decocms 4.333.2 → 4.334.0

package/dist/server/server.js

@@ -1312,7 +1312,7 @@ ${Y}`:Y}case"media":return"";case"mediaSingle":case"mediaGroup":return xg(tK(Q),
                   when count(distinct up.metadata->'models'->'thinking'->>'provider') = 1
                   then max(up.metadata->'models'->'thinking'->>'provider')
                 end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(J)=>J.onTrue()).select((J)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",J.or([J.exists(J.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),J.exists(J.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",Q).where("link.task_board_item_id","in",X).orderBy("link.created_at","desc").execute(),G=new Map;for(let J of Y){let W={threadId:J.threadId,virtualMcpId:J.virtualMcpId??null,status:J.status??null,failureKind:J.failureKind??null,title:J.title??null,lastMessage:XH$(J.lastMessagePayload),hasPreview:Zw4(J.metadata),hasMessages:!!J.hasMessages,lastActiveAt:Xw4(J.updatedAt,J.lastProgressAt),costUsd:Qw4(J.costUsd),costProvider:J.costProvider??null,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},K=G.get(J.taskId);if(K)K.push(W);else G.set(J.taskId,[W])}for(let J of Z)J.threads=G.get(J.id)??[]}async attachTags($,Z){let Q=Z.map((G)=>G.id),X=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",Q).orderBy("tag.name","asc").execute(),Y=new Map;for(let G of X){let J={id:G.id,name:G.name,color:G.color??null,createdBy:G.createdBy,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},W=Y.get(G.taskId);if(W)W.push(J);else Y.set(G.taskId,[J])}for(let G of Z)G.tags=Y.get(G.id)??[]}async attachReviewVerdicts($,Z){let Q=Z.map((G)=>G.id),X=await $.selectFrom("task_board_activity").select(["task_board_item_id as taskId","action","data","occurred_at"]).where("task_board_item_id","in",Q).where("action","in",["status_changed","review_approved","review_changes_requested"]).orderBy("occurred_at","asc").execute(),Y=new Map;for(let G of X){let J={action:G.action,data:G.data??null,occurredAt:G.occurred_at instanceof Date?G.occurred_at.toISOString():G.occurred_at},W=Y.get(G.taskId);if(W)W.push(J);else Y.set(G.taskId,[J])}for(let G of Z){let J=Y.get(G.id)??[],W=G.reviewCycleStartedAt,K=RO(J,{cycleStartedAt:W}),F=RO(J,{cycleStartedAt:W,verifiedOnly:!0});G.reviewVerdicts=kK.flatMap((H)=>{let U=K.get(H);if(!U)return[];return[{reviewer:H,verdict:U,verified:F.get(H)==="approved"}]})}}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:R8("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute(),await this.fanOut([$])}async fanOut($){for(let Z of $){let Q=aD4(Z.action);if(!Q)continue;await hg({db:this.db,taskBoardItemId:Z.taskBoardItemId,type:Q,actorId:Z.actorId,alsoSubscribe:Z.alsoSubscribe})}}async resolveReviewClaimByToken($,Z){let Q=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return Q?{reviewer:Q.reviewer,cycleAt:Q.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),Q=[];for(let X of $)if(!(eD4.has(X.action)&&await this.touchRecentActivity(X,Z)))Q.push(X);if(Q.length===0)return;await this.db.insertInto("task_board_activity").values(Q.map((X)=>({id:R8("act"),task_board_item_id:X.taskBoardItemId,action:X.action,actor_id:X.actorId,data:X.data?JSON.stringify(X.data):null,occurred_at:Z}))).execute(),await this.fanOut(Q)}async touchRecentActivity($,Z){let Q=new Date(Date.parse(Z)-$w4).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((Y)=>$.actorId===null?Y("actor_id","is",null):Y("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(Q)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((X)=>({id:X.id,taskBoardItemId:X.task_board_item_id,action:X.action,actorId:X.actor_id,data:typeof X.data==="string"?JSON.parse(X.data):X.data??{},occurredAt:X.occurred_at instanceof Date?X.occurred_at.toISOString():X.occurred_at}))}async hasHumanRejectedDone($,Z){let Q=rK`a.data->>'from'`,X=rK`a.data->>'reason'`,Y="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(Q,"in",["done","merged"]).where(X,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((X)=>xw0(X))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let Q=null;if($.parentId){let Y=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!Y)return null;Q=Y.parent_id??Y.id}let X=await this.db.insertInto("task_board_comments").values({id:R8("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:Q,author_id:$.authorId,thread_id:$.threadId??null,body:$.body}).returningAll().executeTakeFirstOrThrow();return xw0(X)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let Q=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return Q?xw0(Q):null}async deleteComment($,Z,Q){let X=await this.commentInOrg($,Z);if(!X)return!1;if(X.authorId!==Q&&X.authorId!==d$)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async getComment($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?xw0(Q):null}async commentInOrg($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?{authorId:Q.author_id,parentId:Q.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,type:$.type??hm0,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,externalUrl:$.external_url??null,source:$.source??null,sortOrder:$.sort_order,keySeq:$.key_seq,retryAttempts:$.retry_attempts??0,reviewCycleStartedAt:$.review_cycle_started_at instanceof Date?$.review_cycle_started_at.toISOString():$.review_cycle_started_at??null,threads:[],tags:[],reviewVerdicts:[],createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var sD4,eD4,$w4=600000,YH$,bt,Yw4;var AU=D(()=>{YJ();r7();w4();w4();Ow0();Sw0();vw0();bw0();sD4=new Set(Vw0);eD4=new Set(["description_changed","title_changed"]);YH$=new Set(["in_progress","in_review"]),bt=new Set(["completed","failed","expired"]);Yw4=[...K70,"done"]});function GH$($){let Z=$[1],Q=$[2],X=Number($[3]);return{owner:Z,repo:Q,number:X,url:`https://github.com/${Z}/${Q}/pull/${X}`}}function JD($){let Z=$.length>200000?$.slice(0,200000):$,Q=Gw4.exec(Z);if(Q&&Number(Q[3])>0)return GH$(Q);let X=Jw4.exec(Z);if(X&&Number(X[3])>0)return GH$(X);return null}function yw0($){if($==null)return null;if(typeof $==="string")return JD($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?JD(Z):null}var Gw4,Jw4;var lg=D(()=>{Gw4=/https?:\/\/github\.com\/([^/\s"']+)\/([^/\s"']+)\/pull\/(\d+)/,Jw4=/https?:\/\/api\.github\.com\/repos\/([^/\s"']+)\/([^/\s"']+)\/pulls\/(\d+)/});import{z as gw0}from"zod";async function I6($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}async function JH$($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}var Or0;var BQ=D(()=>{I0();OJ();Or0=g({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gw0.object({taskBoardItemId:gw0.string()}),outputSchema:gw0.object({activity:gw0.array(u3$)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,Q)}}})});function G_($){if($.length===0)return!1;let Z=new Map;for(let Q of $){let X=`${Q.repoOwner}/${Q.repoName}`.toLowerCase(),Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z.values()].every(Ww4)}function Ww4($){return $.some((Z)=>Z.merged===!0)&&$.every((Z)=>Z.merged===!0||Z.state==="closed")}async function Kw4($,Z,Q,X){let Y=await $.storage.taskBoard.getById(Q,Z);if(!Y||Y.status!=="done")return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),J=await Promise.all(G.map(async(F)=>({...F,...await X($,Z,F)})));if(!G_(J))return!1;let W=z$.archive,K=await $.storage.taskBoard.update(Q,Z,{status:W},Y.updatedBy);return await I6($,{taskBoardItemId:Q,action:"status_changed",actorId:null,data:{from:"done",to:W,reason:"merged_pr_auto_archive"}}),G8(Z,K),!0}async function WH$($,Z,Q,X=uw0){let Y=0;for(let G of Q)try{if(await Kw4($,Z,G,X))Y+=1}catch(J){console.error(`[task-board-archive] ${G} failed`,J)}return{archived:Y}}function hw0($){let Z=new Map;for(let{id:Q,organizationId:X}of $){let Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z].map(([Q,X])=>({organizationId:Q,itemIds:X}))}var cg=D(()=>{w4();BQ();EZ();n5()});function J_($){let Z=Hw4[$];if(Z===void 0)throw Error(`Unknown board column "${$}"`);return Z}function Dr0($){return KH$.includes($)}function FH$($,Z){return J_(Z)>J_($)}function cw0($,Z){return J_($)<=J_(Z)}function UH$($){return $==="done"||KH$.includes($)}function XY($){if(J_($.status)>lw0.in_review)return!1;return $.status===z$.review||Boolean($.reviewCycleStartedAt)}var Fw4,lw0,Hw4,KH$,HH$;var XW=D(()=>{w4();Fw4=Object.fromEntries(l3.map(($,Z)=>[$,Z])),lw0=Fw4,Hw4=lw0;KH$=K70;HH$=new Set(["in_review","approved"])});function dw0($){return $.replace(/\/api\/[^/\s)]+\/fs\/([^/\s)]+)\/read\?path=([^)\s]+)/g,(Z,Q,X)=>{let Y,G;try{Y=decodeURIComponent(Q),G=decodeURIComponent(X)}catch{return Z}let J=(W)=>W.startsWith("/")||W.split("/").includes("..");if(J(Y)||J(G))return Z;return lK(Y,G)})}function mw0($,Z){return Z===$?null:"The image and file links in that description are real paths in this sandbox, not URLs \u2014 `Read` them. A screenshot the task points at is usually the clearest statement of what it wants."}var wr0=D(()=>{Nj()});function Uw4($){let Z=new Map($.map((G)=>[G.id,G])),Q=new Map;for(let G of kg($)){let J=NH$(G.owner,G.repo);Q.set(J,[...Q.get(J)??[],G])}if(Q.size!==1)return null;let X=[...Q.values()][0],Y=X.find((G)=>{let J=Z.get(G.connectionId);return J?gE(J):!1})??X[0];return{connectionId:Y.connectionId,owner:Y.owner,name:Y.repo,installationId:Y.installationId,url:`https://github.com/${Y.owner}/${Y.repo}`}}async function iw0($,Z){if(!Ge())return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"hosted sandbox unavailable \u2014 running Decopilot"),null;try{let{items:Q}=await $.storage.connections.list(Z,{slug:"mcp-github"}),X=Uw4(Q);if(X)return{repo:X};let Y=new Map;for(let J of kg(Q)){let W=NH$(J.owner,J.repo);if(!Y.has(W))Y.set(W,{connectionId:J.connectionId,repo:`${J.owner}/${J.repo}`})}let G=Y;if(G.size===0)return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"no importable repos \u2014 running Decopilot"),null;return console.warn(`[task-board] claude-code for org ${Z}: ${G.size} importable repos \u2014 the run picks one with TASK_ADD_REPO`),{choices:[...G.values()]}}catch(Q){return console.warn("[task-board] repo lookup for claude-code failed",Q),null}}function BH$($,Z,Q){let X=["You've been assigned this task. Complete it and finish with a pull request if it makes sense (like a coding task) or is explicitly requested.","","You are running AUTONOMOUSLY \u2014 no human is watching, so drive this to "+"completion yourself. Make reasonable decisions and move on; do not stop to ask for confirmation.","",`Title: ${$.title}`];if($.description){let Y=dw0($.description);X.push("","Description:",Y);let G=mw0($.description,Y);if(G)X.push("",G)}if(X.push("",Z?`The repository ${Z.owner}/${Z.name} is already cloned at your working directory, on its own branch. \`git\` and \`gh\` are authenticated. ${Gn}`:["Your working directory is EMPTY: this organization has several repositories, so nothing has been cloned yet. FIRST call `mcp__studio__TASK_ADD_REPO` with the connectionId of the repository this task is about. It clones that repository into your working directory and waits for the checkout, so once it returns the repository is there on its own branch and `git` and `gh` are authenticated. Do not read files, run `git`, or run `gh` before it returns; there is nothing there yet.","","Repositories in this organization:",...(Q?.repoChoices??[]).map((Y)=>`- ${Y.repo} (connectionId: ${Y.connectionId})`),Q?.repoChoices?.length?"Start with the one the task is about. If it turns out to need a change in "+"another of them too, call `mcp__studio__TASK_ADD_REPO` again \u2014 repositories "+"accumulate, so a second call adds a checkout beside the first rather than replacing it. Each lands in its own directory and keeps its own git remote, so open one pull request per repository you changed.":"Call `mcp__studio__TASK_ADD_REPO` with no arguments to list them."].join(`
