P.slice(6).trim()),N0=o.indexOf(":");if(N0!==-1){let j0=decodeURIComponent(o.slice(0,N0)),a=decodeURIComponent(o.slice(N0+1));I=j0||null,k=a||null}}catch{}let f=await $.req.formData();if(f.has("resource"))f.set("resource",U);let b=f.get("client_id"),p=f.get("client_secret");if(typeof b==="string"&&b)I=b;if(typeof p==="string"&&p)k=p;let l=new URLSearchParams;for(let[o,N0]of f.entries())l.append(o,N0.toString());A=l.toString()}else if(X==="register"&&z?.toLowerCase().includes("application/json")){let f=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),b=await $.req.text(),p={};try{p=b?JSON.parse(b):{}}catch{A=b}let l=typeof p==="object"&&p!==null&&!Array.isArray(p);if(A===void 0&&!l)A=b;if(A===void 0){let o=p,N0=o.metadata&&typeof o.metadata==="object"?o.metadata:{};o.metadata={...N0,organization_id:J.organization_id,...f?.slug?{organization_slug:f.slug}:{},...f?.name?{organization_name:f.name}:{}},A=JSON.stringify(o),j["Content-Type"]="application/json"}}else A=$.req.raw.body??void 0;let M=await fetch(L.toString(),{method:$.req.method,headers:j,body:A,duplex:"half",redirect:"manual"}),S=new Headers,m=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[f,b]of M.headers.entries())if(!m.includes(f.toLowerCase()))S.set(f,b);if(X==="token"&&M.ok){let f=await M.text();try{let b=JSON.parse(f);if(typeof b.access_token==="string"&&b.access_token){let p=typeof b.expires_in==="number"?new Date(Date.now()+b.expires_in*1000):null,l=null;try{l=await fu(J.connection_url)??O}catch{l=O}let o={connectionId:Z,accessToken:b.access_token,refreshToken:typeof b.refresh_token==="string"?b.refresh_token:null,scope:typeof b.scope==="string"?b.scope:null,expiresAt:p,clientId:I,clientSecret:k,tokenEndpoint:l};await new t6(Y.db,Y.vault).upsert(o)}}catch(b){console.error("[oauth-proxy] failed to persist downstream token:",b)}return new Response(f,{status:M.status,statusText:M.statusText,headers:S})}return new Response(M.body,{status:M.status,statusText:M.statusText,headers:S})},wp$=async($)=>{let Z=$.var.studioContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),G=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return QN($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:G,connectedAt:new Date().toISOString()})}),!b5.add({id:J,organizationId:X,typePatterns:G?.length?G:null,push:(H)=>{W.writeSSE({id:H.id,event:H.type,data:JSON.stringify(H)}).catch(()=>{b5.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let F=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(F)})},30000);await new Promise((H)=>{W.onAbort(()=>{clearInterval(F),b5.remove(X,J),H()})})})},Bw6,ww6,Lw6=()=>Dw6($8),Ew6=()=>Ow6($8);var Ep$=D(()=>{a8();D$();v_1();Ey$();Ay$();go0();ky$();At();u5();SE();I8();d$();qA0();by$();ps0();oY();KD();v91();aG();Q6();v4();u91();Ug$();Og$();Vg$();s91();mg$();YZ1();ZJ();OA0();GZ1();ng$();kA0();Zm$();FZ1();Xm$();mL0();Zo();Fm$();nL0();b71();Um$();wm$();Rm$();Mm$();fm$();bm$();ym$();lm$();nm$();am$();f71();_71();os();tN();Oi$();yX();CD0();Kr0();Cp();vp();as0();Di$();Li$();QZ1();Ri$();la0();Ii$();Lw0();u50();jU();x5();U91();ki$();_i$();o90();SQ1();qY();WZ1();EU();ga0();o90();EL0();Au0();Tu0();fi$();Zy();gi$();Yl();v91();dg();FL0();Up$=V(nF(),1);Bw6=new Fw6,ww6=new Set([MG,iJ,gF,hF,JN,Hw])});var Ap$={};j4(Ap$,{resolveClientDir:()=>qw6,resolveAssetPathWithTraversalCheck:()=>Pp$,isPathWithinDirectory:()=>zp$,createAssetHandler:()=>Mw6});import{resolve as gs,dirname as zw6,join as Pw6,extname as Aw6,basename as Tw6,sep as jp$}from"path";function Rw6($,Z){if($===Z||Tw6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${jp$}assets${jp$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function zp$($,Z){let Q=gs(Z),X=gs($);return X===Q||X.startsWith(Q+"/")}function Pp$({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,X=gs(Z,Q);if(!zp$(X,Z))return null;return X}function qw6($,Z="../client"){let Q=new URL($),X=zw6(Q.pathname);return gs(X,Z)}function Mw6($={}){let{env:Z="production",clientDir:Q=Iw6,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(G){return null};return async function(G){if(G.method!=="GET")return null;let J=new URL(G.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=Pp$({requestPath:W,clientDir:Q});if(!K)return null;let F=Pw6(K,"index.html"),H=gs(Q,"index.html"),U=G.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Aw6(K))?