-`),""),Q?.resolveConflict&&Q.pr)X.push(`Pull request #${Q.pr.number} (${Q.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`gh pr checkout ${Q.pr.number}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(Q?.feedback)X.push(Q.pr?`A reviewer requested changes on pull request #${Q.pr.number} (${Q.pr.url}):`:"A reviewer requested changes on your previous work:",Q.feedback,Q.pr?`Check that branch out (\`gh pr checkout ${Q.pr.number}\`) before editing, address the feedback, then push to update the SAME pull request \u2014 do NOT open a new one.`:"Address this feedback.","");else if(Q?.pr)X.push(`This task already has an open pull request #${Q.pr.number} (${Q.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.","");return X.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',"- Open the pull request from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.",'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),X.join(`
+`),""),Q?.resolveConflict&&Q.pr)X.push(`Pull request #${Q.pr.number} (${Q.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`gh pr checkout ${Q.pr.number}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME pull request \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(Q?.feedback)X.push(Q.pr?`A reviewer requested changes on pull request #${Q.pr.number} (${Q.pr.url}):`:"A reviewer requested changes on your previous work:",Q.feedback,Q.pr?`Check that branch out (\`gh pr checkout ${Q.pr.number}\`) before editing, address the feedback, then push to update the SAME pull request \u2014 do NOT open a new one.`:"Address this feedback.","");else if(Q?.pr)X.push(`This task already has an open pull request #${Q.pr.number} (${Q.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.","");return X.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',"- Open the pull request from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.","- If your change adds or edits pages a person can open, name them in the pull request body on a `Route:` line, or on a `Preview routes:` line followed by one `- /path` bullet per page \u2014 paths only, no host. Skip it when the change has no visible route.",'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),X.join(`
 `)}var NH$=($,Z)=>`${$}/${Z}`.toLowerCase();var Lr0=D(()=>{xD0();gX();w4();w$();wr0()});import{createHmac as Nw4,timingSafeEqual as Bw4}from"crypto";function Er0($,Z,Q){return`rtok_${Nw4("sha256",ww0()).update(`${$}:${Z}:${Q.toISOString()}`).digest("base64url")}`}function OH$($,Z,Q,X){let Y=Buffer.from($),G=Buffer.from(Er0(Z,Q,X));return Y.length===G.length&&Bw4(Y,G)}var jr0=D(()=>{Co0()});import{createHash as Ow4}from"crypto";function xt($,Z){if($.status===null||DH$.has($.status))return!1;return!Vt({updated_at:$.lastActiveAt,last_progress_at:null},Z)}function Dw4($,Z){return $.threads.some((Q)=>!kK.some((X)=>TO(Q.title,X))&&xt(Q,Z))}function Ew4($,Z){return Z-$>=Lw4}function jw4($,Z,Q,X){if($||Z!==!1)return!1;return Ew4(Q,X)}async function pw0($,Z,Q){let X=await $.storage.organizationSettings.get(Z.organizationId),Y=oH(X?.flags);if(Y.length===0)return;if(Dw4(Z,Date.now()))return;let G=QX(X?.flags,"cheap_reviewer_model")?"reviewer":"default",J=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId),W=Z.reviewCycleStartedAt,K=rH(J,W),F=new Date(K),H=RO(J,{cycleStartedAt:W});await Promise.all(Y.map(async(U)=>{let N=H.has(U);if(!N){let O=Iw4(J,K),w=qw4(Z,U,K,O);if(w){await Sw4($,Z,U,w).catch((L)=>console.error(`[task-board] ${U} verdict nudge failed`,L));return}if(kw4(O,Date.now()))return}if(Tw4(Z,U,K,Date.now(),N)){await sK($,Z,`${VK[U]} failed ${zr0} times on `+"this review \u2014 it will not be retried");return}if(Q?.previewMatchesHead===!1){if(jw4(N,Q.previewMatchesHead,K,Date.now()))await sK($,Z,"the pull request's deploy preview is not showing its latest commit (its checks never went green), so the Reviewer cannot verify this change against what the PR actually does");return}if(Rw4(Z,U,K,Date.now(),N))return;let B=zw4(Z,U,K,Date.now(),N);await vw4($,Z,U,F,B,G).catch((O)=>console.error(`[task-board] ${U} reviewer enqueue failed`,O))}))}function zw4($,Z,Q,X=Date.now(),Y=!0){return $.threads.filter((G)=>TO(G.title,Z)&&Pr0(G,X,Y)&&new Date(G.createdAt).getTime()>=Q).length}function Pw4($,Z){if(!$||!Z||!("choices"in Z))return null;return Z.choices.find((Q)=>Q.repo===$)?.connectionId??null}function Aw4($,Z,Q){let X=$.threads.filter((Y)=>TO(Y.title,Z)&&Y.status==="completed"&&new Date(Y.createdAt).getTime()<Q).map((Y)=>new Date(Y.lastActiveAt).getTime()).filter((Y)=>Number.isFinite(Y));return X.length===0?0:Math.max(...X)}function Pr0($,Z,Q=!0){if($.status==="failed")return!0;if($.status!==null&&DH$.has($.status))return!Q;return $.status!==null&&!xt($,Z)}function wH$($,Z,Q,X=Date.now()){return $.threads.filter((Y)=>{if(!TO(Y.title,Z))return!1;return xt(Y,X)||new Date(Y.createdAt).getTime()>=Q})}function Tw4($,Z,Q,X=Date.now(),Y=!0){let G=wH$($,Z,Q,X);return G.length>0&&G.every((J)=>Pr0(J,X,Y))&&G.length>=zr0}function Rw4($,Z,Q,X=Date.now(),Y=!0){let G=wH$($,Z,Q,X);if(G.length===0)return!1;if(G.some((W)=>xt(W,X)))return!0;let J=G.filter((W)=>Pr0(W,X,Y));if(J.length>=zr0)return!0;return J.length!==G.length}function qw4($,Z,Q,X,Y=Date.now()){return $.threads.find((G)=>TO(G.title,Z)&&G.status==="completed"&&!xt(G,Y)&&new Date(G.createdAt).getTime()>=Q&&!X.has(G.threadId))??null}function Iw4($,Z){let Q=new Map;for(let X of $){if(X.action!=="review_verdict_requested")continue;let Y=new Date(X.occurredAt).getTime();if(Y<Z)continue;let G=X.data?.threadId;if(typeof G==="string")Q.set(G,Y)}return Q}function kw4($,Z){for(let Q of $.values())if(Z-Q<Mw4)return!0;return!1}function Vw4($){return[`Your ${VK[$]} run ended without recording a decision, so the task is stuck: nothing ships and nobody is told why. A review that reaches no verdict is not a review.`,"","Do exactly ONE thing in this run and then stop:","- Call `TASK_BOARD_REVIEW_DECISION` now, with the verdict your review already reached and notes that say what you checked.","- Approve ONLY if you actually exercised the change and it holds. If you could not finish \u2014 a check never came back, a preview never rendered, you ran out of room \u2014 `request_changes` and say exactly what is unresolved. That hands the card to a person, which is the correct outcome for an unfinished review.","- Do NOT re-run the review, do NOT change any code, and do NOT wait on any background task: whatever you know right now is the verdict."].join(`
 `)}async function Sw4($,Z,Q,X){let Y=await $.storage.threads.get(X.threadId);if(!Y||Y.message_storage_version!==2)return;await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"review_verdict_requested",actorId:null,data:{reviewer:Q,threadId:X.threadId}}),console.warn(`[task-board] ${Q} reviewer on ${Z.id} completed with no verdict \u2014 `+"asking for one"),await yg($,Z,Y,{messageId:`review-verdict-${X.threadId}`,prompt:Vw4(Q),workflowID:`review-verdict:${X.threadId}`,runClass:"reviewer"})}function Cw4($,Z,Q,X){return`review:${$}:${Z}:${Q.toISOString()}:${X}`}function _w4($){return`thrd_${Ow4("sha256").update($).digest("hex").slice(0,32)}`}async function vw4($,Z,Q,X,Y,G){let J=Z.organizationId,W=Er0(Z.id,Q,X),K=await iw0($,J),F=K&&"repo"in K?K.repo:null,H=K!==null,U=Aw4(Z,Q,X.getTime()),N=Pw4(Z.repo,K),B=H?"mcp__studio__TASK_BOARD_ITEM_PRS_GET":"TASK_BOARD_ITEM_PRS_GET",O=H?"mcp__studio__TASK_BOARD_REVIEW_DECISION":"TASK_BOARD_REVIEW_DECISION",w=H?"mcp__studio__TASK_BOARD_COMMENT_CREATE":"TASK_BOARD_COMMENT_CREATE",L=H?"mcp__studio__TASK_BOARD_COMMENT_LIST":"TASK_BOARD_COMMENT_LIST",E=[ww4[Q],"","You are running AUTONOMOUSLY \u2014 no human is watching this run. Making the "+'approve / request-changes call IS your job; you are the decision-maker, not an assistant asking a human to decide. NEVER use `user_ask` to ask whether to approve, or to confirm an obvious call ("Approve the PR?"). Reserve `user_ask` for a genuine, unresolvable blocker only a human can clear (e.g. a missing credential, or a requirement so ambiguous you '+"truly cannot judge the outcome) \u2014 that should be rare. When in doubt "+"between asking and deciding, DECIDE.","","Do NOT merge the pull request \u2014 the board does that itself once your "+"approval is in. Pushing fixes to the PR's own branch is expected of you; opening a second pull request, force-pushing, or touching any other ref is not."].join(`
 `),j=Z.description&&H?dw0(Z.description):Z.description,z=Z.description&&j?mw0(Z.description,j):null,P=[...H?[]:[E,""],`Task title: ${Z.title}`,j?`
@@ -2914,7 +2914,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${G.join(`
 `)}`:Y}function ZO6($){let Z=new Set;for(let Q of $)for(let X of Q.split(`
 `)){let Y=X.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var nd$=200,iB6=12,nB6,oB6=300,IQ1=3;var MQ1=D(()=>{Qw();Q20();nB6={aheadBy:0,behindBy:0,files:[]}});function XO6($){if(!$||$.includes(".."))return!1;return QO6.test($)}function od$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!XO6(Z))return null;let{__resolveType:Q,...X}=$;return{resolveType:Z,payload:X}}function rd$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var QO6;var sd$=D(()=>{QO6=/^[\w./@-]+$/});function ta($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function ad$($,Z,Q,X){if(!X.connectionId)throw new iv("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new iv(H9);await lO({ctx:$,connectionId:X.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(H)=>{let U=H instanceof Error?H.message:H9;throw new iv(U)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await uK(X.connectionId,X.owner,X.name,$.db,$.vault).catch((H)=>{let{code:U,message:N}=c9$(H instanceof Error?H.message:String(H));throw U?new iv(N):H}),K=El($),F=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!F.ok){let H=await uO(F,YO6).catch(()=>F.statusText);throw Error(`Failed to refresh sandbox git credentials (${F.status}): ${H}`)}}var YO6=10485760,iv;var kQ1=D(()=>{HJ();iT0();yn();Ep0();Kg();iv=class iv extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function JO6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!GO6.test(Z))throw Error(`Invalid branch name: ${$}`)}function pv($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(KO6)])}async function HO6($,Z){let Q=$.var.studioContext,X=WJ(Z.branch),Y=$.req.query("thread")??X,G=Y&&Y===X?Z.branchThread:Y?await Q.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=cC(J?.metadata?.runtime);if(W)return W;let K=CD0(Z.virtualMcpMetadata),F=K==="cms"?await KQ1(Q,{claimName:Z.claimName}):"alive",H=K==="cms"&&F!=="alive"?"cms":"sandbox",U=!!J&&(F==="gone"||F==="alive"&&K==="cms");if(U&&J)Nt(Q,J.id,H);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:F,resolved:H,stamped:U});return H}async function UO6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await HX($.var.studioContext)}catch{return null}}function nv($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Tl($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),X=$.var.studioContext,Y=ta(Z,Q);if(!Y)throw new m4(404,"AUTH","repo","Project has no GitHub repository");let G=t(X);return pT0(X,G.id,Y)}function VQ1($,Z){if(Z instanceof tA0)return $.json({error:Z.message},429,{...q5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof m4){let X=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},X,q5)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},502,q5)}async function Zm$($,Z,Q){let X;try{X=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await X.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:X.status,headers:{"content-type":X.headers.get("content-type")??"application/json"}})}async function Qm$($){try{let Z=await Tl($),Q=await X20(Z,$.get("vmClaim").branch);return $.json(Q,200,q5)}catch(Z){return VQ1($,Z)}}function oa($,Z){let X=(J20.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=X.catch(()=>{});return J20.set($,Y),Y.finally(()=>{if(J20.get($)===Y)J20.delete($)}),X}async function eZ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,q5);let X=Q?.runner??nv($);if(X instanceof Response)return X;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=Q?.method??"POST",K=null,F=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,F.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),F.set("content-type","application/json");let H=Q?.signal,U={method:W,headers:F,body:K,...H?{signal:H}:{}},N=async()=>{let B=await X.proxyDaemonRequest(Y,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await X.adoptLiveClaim({userId:G,projectRef:J},Y))B=await X.proxyDaemonRequest(Y,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...q5}})}}let O=await B.text(),w=Q?.redactRepoDir?NO6(O):O,L=B.headers.get("content-type")??"application/json";return new Response(w,{status:B.status,headers:{"content-type":L,...q5}})};try{if(H){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((w,L)=>{if(H.aborted)return L(H.reason);H.addEventListener("abort",()=>L(H.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function NO6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function W20($,Z,Q,X="GET",Y){let G=await $.proxyDaemonRequest(Z,Q,{method:X,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(Y,Z))G=await $.proxyDaemonRequest(Z,Q,{method:X,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function BO6($){return Xm$.includes($)}var GO6,ed$=524288,WO6=65536,KO6=1e4,$m$=2000,FO6,J20,q5,Xm$,Ym$=()=>{let $=new Y1;$.use("/:virtualMcpId/:branch/*",FO6),$.post("/:virtualMcpId/:branch/write",(Q)=>eZ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>eZ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>eZ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>eZ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>eZ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>eZ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>eZ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:pv(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let X=Q.req.param("script");if(!X)return Q.json({error:"missing script name"},400);return eZ(Q,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let X=Q.req.param("script");if(!X)return Q.json({error:"missing script name"},400);return eZ(Q,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>eZ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>eZ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let X=Q.req.param("step");if(!X||!BO6(X))return Q.json({error:`step must be one of: ${Xm$.join(", ")}`},400);let Y=Q.get("vmClaim"),G=await KQ1(Q.var.studioContext,{claimName:Y.claimName})==="gone"?null:await UO6(Q);if(!G)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,q5);if(X==="start"){let J=t(Q.var.studioContext),W=Jg(Y.virtualMcpMetadata);try{await r70({ctx:Q.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:W})}catch(K){let F=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${F}`},502)}}return eZ(Q,`/_sandbox/setup/${X}`,{signal:Q.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let X=Q.get("vmClaim");if(!X.runner)return YN(Q,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Yd$(Q,{ctx:Q.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Qm$(Q);return Z(Q)});let Z=(Q)=>eZ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout($m$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Qm$(Q);return eZ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout($m$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")try{let Y=await Q.req.json().catch(()=>({})),G=await Tl(Q),J=await Y20(G,X.branch,Y.base);return Q.json(J,200,q5)}catch(Y){return VQ1(Q,Y)}return eZ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,q5);let X=nv(Q);if(X instanceof Response)return X;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=Q.get("vmClaim"),W=Q.var.studioContext;return oa(Y,async()=>{try{await FQ1(W,X,Y);let K=ta(G,J);if(K)await ad$(W,X,Y,K)}catch(K){if(K instanceof iv)return Q.json({error:K.message},403,q5);let F=K instanceof Error?K.message:String(K);return Q.json({error:F},502,q5)}return eZ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")return oa(X.claimName,async()=>{let Y=await Q.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return Q.json({error:"filepaths is required"},400,q5);try{let J=await Tl(Q);return await td$(J,X.branch,G),Q.json({ok:!0},200,q5)}catch(J){let W=J instanceof m4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return Q.json({error:K},W,q5)}});return oa(X.claimName,()=>eZ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let X=Q.get("vmClaim");if(X.runtime==="cms")return oa(X.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Tl(Q),F=W.base??await K.getDefaultBranch();return await G20(K,X.branch,F),Q.json({ok:!0},200,q5)}catch(W){return VQ1(Q,W)}});let Y=nv(Q);if(Y instanceof Response)return Y;let{claimName:G}=Q.get("vmClaim"),J=Q.var.studioContext;return oa(G,async()=>{try{await FQ1(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,q5)}return eZ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",s5({maxSize:ed$,onError:(Q)=>Q.json({error:"Payload too large"},413,q5)}),async(Q)=>{let X=Q.get("vmClaim"),Y=null;if(X.runtime!=="cms"){let F=nv(Q);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=X,K=Q.var.studioContext;try{let F=await Q.req.json().catch(()=>({})),H=F.status,U=F.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=NQ1(H)&&N?[H,U]:Y?await Promise.all([W20(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),W20(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Tl(Q);return Promise.all([X20(L,X.branch),Y20(L,X.branch)])})(),w=await Fd$(K,B,O);return Q.json(w,200,q5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,q5);return Q.json({error:H},502,q5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",s5({maxSize:ed$,onError:(Q)=>Q.json({error:"Payload too large"},413,q5)}),async(Q)=>{let X=Q.get("vmClaim"),Y=null;if(X.runtime!=="cms"){let F=nv(Q);if(F instanceof Response)return F;Y=F}let{claimName:G,userId:J,projectRef:W}=X,K=Q.var.studioContext;try{let F=await Q.req.json().catch(()=>({})),H=F.status,U=F.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=NQ1(H)&&N?[H,U]:Y?await Promise.all([W20(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),W20(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Tl(Q);return Promise.all([X20(L,X.branch),Y20(L,X.branch)])})(),w=await Ud$(K,B,O,typeof F.language==="string"?F.language:void 0);return Q.json(w,200,q5)}catch(F){let H=F instanceof Error?F.message:String(F);if(H==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,q5);return Q.json({error:H},502,q5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let X=nv(Q);if(X instanceof Response)return X;let{claimName:Y}=Q.get("vmClaim"),G=Q.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Q.json({error:"Path not allowed"},403);let J;try{J=await X.getPreviewUrl(Y)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,"");return Zm$(Q,`${W}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",s5({maxSize:WO6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let X=nv(Q);if(X instanceof Response)return X;let{claimName:Y}=Q.get("vmClaim"),G;try{G=await X.getPreviewUrl(Y)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let J;try{J=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return Q.json({error:"Invalid JSON body"},400);let W=od$(J);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=rd$(G,W.resolveType);return Zm$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var Gm$=D(()=>{h$();_F();Ll();WQ1();Cn();Zd$();KJ();qg();Qd$();e3();Xd$();Gd$();Dp0();bn();DQ1();Nd$();LQ1();Qw();MQ1();sd$();kQ1();GO6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;FO6=mT0(async($,Z)=>{let Q=$.var.studioContext;try{o(Q)}catch{return $.json({error:"Unauthorized"},401)}let X=t0(Q);if(!X)return $.json({error:"Unauthorized"},401);let Y;try{Y=t(Q)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{JO6(J)}catch(w){let L=w instanceof Error?w.message:String(w);return $.json({error:L},400)}let W=await Q.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Vn({orgId:Y.id,virtualMcpId:G,branch:J}),F=await Fp0(Q,J),H=Hp0(F,X),U=$d$({userId:H,projectRef:K}),N=W.metadata??null,B=await HO6($,{claimName:U,branch:J,virtualMcpId:G,sandboxUserId:H,virtualMcpMetadata:N,branchThread:F});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:X,runner:null,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((w)=>w.connection_id)??[],runtime:B}),Z();let O;try{O=await HX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:X,runner:O,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((w)=>w.connection_id)??[],runtime:B}),Z()});J20=new Map;q5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Xm$=["clone","install","start"]});function Jm$($,Z,Q){let X=SQ1.get($);if(!X)X={pending:null,running:!1},SQ1.set($,X);if(!X.pending)X.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=X.pending;Y.deps=Z;for(let[J,W]of Object.entries(Q.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of Q.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!X.running)DO6($,X);return G}async function DO6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let X=await wO6(Q);for(let Y of Q.resolvers)Y(X)}catch(X){for(let Y of Q.rejecters)Y(X)}}}finally{if(Z.running=!1,!Z.pending)SQ1.delete($)}}async function wO6($){let{client:Z,branch:Q,packagePath:X}=$.deps;for(let Y=0;;Y++){let G=await Al(Z,Q),J=await Z.getCommitTreeSha(G),W=await Z.getDecofileTree(J,X),K=RQ1(W,X),F=[],H=new Map(K.map((O)=>[O.path,{stem:O.stem,sha:O.sha}]));for(let[O,w]of $.set){let L=qQ1(K,O),E=`${JSON.stringify(w,null,2)}