[F,H]:[];for(let O of[K,...B])try{let w=Bun.file(O);if(await w.exists())return new Response(w,{headers:Rw6(O,H)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var Iw6="./dist/client";var Tp$=()=>{};var Rp$={};j4(Rp$,{tryUpgradePreviewWs:()=>fw6,tryHandlePreviewHttp:()=>vw6,previewWebSocketHandler:()=>bw6,parsePreviewBaseDomain:()=>_w6,isPreviewWsData:()=>$20,extractHandleFromHost:()=>hQ1});function Sw6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function Cw6(){return new Response(Vw6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function _w6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let X=Q.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function hQ1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),X=(Q>=0?$.slice(0,Q):$).toLowerCase(),G=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(G))return null;let J=X.slice(0,X.length-G.length);if(!J||J.includes("."))return null;return J}async function vw6($,Z){let Q=hQ1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let X=await Z.getRunner();if(!X)return us(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(Q,$);if(Y.headers.get(CC)&&Sw6($))return Cw6();return Y.headers.delete(CC),Y}function us($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function $20($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function fw6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=hQ1($.headers.get("host"),Q.baseDomain);if(!X)return null;let Y=await Q.getRunner();if(!Y)return us(503,"preview proxy not configured");let G=await Y.resolvePreviewUpstreamUrl(X);if(!G)return us(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox"))return us(404,"not found");let W=`${G.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),F=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],H={kind:"preview",upstreamUrl:W,upstreamProtocols:F,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:H}))return us(426,"upgrade failed");return}function hs($,Z,Q,X){if(Z.closed)return;Z.closed=!0;try{$.close(Q,X)}catch{}try{Z.upstream?.close()}catch{}}var kw6=256,Vw6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',bw6;var Ip$=D(()=>{Gt0();bw6={open($){let Z=$.data;if(!$20(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),hs($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)Q.send(X)}}),Q.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),Q.addEventListener("close",(X)=>{hs($,Z,X.code||1000,X.reason||"")}),Q.addEventListener("error",()=>{hs($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!$20(Q))return;let X=Q.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(Q.pending.length>=kw6){hs($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!$20(Z))return;hs($,Z,1000,"")}}});var Vp$={};j4(Vp$,{printBanner:()=>yw6,bannerLines:()=>kp$,BANNER_LINES:()=>qp$,BANNER_GRADIENT:()=>Mp$});function xw6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function kp$($){let Z=qp$.map((Q,X)=>{let[Y,G,J]=xw6(Mp$[X]);return`\x1B[38;2;${Y};${G};${J}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function yw6($){console.log("");for(let Z of kp$($))console.log(Z);console.log("")}var qp$,Mp$;var Sp$=D(()=>{qp$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],Mp$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a8();var aQ1="11";function sQ1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:aQ1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a8();import np$ from"pg";var eQ1=8314027461559302n,tp$=600000,op$=500;async function $X1($,Z){let{databaseUrl:Q,lockTimeoutMs:X=tp$}=$,Y=$.log??((K)=>console.log(K)),G=new np$.Client({connectionString:Q});await G.connect();let J=Date.now(),W=!1;try{while(!W){if(W=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[eQ1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-J>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await L$(op$)}let K=Date.now()-J;if(K>1000)Y(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await G.query("SELECT pg_advisory_unlock($1)",[eQ1.toString()])}catch{}await G.end().catch(()=>{})}}D$();F20();Q6();function pn$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function M20($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function xX1(){let $=pn$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:M20($,"--cpu-prof-dir")??process.cwd(),name:M20($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(M20($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}S20();var ss;function iX1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Bw();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),ss=setInterval(()=>void Z().catch(()=>{}),$),ss.