-`,j=await Z.createBlob(E);await md$(Z.owner,Z.repo,j,E);let z=L[0]??`${Z20(X)}/${jQ1(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let P=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:P,sha:j,content:E});for(let A of L.slice(1))F.push({path:A,mode:"100644",type:"blob",sha:null}),H.delete(A)}for(let O of $.del)for(let w of qQ1(K,O))F.push({path:w,mode:"100644",type:"blob",sha:null}),H.delete(w);if(F.length===0)return G;let U=X?`${X}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===U)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:w,skipped:L}=ma(O);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:Q,packagePath:X,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(w);F.push({path:U,mode:"100644",type:"blob",sha:E})}let N=await Z.createTree(J,F),B=await Z.createCommit({message:LO6($),treeSha:N,parentShas:[G]});try{return await Z.updateRef(Q,B),B}catch(O){if(!(O instanceof m4&&O.status===422)||Y>=OO6-1)throw O;await E$(Q7(2000,200,Y,2,0.5))}}}function LO6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let X=`chore(decofile): ${Q.join("; ")}`;return ei0(X,$.deps.coAuthor)}var OO6=3,SQ1;var Wm$=D(()=>{i70();tT0();s8();Qw();Q20();SQ1=new Map});import{createHmac as Km$,randomBytes as EO6,timingSafeEqual as jO6}from"crypto";function Fm$(){if(K20)return K20;let $;try{let Z=k0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return K20=$?Buffer.from($):EO6(32),K20}function CQ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+zO6)/1000)},X=Buffer.from(JSON.stringify(Q)).toString("base64url"),Y=Km$("sha256",Fm$()).update(X).digest("base64url");return`${X}.${Y}`}function Hm$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let X=$.slice(0,Q),Y=Buffer.from($.slice(Q+1)),G=Buffer.from(Km$("sha256",Fm$()).update(X).digest("base64url"));if(Y.length!==G.length||!jO6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(X,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var zO6=21600000,K20=null;var Um$=D(()=>{w$()});import{z as Rl}from"zod";function AO6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&PO6.test($)}function wm$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function ra($){let Z=$.get("decofileScope");return pT0($.var.studioContext,Z.organizationId,Z.githubRepo)}function sa($,Z){if(Z instanceof m4){let X=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},X)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},500)}function Lm$(){let $=new Y1;return $.use("/:virtualMcpId/:branch",Dm$),$.use("/:virtualMcpId/:branch/*",Dm$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await id$(X,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=CQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(wm$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(X){return sa(Z,X)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),X=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await ra(Z),G=await Y.getFileTextAtRef(Q.branch,X);if(G===null){let J=await Y.getDefaultBranch();if(J!==Q.branch)G=await Y.getFileTextAtRef(J,X)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return sa(Z,Y)}}),$.patch("/:virtualMcpId/:branch",RO6,async(Z)=>{let Q=Z.get("decofileScope"),X=Z.var.studioContext,Y=qO6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{nT0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(EQ1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await ra(Z),W=await Jm$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:El(X)},G),K=CQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:wm$(Z)})}catch(J){return sa(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await X.mergeBranch(Y,Q.branch,G)}catch(W){if(!(W instanceof m4&&W.status===409))throw W;await G20(X,Q.branch,Y),J=await X.mergeBranch(Y,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof m4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof m4&&J.status===405){let K=await X.findOpenPullRequest(Y,Q.branch)??await X.createPullRequest({base:Y,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(X){return sa(Z,X)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([X.compare(Y,Q.branch),X.getBranchHead(Q.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof m4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(X){return sa(Z,X)}}),$}var PO6,Nm$=500,Bm$=1048576,Om$=1024,TO6=8388608,RO6,qO6,Dm$;var Em$=D(()=>{gt0();tT0();h$();_F();WQ1();iT0();kQ1();LQ1();Wm$();Um$();MQ1();Qw();Q20();PO6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;RO6=s5({maxSize:TO6,onError:($)=>$.json({error:"Payload too large"},413)}),qO6=Rl.object({set:Rl.record(Rl.string(),Rl.unknown()).optional(),delete:Rl.array(Rl.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=Nm$,{message:`Patch cannot touch more than ${Nm$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=Bm$),{message:`Each block must be at most ${Bm$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=Om$),{message:`Each block key must be at most ${Om$} characters`}),Dm$=mT0(async($,Z)=>{let Q=$.var.studioContext,X=Q.organization;if(!X)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!AO6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Hm$(B,{organizationId:X.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!SD0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],U=ta(K,H);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:X.id,virtualMcpId:Y,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var jm$=($)=>{let Z=new Y1;if(Z.use("*",Cv),Z.use("*",Fh$),Z.route("/",YT0()),Z.route("/",vh$()),Z.route("/",lc$()),Z.route("/",gc$()),Z.route("/",lT0()),Z.route("/tools",tc$()),Z.route("/",ic$()),Z.route("/",Dc$({kvStorage:$.kvStorage})),Z.route("/",Bc$()),Z.route("/fs",Vc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ym$()),Z.route("/decofile",Lm$()),Z.route("/",bc$()),Z.route("/",Cc$()),Z.route("/deco-sites",JT0()),Z.route("/hosting",Ah$()),Z.route("/monitor",Vh$()),Z.route("/sso",aA0()),Z.route("/",cT0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Lh$()),$.mountDevAssets)Z.route("/dev-assets",HT0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",xx$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",vc$()),Z.route("/mcp",WE0()),Z.route("/mcp/self",uT0()),Z.route("/mcp",HE0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var zm$=D(()=>{h$();Hh$();pA0();Eh$();CZ1();Th$();Sh$();UT0();wa();IZ1();Oc$();wc$();Sc$();_c$();jo();zZ1();UE0();$Q1();fc$();xc$();hc$();cc$();pc$();QQ1();oc$();XQ1();KE0();Gm$();Em$()});function IO6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var MO6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Pm$=()=>{let $=new Y1;return $.use("*",MO6),$.get("/",async(Z)=>{let Q=k0(),X=Q.decoSupabaseUrl,Y=Q.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let G=await zY(X,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:IO6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Am$=D(()=>{h$();w$();ZA0()});import{z as q1}from"zod";function gF($,Z="invalid_request_error",Q=null,X=null){return{error:{message:$,type:Z,param:Q,code:X}}}function yO6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),X=$.substring(Z+1);if(!Q||!X)return null;return{credentialId:Q,modelId:X}}function gO6($,Z,Q){try{return JSON.parse($)}catch{throw new qm$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function hO6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let X of Q.tool_calls)Z[X.id]=X.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:gO6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let X=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:X,output:{type:"text",value:Q.content}}]}}})}function uO6($){let Z=$.map((Q)=>{let X=Q.function.parameters?aY(Q.function.parameters):aY({type:"object",properties:{}});return[Q.function.name,Q$({description:Q.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function lO6($){if(!$)return;return{openai:{response_format:$}}}function cO6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Tm$($,Z,Q,X,Y,G){let J={model:$,messages:Z,tools:Q,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Rm$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var kO6=256,VO6,SO6,CO6,_O6,vO6,fO6,bO6,xO6,qm$,Im$,Mm$;var km$=D(()=>{M4();h$();Ll();xU();VO6=q1.object({type:q1.literal("function"),function:q1.object({name:q1.string(),description:q1.string().optional(),parameters:q1.record(q1.string(),q1.unknown()).optional()})}),SO6=q1.object({id:q1.string(),type:q1.literal("function"),function:q1.object({name:q1.string(),arguments:q1.string()})}),CO6=q1.discriminatedUnion("role",[q1.object({role:q1.literal("system"),content:q1.string(),name:q1.string().optional()}),q1.object({role:q1.literal("user"),content:q1.union([q1.string(),q1.array(q1.union([q1.object({type:q1.literal("text"),text:q1.string()}),q1.object({type:q1.literal("image_url"),image_url:q1.object({url:q1.string(),detail:q1.string().optional()})})]))]),name:q1.string().optional()}),q1.object({role:q1.literal("assistant"),content:q1.string().nullable().optional(),name:q1.string().optional(),tool_calls:q1.array(SO6).optional()}),q1.object({role:q1.literal("tool"),content:q1.string(),tool_call_id:q1.string()})]),_O6=q1.object({type:q1.literal("text")}),vO6=q1.object({type:q1.literal("json_object")}),fO6=q1.object({type:q1.literal("json_schema"),json_schema:q1.object({name:q1.string(),description:q1.string().optional(),schema:q1.record(q1.string(),q1.unknown()),strict:q1.boolean().optional()})}),bO6=q1.union([_O6,vO6,fO6]),xO6=q1.object({model:q1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:q1.array(CO6),stream:q1.boolean().optional().default(!1),temperature:q1.number().min(0).max(2).optional(),max_tokens:q1.number().positive().optional(),top_p:q1.number().min(0).max(1).optional(),frequency_penalty:q1.number().min(-2).max(2).optional(),presence_penalty:q1.number().min(-2).max(2).optional(),stop:q1.union([q1.string(),q1.array(q1.string())]).optional(),tools:q1.array(VO6).optional(),tool_choice:q1.union([q1.literal("auto"),q1.literal("none"),q1.literal("required"),q1.object({type:q1.literal("function"),function:q1.object({name:q1.string()})})]).optional(),response_format:bO6.optional(),user:q1.string().optional()});qm$=class qm$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Im$=new Y1;Im$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(gF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(gF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(gF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=xO6.safeParse(X);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(gF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=yO6(G.model);if(!J)return $.json(gF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>EL(j.providerId));if(!E)return $.json(gF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(gF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),U=hO6(G.messages),N=G.tools?uO6(G.tools):void 0,B=lO6(G.response_format),O=cO6(),w=Math.floor(Date.now()/1000);if(G.stream)return YN($,async(L)=>{let E=Tm$(H,U,N,G,B,$.req.raw.signal);try{let j=xO(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=kO6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{},finish_reason:Rm$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Tm$(H,U,N,G,B,$.req.raw.signal),E=await fO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:w,model:G.model,choices:[{index:0,message:j,finish_reason:Rm$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(gF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(gF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(gF(Y.message,"server_error"),500)}});Mm$=Im$});function dO6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Vm$(){let $=new Y1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),X=t0(Q);if(!X)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!eQ(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",X).execute(),W=[];for(let F of J){if(!F.slug||m9(F))continue;let H=await Q.storage.virtualMcps.list(F.id);for(let U of H){if(L0$(U)!==G)continue;if(!dO6(U.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Sm$=D(()=>{h$();iH()});var _m$;var Cm$=D(()=>{_m$={name:"decocms",version:"4.333.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function pO6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??iO6}}var vm$,iO6="https://ph.studio.decocms.com",fm$;var bm$=D(()=>{h$();T90();D_();h5();w$();KZ1();Cm$();vm$=new Y1;vm$.get("/",($)=>{let Z={version:_m$.version,theme:lp1(),...hH().logo&&{logo:hH().logo},...TU()&&{internalUrl:Hv1()},...k0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!k0().firecrawlApiKey,hostingEnabled:!!k0().controlplaneRestUrl&&!!k0().controlplaneServiceToken,hostingControlPlaneGa:k0().hostingControlPlaneGa,monitorEnabled:!!k0().clickhouseAnalyticsUrl&&!!k0().clickhouseAnalyticsPassword,monitorGa:k0().monitorGa,auth:Eg$(),posthog:pO6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:Ge()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});fm$=vm$});function ql($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _Q1($){return(ql($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ym$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ql($))}&sz=${Z}`}function xm$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let X=Q.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function gm$($){let{brand:Z,domain:Q,score:X,verdict:Y}=$,G=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?xm$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):xm$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var tv,nO6,tO6,oO6,rO6,hm$;var um$=D(()=>{tv=c0.enum(["good","bad","neutral"]),nO6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:tv.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),tO6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(nO6)),oO6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},rO6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:tv.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:tv.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:tv.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:tv.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(tO6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:tv.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:tv.optional()})).min(1)})]),hm$=c0.object({...oO6,template:rO6})});function F20($){let Z=[],Q=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=hm$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),X=Q.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:X},slides:Q},drops:Z}}var vQ1=D(()=>{um$()});import{join as lm$}from"path";async function aO6($){try{let Z=await fetch(`${jK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(sO6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:X}=F20(Q);if(!X.slides.length)return null;let Y=X.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:X.meta.brand?.trim()||_Q1($),score:X.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function TG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function eO6($,Z){let Q=ql($),X=Z?.brand?.trim()||_Q1(Q),Y=ym$(Q,128),J=`${(k0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=gm$({brand:X,domain:Q,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${X} commerce report by decocms`;return[`<title>${TG(W)}</title>`,`<meta name="description" content="${TG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${TG(W)}" />`,`<meta property="og:description" content="${TG(K)}" />`,`<meta property="og:url" content="${TG(J)}" />`,`<meta property="og:image" content="${TG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${TG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${TG(W)}" />`,`<meta name="twitter:description" content="${TG(K)}" />`,`<meta name="twitter:image" content="${TG(F)}" />`,`<meta name="twitter:image:alt" content="${TG(H)}" />`,`<link rel="canonical" href="${TG(J)}" />`,`<link rel="icon" href="${TG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await md$(Z.owner,Z.repo,j,E);let z=L[0]??`${Z20(X)}/${jQ1(O)}.json`;F.push({path:z,mode:"100644",type:"blob",sha:j});let P=z.slice(z.lastIndexOf("/")+1,-5);H.set(z,{stem:P,sha:j,content:E});for(let A of L.slice(1))F.push({path:A,mode:"100644",type:"blob",sha:null}),H.delete(A)}for(let O of $.del)for(let w of qQ1(K,O))F.push({path:w,mode:"100644",type:"blob",sha:null}),H.delete(w);if(F.length===0)return G;let U=X?`${X}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((O)=>O.type==="blob"&&O.path===U)){let O=await Promise.all([...H.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:w,skipped:L}=ma(O);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:Q,packagePath:X,blocks:L.map((j)=>j.key)});let E=await Z.createBlob(w);F.push({path:U,mode:"100644",type:"blob",sha:E})}let N=await Z.createTree(J,F),B=await Z.createCommit({message:LO6($),treeSha:N,parentShas:[G]});try{return await Z.updateRef(Q,B),B}catch(O){if(!(O instanceof m4&&O.status===422)||Y>=OO6-1)throw O;await E$(Q7(2000,200,Y,2,0.5))}}}function LO6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let X=`chore(decofile): ${Q.join("; ")}`;return ei0(X,$.deps.coAuthor)}var OO6=3,SQ1;var Wm$=D(()=>{i70();tT0();s8();Qw();Q20();SQ1=new Map});import{createHmac as Km$,randomBytes as EO6,timingSafeEqual as jO6}from"crypto";function Fm$(){if(K20)return K20;let $;try{let Z=k0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return K20=$?Buffer.from($):EO6(32),K20}function CQ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+zO6)/1000)},X=Buffer.from(JSON.stringify(Q)).toString("base64url"),Y=Km$("sha256",Fm$()).update(X).digest("base64url");return`${X}.${Y}`}function Hm$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let X=$.slice(0,Q),Y=Buffer.from($.slice(Q+1)),G=Buffer.from(Km$("sha256",Fm$()).update(X).digest("base64url"));if(Y.length!==G.length||!jO6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(X,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var zO6=21600000,K20=null;var Um$=D(()=>{w$()});import{z as Rl}from"zod";function AO6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&PO6.test($)}function wm$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function ra($){let Z=$.get("decofileScope");return pT0($.var.studioContext,Z.organizationId,Z.githubRepo)}function sa($,Z){if(Z instanceof m4){let X=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},X)}let Q=Z instanceof Error?Z.message:String(Z);return $.json({error:Q},500)}function Lm$(){let $=new Y1;return $.use("/:virtualMcpId/:branch",Dm$),$.use("/:virtualMcpId/:branch/*",Dm$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await id$(X,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=CQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(wm$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(X){return sa(Z,X)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),X=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let Y=await ra(Z),G=await Y.getFileTextAtRef(Q.branch,X);if(G===null){let J=await Y.getDefaultBranch();if(J!==Q.branch)G=await Y.getFileTextAtRef(J,X)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(Y){return sa(Z,Y)}}),$.patch("/:virtualMcpId/:branch",RO6,async(Z)=>{let Q=Z.get("decofileScope"),X=Z.var.studioContext,Y=qO6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{nT0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(EQ1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await ra(Z),W=await Jm$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:El(X)},G),K=CQ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:wm$(Z)})}catch(J){return sa(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await X.mergeBranch(Y,Q.branch,G)}catch(W){if(!(W instanceof m4&&W.status===409))throw W;await G20(X,Q.branch,Y),J=await X.mergeBranch(Y,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof m4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof m4&&J.status===405){let K=await X.findOpenPullRequest(Y,Q.branch)??await X.createPullRequest({base:Y,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(X){return sa(Z,X)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let X=await ra(Z),Y=await X.getDefaultBranch();if(Y===Q.