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(ss)clearInterval(ss)}}import*as on$ from"bun:jsc";var{startSamplingProfiler:rn$,samplingProfilerStackTraces:an$}=on$;function pX1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{rn$()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-X;X=G+Z;let W=[];try{W=an$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let H of W){let U=H.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??H.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let F=[...K.entries()].sort((H,U)=>U[1]-H[1]).slice(0,8).map(([H,U])=>({frame:H,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:F}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function nX1(){xX1();let $=[iX1(),mX1(),pX1()];return()=>{for(let Z of $)Z()}}import{existsSync as iw6}from"fs";var IY=V0();vX1();var{DBOS:ls,DBOSClient:gw6}=await import("@dbos-inc/dbos-sdk");function iQ1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var hw6=[MG,iJ,gF,hF,JN,Hw],uw6=IY.dispatchRole==="worker"?hw6:IY.dispatchRole==="api"?[]:void 0;ls.setConfig(sQ1({systemDatabaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl),poolSize:IY.dbosPoolSize,executorID:IY.podName,listenQueues:uw6}));var{createApp:lw6}=await Promise.resolve().then(() => (Ep$(),Lp$)),{isServerPath:cw6}=await Promise.resolve().then(() => (os(),wX1)),{createAssetHandler:dw6,resolveClientDir:bp$}=await Promise.resolve().then(() => (Tp$(),Ap$)),mw6=IY.port,Cp$=bp$(import.meta.url,"../client"),xp$=iw6(Cp$)?Cp$:bp$(import.meta.url,"../dist/client"),pw6=dw6({clientDir:xp$,isServerPath:cw6}),nw6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function tw6($){let Z=new Headers($.headers);for(let[Q,X]of Object.entries(nw6))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:ow6,tryHandlePreviewHttp:rw6,tryUpgradePreviewWs:aw6,previewWebSocketHandler:uQ1,isPreviewWsData:lQ1}=await Promise.resolve().then(() => (Ip$(),Rp$)),{getOrInitSharedRunner:yp$}=await Promise.resolve().then(() => (s3(),W3$)),gp$=ow6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),_p$={baseDomain:gp$??"",getRunner:yp$};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())yp$().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var Z20=await lw6({clientDir:xp$}),cQ1=process.env.DBOS_CONDUCTOR_KEY?.trim(),vp$=process.env.DBOS_CONDUCTOR_URL?.trim();await $X1({databaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl)},()=>ls.launch({...cQ1?{conductorKey:cQ1}:{},...cQ1&&vp$?{conductorURL:vp$}:{}}));console.log(`[dbos] application version: ${ls.applicationVersion}`);var dQ1=5,mQ1=0;await Z6(async()=>{mQ1++;try{return await Z20.initDbos()}catch($){let Z=mQ1>=dQ1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${mQ1}/${dQ1} failed, ${Z}`,$),$}},{maxAttempts:dQ1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!IY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (Sp$(),Vp$));console.log("");for(let Z of $())console.log(Z)}var sw6=Bun.serve({idleTimeout:0,port:mw6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(gp$){let X=await aw6($,Z,_p$);if(X===void 0)return;if(X)return X;let Y=await rw6($,_p$);if(Y)return Y}let Q=await pw6($);if(Q)return tw6(Q);return Z20.fetch($,{server:Z})},websocket:{open($){if(lQ1($.data))uQ1.open($)},message($,Z){if(lQ1($.data))uQ1.message($,Z)},close($){if(lQ1($.data))uQ1.close($)}},development:!1}),ew6=nX1();if(IY.localMode)Promise.resolve().then(() => (G_(),dw0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let X=await Q();if(X>0)console.log(`[local-mode] cleared ${X} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let Y=await $()}catch(X){console.error("Failed to seed local mode:",X)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (G_(),dw0));Z()}catch{}});var fp$=!1;async function $L6($){let Z;try{Z=await gw6.create({systemDatabaseUrl:iQ1(IY.databaseUrl,IY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:iJ,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=Q.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:iJ}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function Q20($){if(fp$)return;fp$=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),X=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);X.unref?.();let Y=0;try{ew6(),Z20.markShuttingDown();let G=QX1(IY.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await L$(G),await sw6.stop(!0);let J=ls.executorID;await ls.shutdown(),await $L6(J),await Z20.shutdown()}catch(G){console.error("[shutdown] Error during shutdown:",G),Y=1}clearTimeout(X),process.exit(Y)}process.on("SIGTERM",()=>Q20("SIGTERM"));process.on("SIGINT",()=>Q20("SIGINT"));process.on("SIGHUP",()=>Q20("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),Q20("uncaughtException")});