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([X.compare(Y,Q.branch),X.getBranchHead(Q.branch)]);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J,lastCommitAt:W.committedAt})}catch(G){if(G instanceof m4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(X){return sa(Z,X)}}),$}var PO6,Nm$=500,Bm$=1048576,Om$=1024,TO6=8388608,RO6,qO6,Dm$;var Em$=D(()=>{gt0();tT0();h$();_F();WQ1();iT0();kQ1();LQ1();Wm$();Um$();MQ1();Qw();Q20();PO6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;RO6=s5({maxSize:TO6,onError:($)=>$.json({error:"Payload too large"},413)}),qO6=Rl.object({set:Rl.record(Rl.string(),Rl.unknown()).optional(),delete:Rl.array(Rl.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=Nm$,{message:`Patch cannot touch more than ${Nm$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=Bm$),{message:`Each block must be at most ${Bm$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=Om$),{message:`Each block key must be at most ${Om$} characters`}),Dm$=mT0(async($,Z)=>{let Q=$.var.studioContext,X=Q.organization;if(!X)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!AO6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Hm$(B,{organizationId:X.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!SD0(K))return $.json({error:"Project has no preview server configured"},404);let H=W.connections?.map((B)=>B.connection_id)??[],U=ta(K,H);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:X.id,virtualMcpId:Y,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var jm$=($)=>{let Z=new Y1;if(Z.use("*",Cv),Z.use("*",Fh$),Z.route("/",YT0()),Z.route("/",vh$()),Z.route("/",lc$()),Z.route("/",gc$()),Z.route("/",lT0()),Z.route("/tools",tc$()),Z.route("/",ic$()),Z.route("/",Dc$({kvStorage:$.kvStorage})),Z.route("/",Bc$()),Z.route("/fs",Vc$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ym$()),Z.route("/decofile",Lm$()),Z.route("/",bc$()),Z.route("/",Cc$()),Z.route("/deco-sites",JT0()),Z.route("/hosting",Ah$()),Z.route("/monitor",Vh$()),Z.route("/sso",aA0()),Z.route("/",cT0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Lh$()),$.mountDevAssets)Z.route("/dev-assets",HT0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",xx$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",vc$()),Z.route("/mcp",WE0()),Z.route("/mcp/self",uT0()),Z.route("/mcp",HE0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var zm$=D(()=>{h$();Hh$();pA0();Eh$();CZ1();Th$();Sh$();UT0();wa();IZ1();Oc$();wc$();Sc$();_c$();jo();zZ1();UE0();$Q1();fc$();xc$();hc$();cc$();pc$();QQ1();oc$();XQ1();KE0();Gm$();Em$()});function IO6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var MO6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Pm$=()=>{let $=new Y1;return $.use("*",MO6),$.get("/",async(Z)=>{let Q=k0(),X=Q.decoSupabaseUrl,Y=Q.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let G=await zY(X,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:IO6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var Am$=D(()=>{h$();w$();ZA0()});import{z as q1}from"zod";function gF($,Z="invalid_request_error",Q=null,X=null){return{error:{message:$,type:Z,param:Q,code:X}}}function yO6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),X=$.substring(Z+1);if(!Q||!X)return null;return{credentialId:Q,modelId:X}}function gO6($,Z,Q){try{return JSON.parse($)}catch{throw new qm$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function hO6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let X of Q.tool_calls)Z[X.id]=X.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:gO6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let X=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:X,output:{type:"text",value:Q.content}}]}}})}function uO6($){let Z=$.map((Q)=>{let X=Q.function.parameters?aY(Q.function.parameters):aY({type:"object",properties:{}});return[Q.function.name,Q$({description:Q.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function lO6($){if(!$)return;return{openai:{response_format:$}}}function cO6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Tm$($,Z,Q,X,Y,G){let J={model:$,messages:Z,tools:Q,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function Rm$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var kO6=256,VO6,SO6,CO6,_O6,vO6,fO6,bO6,xO6,qm$,Im$,Mm$;var km$=D(()=>{M4();h$();Ll();xU();VO6=q1.object({type:q1.literal("function"),function:q1.object({name:q1.string(),description:q1.string().optional(),parameters:q1.record(q1.string(),q1.unknown()).optional()})}),SO6=q1.object({id:q1.string(),type:q1.literal("function"),function:q1.object({name:q1.string(),arguments:q1.string()})}),CO6=q1.discriminatedUnion("role",[q1.object({role:q1.literal("system"),content:q1.string(),name:q1.string().optional()}),q1.object({role:q1.literal("user"),content:q1.union([q1.string(),q1.array(q1.union([q1.object({type:q1.literal("text"),text:q1.string()}),q1.object({type:q1.literal("image_url"),image_url:q1.object({url:q1.string(),detail:q1.string().optional()})})]))]),name:q1.string().optional()}),q1.object({role:q1.literal("assistant"),content:q1.string().nullable().optional(),name:q1.string().optional(),tool_calls:q1.array(SO6).optional()}),q1.object({role:q1.literal("tool"),content:q1.string(),tool_call_id:q1.string()})]),_O6=q1.object({type:q1.literal("text")}),vO6=q1.object({type:q1.literal("json_object")}),fO6=q1.object({type:q1.literal("json_schema"),json_schema:q1.object({name:q1.string(),description:q1.string().optional(),schema:q1.record(q1.string(),q1.unknown()),strict:q1.boolean().optional()})}),bO6=q1.union([_O6,vO6,fO6]),xO6=q1.object({model:q1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:q1.array(CO6),stream:q1.boolean().optional().default(!1),temperature:q1.number().min(0).max(2).optional(),max_tokens:q1.number().positive().optional(),top_p:q1.number().min(0).max(1).optional(),frequency_penalty:q1.number().min(-2).max(2).optional(),presence_penalty:q1.number().min(-2).max(2).optional(),stop:q1.union([q1.string(),q1.array(q1.string())]).optional(),tools:q1.array(VO6).optional(),tool_choice:q1.union([q1.literal("auto"),q1.literal("none"),q1.literal("required"),q1.object({type:q1.literal("function"),function:q1.object({name:q1.string()})})]).optional(),response_format:bO6.optional(),user:q1.string().optional()});qm$=class qm$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Im$=new Y1;Im$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(gF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(gF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(gF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=xO6.safeParse(X);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(gF(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=yO6(G.model);if(!J)return $.json(gF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>EL(j.providerId));if(!E)return $.json(gF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let F;try{F=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(gF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let H=F.aiSdk.languageModel(K),U=hO6(G.messages),N=G.tools?uO6(G.tools):void 0,B=lO6(G.response_format),O=cO6(),w=Math.floor(Date.now()/1000);if(G.stream)return YN($,async(L)=>{let E=Tm$(H,U,N,G,B,$.req.raw.signal);try{let j=xO(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=kO6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:w,model:G.model,choices:[{index:0,delta:{},finish_reason:Rm$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Tm$(H,U,N,G,B,$.req.raw.signal),E=await fO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:w,model:G.model,choices:[{index:0,message:j,finish_reason:Rm$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(gF("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(gF(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(gF(Y.message,"server_error"),500)}});Mm$=Im$});function dO6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Vm$(){let $=new Y1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),X=t0(Q);if(!X)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!eQ(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",X).execute(),W=[];for(let F of J){if(!F.slug||m9(F))continue;let H=await Q.storage.virtualMcps.list(F.id);for(let U of H){if(L0$(U)!==G)continue;if(!dO6(U.metadata))continue;W.push({orgSlug:F.slug,orgName:F.name??F.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Sm$=D(()=>{h$();iH()});var _m$;var Cm$=D(()=>{_m$={name:"decocms",version:"4.334.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function pO6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??iO6}}var vm$,iO6="https://ph.studio.decocms.com",fm$;var bm$=D(()=>{h$();T90();D_();h5();w$();KZ1();Cm$();vm$=new Y1;vm$.get("/",($)=>{let Z={version:_m$.version,theme:lp1(),...hH().logo&&{logo:hH().logo},...TU()&&{internalUrl:Hv1()},...k0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!k0().firecrawlApiKey,hostingEnabled:!!k0().controlplaneRestUrl&&!!k0().controlplaneServiceToken,hostingControlPlaneGa:k0().hostingControlPlaneGa,monitorEnabled:!!k0().clickhouseAnalyticsUrl&&!!k0().clickhouseAnalyticsPassword,monitorGa:k0().monitorGa,auth:Eg$(),posthog:pO6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:Ge()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});fm$=vm$});function ql($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _Q1($){return(ql($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ym$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ql($))}&sz=${Z}`}function xm$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let X=Q.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function gm$($){let{brand:Z,domain:Q,score:X,verdict:Y}=$,G=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?xm$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):xm$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var tv,nO6,tO6,oO6,rO6,hm$;var um$=D(()=>{tv=c0.enum(["good","bad","neutral"]),nO6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:tv.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),tO6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(nO6)),oO6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},rO6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:tv.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:tv.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:tv.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:tv.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(tO6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:tv.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:tv.optional()})).min(1)})]),hm$=c0.object({...oO6,template:rO6})});function F20($){let Z=[],Q=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=hm$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),X=Q.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:X},slides:Q},drops:Z}}var vQ1=D(()=>{um$()});import{join as lm$}from"path";async function aO6($){try{let Z=await fetch(`${jK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(sO6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:X}=F20(Q);if(!X.slides.length)return null;let Y=X.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:X.meta.brand?.trim()||_Q1($),score:X.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function TG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function eO6($,Z){let Q=ql($),X=Z?.brand?.trim()||_Q1(Q),Y=ym$(Q,128),J=`${(k0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=gm$({brand:X,domain:Q,score:Z?.score,verdict:Z?.verdict}),F=`${J}/og.png`,H=`${X} commerce report by decocms`;return[`<title>${TG(W)}</title>`,`<meta name="description" content="${TG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${TG(W)}" />`,`<meta property="og:description" content="${TG(K)}" />`,`<meta property="og:url" content="${TG(J)}" />`,`<meta property="og:image" content="${TG(F)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${TG(H)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${TG(W)}" />`,`<meta name="twitter:description" content="${TG(K)}" />`,`<meta name="twitter:image" content="${TG(F)}" />`,`<meta name="twitter:image:alt" content="${TG(H)}" />`,`<link rel="canonical" href="${TG(J)}" />`,`<link rel="icon" href="${TG(Y)}" sizes="any" />`].join(`
     `)}function $D6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function cm$($){let Z=new Y1;return Z.get("/:domain/og.png",async(Q)=>{let X=ql(Q.req.param("domain")),Y=async()=>{let G=$?Bun.file(lm$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return Q.notFound();return Q.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${jK({})}/api/v2/public/diagnostics/${encodeURIComponent(X)}/og.png`,{signal:AbortSignal.timeout(ZD6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return Q.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(Q)=>{let X=Q.req.param("domain"),Y=$?lm$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return Q.notFound();let J=await G.text();try{let W=await aO6(ql(X)),K=eO6(X,W);return Q.html($D6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(J)}}),Z}var sO6=2500,ZD6=1e4;var dm$=D(()=>{h$();vQ1();TE();w$()});function aa($,Z){return fetch(`${jK({})}${$}`,Z)}async function QD6($,Z,Q){let X=new URLSearchParams;if(Z)X.set("pw",Z);if(Q)X.set("lang",Q);let Y=X.toString()?`?${X.toString()}`:"",G=await aa(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=F20(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var XD6,JN,mm$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},im$;var pm$=D(()=>{h$();tY();TE();vQ1();XD6=new Set(["complete","errored","terminated","unknown"]),JN=new Y1;JN.use("*",async($,Z)=>{let Q=await $8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});JN.use("/link-token/*",mm$);JN.use("/suggest",mm$);JN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),X=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await QD6(Z,X,Y);if($.header("Cache-Control","private, no-store"),Q||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});JN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let X=typeof Q.domain==="string"?Q.domain.trim():"";if(!X)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let J=await aa("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${AE({})}`},body:JSON.stringify({url:X,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});JN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await aa(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${AE({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let Y=(await Q.json()).status??"unknown",G={done:XD6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});JN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await aa(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});JN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await aa(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let X=await Q.json();return $.json({suggestions:Array.isArray(X.suggestions)?X.suggestions:[]})}catch{return $.json({suggestions:[]})}});im$=JN});import{createHmac as YD6,timingSafeEqual as GD6}from"crypto";function tm$($,Z,Q,X=Date.now()){if(!Z||!Q)return!1;let Y,G=[];for(let F of Z.split(",")){let H=F.indexOf("=");if(H<=0)continue;let U=F.slice(0,H).trim(),N=F.slice(H+1).trim();if(U==="t")Y=N;else if(U==="v1")G.push(N)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(X/1000-J)>JD6)return!1;let W=YD6("sha256",Q).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((F)=>{let H=Buffer.from(F,"hex");return K.length===H.length&&GD6(K,H)})}function om$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=iJ(Z),X=iJ(iJ(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!X)return null;return{id:hF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:X}}}function rm$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function hF($){return typeof $==="string"?$:void 0}function iJ($){return typeof $==="object"&&$!==null?$:void 0}function H20($){return typeof $==="number"?new Date($*1000):null}function xQ1($){return hF($)??hF(iJ($)?.id)}function WD6($){return xQ1($.subscription)??hF(iJ(iJ($.parent)?.subscription_details)?.subscription)}function KD6($){let Z=H20($.current_period_end);if(Z)return Z;let Q=iJ($.items)?.data;if(!Array.isArray(Q))return null;let X=0;for(let Y of Q){let G=iJ(Y)?.current_period_end;if(typeof G==="number"&&G>X)X=G}return X>0?new Date(X*1000):null}function fQ1($,Z){let Q=H20($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function bQ1($,Z){let Q=H20($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function FD6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let X=hF(iJ(Q.metadata)?.orgId);if(!X)return{handled:!1,reason:"no orgId"};if(hF(iJ(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(hF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=hF(Q.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:X}),{handled:!1,reason:"topup session without id"};let W=Number(iJ(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:X,creditCents:iJ(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:X,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(hF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(X);if(!Y)return{handled:!1,reason:"unknown org"};let G=xQ1(Q.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:X,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(fQ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X,{stripeCustomerId:xQ1(Q.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:bQ1(Z,Y)}),{handled:!0,organizationId:X}}case"customer.subscription.updated":case"customer.subscription.deleted":{let X=hF(Q.id);if(!X)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(X);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&fQ1(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":rm$(Q.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:KD6(Q),...G&&{stripeSubscriptionId:null},lastStripeEventAt:bQ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let X=WD6(Q);if(!X)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(X);if(!Y)return{handled:!1,reason:"unknown subscription"};if(fQ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:H20(Q.period_end),lastStripeEventAt:bQ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function HD6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:rm$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function nm$($,Z){let Q=HD6($,Z);if(!Q)return;dY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:ot1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function sm$($){let Z=new DK(s$().db),Q=await FD6(Z,$);if(!(Q.handled&&Q.topUp))nm$($,Q);if(Q.handled&&Q.topUp)await Kz$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),nm$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await N1$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(X){if(!(X instanceof oY&&(X.status===400||X.status===404)))throw X}return Q}var JD6=300;var am$=D(()=>{sG();b4();G90();iE();m11()});var UD6=1048576,yQ1;var em$=D(()=>{h$();_F();w$();am$();yQ1=new Y1;yQ1.post("/webhook",s5({maxSize:UD6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=k0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!tm$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=om$(Q);if(!Y)return $.json({error:"invalid payload"},400);let G=await sm$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as ND6}from"crypto";function OD6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let X=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==X.length)return!1;return ND6(Buffer.from(Y),Buffer.from(X))}var BD6=5242880,gQ1;var $i$=D(()=>{h$();_F();e3();gQ1=new Y1;gQ1.post("/webhook",s5({maxSize:BD6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let Q=await $.req.text();if(!OD6(Q,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let X;try{X=JSON.parse(Q)}catch{return $.json({error:"invalid payload"},400)}let Y=X.ref,G=X.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await xt0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function Zi$($){let Z=new tU($.db,new lQ($.encryptionKey)),Q=new Y1;return Q.get("/attachments/:token",async(X)=>{let Y=XF$(X.req.param("token"));if(!Y)return X.json({error:"Invalid or expired link"},404);let G=await Z.getByOrg(Y.organizationId);if(!G)return X.json({error:"Jira is not connected"},404);let W=await new JG(G.siteUrl,G.email,G.apiToken).downloadAttachment(Y.attachmentId);if(!W.ok||!W.body)return X.json({error:"Jira refused the download"},502);let K=new Headers;for(let F of["content-type","content-length","content-disposition"]){let H=W.headers.get(F);if(H)K.set(F,H)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var Qi$=D(()=>{h$();sN();_o0();eC()});function Xi$($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,X=Z.issue?.key,Y=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof X!=="string"||typeof Y!=="string"&&typeof Y!=="number")return null;let G=Z.changelog?.items?.find((J)=>J.field==="status");if(!G||typeof G.toString!=="string")return null;return{issueId:String(Q),issueKey:X,toStatus:G.toString,changelogId:String(Y)}}function Yi$($,Z,Q){let X=[];for(let Y of Z){if(new Date(Y.created).getTime()<Q.getTime())continue;let G=Y.items.find((J)=>J.field==="status");if(!G||typeof G.toString!=="string")continue;X.push({issueId:$.id,issueKey:$.key,toStatus:G.toString,changelogId:Y.id})}return X.sort((Y,G)=>Number(Y.changelogId)-Number(G.changelogId))}function LD6($){return`Jira ${$.key}: ${$.summary}`}async function U20($,Z,Q){if(!Z.enabled)return"disabled";let X=Z.organizationId,Y=await $.storage.jiraIntegrations.getAutomation(X,Q.toStatus);if(!Y)return"no_rule";let G=new JG(Z.siteUrl,Z.email,Z.apiToken),J=await Rw0(G,Z.siteUrl,Q.issueId),W=await ED6($,Z,Q,J);if(!await $.storage.jiraIntegrations.claimTrigger(X,Q.issueId,Q.changelogId))return"duplicate";let F=await $.storage.taskBoard.update(W.id,X,{assigneeId:d$,assignedBy:Z.createdBy},Z.createdBy);try{await YW($,F,{instruction:Y.prompt??DD6,source:{kind:"jira",issueKey:J.key,title:LD6(J),body:`${qw0(J)}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.333.2",
+  "version": "4.334.0",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/api-keys-BwDWxdgH.js

@@ -1 +0,0 @@
-import{c as o,j as r}from"./index-DQZFoxWW.js";import{O as m}from"./api-keys-Dn_3cXMh.js";import{R as p}from"./require-capability-DZ3K4KuW.js";import"./AlertCircle-DcaGOfqb.js";import"./Copy01-CJNn1OB1.js";import"./Key01-AKeYb1iG.js";import"./Plus-DpnDDGUT.js";import"./Trash01-Bldrihzd.js";import"./alert-dialog-B06De0JK.js";import"./dialog-BbIp2E0f.js";import"./input-BsSeCBxN.js";import"./label--O9EnxKm.js";import"./use-mcp-client-B7GMb55O.js";import"./constants-BRGHAWVM.js";import"./auth-zMOvmMis.js";import"./access-gate-1nyr2_09.js";import"./capability-load-error-C1fvtm6R.js";function A(){const t=o.c(1);let i;return t[0]===Symbol.for("react.memo_cache_sentinel")?(i=r.jsx(p,{capability:"api-keys:manage",area:"api-keys",children:r.jsx(m,{})}),t[0]=i):i=t[0],i}export{A as default};

package/dist/client/assets/app-editor-BnC1oHgl.js

@@ -1 +0,0 @@
-import{c as jt,b as Bt,r as A,j as o,l as _t,h as wt,t as ht}from"./index-DQZFoxWW.js";import{b as At}from"./chat-context-BqppScTT.js";import{i as Et}from"./ChevronRight-bnM8sZnx.js";import{S as Nt}from"./scroll-area-BGq-CSAV.js";import{u as Rt,A as Tt}from"./use-section-preview-base-CySGpS3n.js";import{n as Ct,r as Kt,c as Pt,d as Ft,e as Ot,g as Ut,h as $t,S as It,i as zt,j as Lt}from"./index-CPlGS2ux.js";import"./use-panel-navigate-uNuYTogU.js";import"./use-destination-route-CxlaF62v.js";import"./autosend-DxcRD2DE.js";import"./thread-intent-CUjfCf3a.js";import"./slugify-CEUa2lfQ.js";import"./hooks-B_A_YAvI.js";import"./use-mcp-client-B7GMb55O.js";import"./constants-BRGHAWVM.js";import"./auth-zMOvmMis.js";import"./delay-CnY5UFtP.js";import"./backoff-CrEUbyZT.js";import"./decopilot-sse-pool-jE1UNqKB.js";import"./task-board-Cu3ebbWq.js";import"./schema-DJ_LjEj1.js";import"./use-is-desktop-app-BNujXJc_.js";import"./use-virtual-mcp-BKOb-edU.js";import"./use-ai-providers-BPMNNM9J.js";import"./location-oTTXFrSF.js";import"./use-decopilot-events-Dr2tn2qY.js";import"./thread-route-C77zHHgw.js";import"./dialog-BbIp2E0f.js";import"./Check-CPeotzvS.js";import"./Copy01-CJNn1OB1.js";import"./Download01-C9ja7dKD.js";import"./use-organization-settings-Bim0oSik.js";import"./select-BYLjNRqU.js";import"./ChevronUp-lpjVq059.js";import"./agent-icon-Bg0V7rBE.js";import"./AlertCircle-DcaGOfqb.js";import"./Tool01-rRxeerFJ.js";import"./ArrowUp-DjRXENFc.js";import"./ArrowLeft-Detws_kn.js";import"./Tool02-BMrjnDwT.js";import"./XCircle-D12ha_F2.js";import"./TrendUp01-CEv20ANy.js";import"./ZoomOut-CzCm9DJJ.js";import"./Users03-C7sDJhvM.js";import"./CheckCircle-LnwWJzlu.js";import"./ChevronSelectorVertical-n7kw9dxn.js";import"./DotsVertical-BA3sYvvo.js";import"./UserSquare-BwCmNnA8.js";import"./CreditCard01-DD4scA21.js";import"./Settings02-Dz98QNaV.js";import"./Eye-_y5C5trc.js";import"./Share07-Da3b1mEa.js";import"./GitBranch01-DkwtqntI.js";import"./Globe01-9k1-8Bkj.js";import"./XClose-CeMD3p1S.js";import"./HardDrive-CdqU3bsX.js";import"./Image01-CuEDWVnx.js";import"./Key01-AKeYb1iG.js";import"./Link01-Cvf2YaHo.js";import"./LinkExternal01-xE8jtKuV.js";import"./Monitor01-DQ-8DG1K.js";import"./Sun-BD7IkygO.js";import"./Package-BnH-DX9P.js";import"./Palette-DM4do941.js";import"./Play-Wv9XyTGD.js";import"./Plus-DpnDDGUT.js";import"./SearchMd-C78znxGO.js";import"./Shield01-DbOzYSD-.js";import"./Stars01-D39IduhG.js";import"./Trash01-Bldrihzd.js";import"./Upload01-CK5z8KOm.js";import"./User01-D5U704R9.js";import"./Users01-BsjnkiW6.js";import"./Zap-C31cx3nD.js";import"./input-BsSeCBxN.js";import"./automation-runs-C9h76Dtp.js";import"./useInfiniteQuery-DOzB4Ufe.js";import"./use-infinite-scroll-nYcTuRXU.js";import"./use-connection-nBPBlykt.js";import"./table-NiA21uit.js";import"./empty-state-DZCVNnXo.js";import"./use-members-BlqffsCz.js";import"./use-org-auth-client-i16AipDJ.js";import"./use-automations-NAtp0nLm.js";import"./useSuspenseInfiniteQuery-D1vpN7Ip.js";import"./avatar-bNMWoXcJ.js";import"./format-time-BnbuEtat.js";import"./differenceInSeconds-NQ4PDo0z.js";import"./use-copy-BJuvIH9P.js";import"./markdown-C0jiYp_K.js";import"./monaco-editor-B8BD8_K_.js";import"./editor-DLiWSZ6N.js";import"./mcp-app-renderer-ckwtfKNT.js";import"./types-C1fGgzVT.js";import"./shell-layout-zj5zULrN.js";import"./project-icon-CZR3WCka.js";import"./github-repo-COLY3wWI.js";import"./source-system-tabs-CnEGUb4r.js";import"./command-DpmK47dk.js";import"./index-BK1TU5kP.js";import"./required-auth-layout-BPDfLH17.js";import"./use-org-sso-BAfQh97v.js";import"./use-org-notice-DUpfepsT.js";import"./integration-icon-2mEYcBnc.js";import"./use-navigate-to-agent-iT8LNx0e.js";import"./use-mcp-prompts-BzAmejPC.js";import"./form-_XbiKNzI.js";import"./label--O9EnxKm.js";import"./file-type-icon-DuGi_pds.js";import"./drawer-Ywd9lny1.js";import"./collection-search-B5HY9h2O.js";import"./tabs-BE22XnKA.js";import"./toggle-group-CNCN-feG.js";import"./task-route-DWOK_1yO.js";import"./extract-connection-data-DNytJo3X.js";import"./metadata-dUsYcpuu.js";import"./connection-Bd70O3gk.js";import"./connection-card-Y36WaUB4.js";import"./use-registry-connections-Q6rfMPwh.js";import"./retry-CErkP7V6.js";import"./connection-slug-CITJ0kGN.js";import"./textarea-COv6_7kb.js";import"./connection-form-helpers-M5ss_NIF.js";import"./authenticate-and-persist-oauth-DMon8HFQ.js";import"./mcp-oauth-yY3pVGXM.js";import"./collection-tabs-BQTI3gzj.js";import"./badge-C_GSC8a9.js";import"./use-file-configs-DekEAxHE.js";import"./site-slug-uya6Wp4-.js";import"./dropdown-menu-_O1N4j0N.js";import"./popover-CNj_cwoO.js";import"./github-icon-KmcruFDl.js";import"./get-initials-D-f_fDFw.js";import"./select-model-D88y5PjQ.js";import"./checkbox-BOaZCwtg.js";import"./ai-providers-logos-DD3qZ33J.js";import"./folder-icon-DKyyUi5-.js";import"./question-004-sINsf4GQ.js";import"./use-status-sounds-Z9SoRUgh.js";import"./toolbar-Bh6kxgq2.js";import"./skill-preview-n85iiyBT.js";import"./pt-BR-CLy76QW2.js";import"./alert-dialog-B06De0JK.js";import"./use-debounced-autosave-B7LJZF37.js";import"./search-input-_YPOOCX-.js";import"./use-mcp-auth-status-BLPi_-5f.js";import"./switch-Dyaq2WTK.js";import"./github-repo-picker-CFHuxa0v.js";import"./use-debounced-value-B5ut0lSD.js";import"./provision-repo-scoped-github-connection-WQFARyHG.js";import"./use-secrets-DsX8TQKT.js";import"./client-icons-C0K0ya9X.js";import"./connect-layout-oDM0ynMt.js";import"./self-tool-result-Bmz7PXaB.js";import"./track-D1v5yHSQ.js";import"./use-tags-D-cngrRH.js";import"./breadcrumb-3Q_w1e9s.js";import"./toolbar-icon-button-dYfXBmEL.js";import"./safe-image-url-D5z803Ot.js";import"./automation-list-row-CAqVRPQ7.js";import"./site-error--i37Vnuw.js";import"./cards-DB_U2vtt.js";function Vt(n,t){const s=(n.title||n.resolveType.split("/").pop()||"").replace(/\.(tsx?|jsx?)$/,"").replace(/[^A-Za-z0-9_-]/g,""),i=/^[A-Za-z]/.test(s)&&s.length>0?s:"Section",m=Ct(t,i);return{blockKey:m,data:{__resolveType:n.resolveType,name:m}}}function Zr(n){const t=jt.c(79),{orgSlug:s,virtualMcpId:i,branch:m,blockKey:p,block:x,meta:a,decofile:l,title:bt,excludeFields:Z,schemaPending:lt,previewBaseUrl:ct}=n,D=lt===void 0?!1:lt,H=ct===void 0?null:ct,G=At()?.taskId??null,c=Bt();let N;t[0]!==H||t[1]!==i?(N={virtualMcpId:i,sandboxUrl:H},t[0]=H,t[1]=i,t[2]=N):N=t[2];const h=Rt(N),v=typeof x?.__resolveType=="string"?x.__resolveType:"";let R;t[3]!==Z||t[4]!==a||t[5]!==v?(R=Kt(v,a,Z),t[3]=Z,t[4]=a,t[5]=v,t[6]=R):R=t[6];const b=R;let T;t[7]!==b?(T=!!b&&Object.keys(b.properties??{}).length>0,t[7]=b,t[8]=T):T=t[8];const J=T,dt=bt??(x?Pt(p,x,a):p);let C;t[9]!==m||t[10]!==s||t[11]!==i?(C={orgSlug:s,virtualMcpId:i,branch:m},t[9]=m,t[10]=s,t[11]=i,t[12]=C):C=t[12];const{save:S,flush:Q,isPending:W}=Ft(C);let K;t[13]!==m||t[14]!==s||t[15]!==i?(K={orgSlug:s,virtualMcpId:i,branch:m},t[13]=m,t[14]=s,t[15]=i,t[16]=K):K=t[16];const X=Ot(K);let P;t[17]!==S?(P=zt((e,r)=>S(e,r)),t[17]=S,t[18]=P):P=t[18];const Y=P,[vt,St]=A.useState(p),[tt,ut]=A.useState(null),[et,ft]=A.useState(0);let F;t[19]===Symbol.for("react.memo_cache_sentinel")?(F=[],t[19]=F):F=t[19];const[g,xt]=A.useState(F),[ot,d]=A.useState(!1),O=A.useRef(null);vt!==p&&(St(p),ut(null),ft(Mt),xt([]));let U;t[20]!==x?(U=x??{},t[20]=x,t[21]=U):U=t[21];const rt=U;let y;t[22]!==tt?(y=tt??{},t[22]=tt,t[23]=y):y=t[23];let $;t[24]!==rt||t[25]!==y?($={...rt,...y},t[24]=rt,t[25]=y,t[26]=$):$=t[26];const it=$;let I;t[27]!==p||t[28]!==v||t[29]!==S?(I=e=>{const r=e;ut(r),S(p,{...r,__resolveType:v})},t[27]=p,t[28]=v,t[29]=S,t[30]=I):I=t[30];const st=I;let z;t[31]===Symbol.for("react.memo_cache_sentinel")?(z=e=>{xt(e)},t[31]=z):z=t[31];const E=z;let L;t[32]!==l||t[33]!==Q||t[34]!==X||t[35]!==c?(L=async(e,r)=>{try{const{blockKey:u,data:f}=Vt(e,l);await X.mutateAsync({blockKey:u,data:f}),ht.success(c("sandbox.appEditor.createdSection",{name:u})),r({__resolveType:u}),Q()}catch(u){const f=u,kt=f instanceof Error?f.message:c("sandbox.appEditor.failedAddSection");throw ht.error(kt),f}},t[32]=l,t[33]=Q,t[34]=X,t[35]=c,t[36]=L):L=t[36];const k=L;let V;t[37]!==d?(V=e=>{O.current=e.append,d(!0)},t[37]=d,t[38]=V):V=t[38];const mt=V;let q;t[39]!==k||t[40]!==d?(q=async e=>{const r=O.current;if(r)try{await k(e,u=>{r(u),d(!1),O.current=null})}catch{}},t[39]=k,t[40]=d,t[41]=q):q=t[41];const pt=q,at=g.length>0?[dt,...g]:[],gt="flex h-full flex-col",yt="flex h-12 shrink-0 items-center justify-between border-b px-6",nt=at.length>0?o.jsx("nav",{"aria-label":c("sandbox.appEditor.editingBreadcrumb"),className:"flex min-w-0 flex-1 items-center gap-1 overflow-hidden text-sm",children:at.map((e,r)=>{const u=r===at.length-1,f=Ut(e);return o.jsxs("span",{className:"flex min-w-0 items-center gap-1 overflow-hidden",children:[r>0&&o.jsx(Et,{className:"size-3 shrink-0 text-muted-foreground/60"}),o.jsx("button",{type:"button",onClick:()=>{E(r===0?[]:$t(g,r)),ft(qt)},title:f,className:_t("min-w-0 truncate rounded-md px-1 py-0.5 text-left transition-colors",u?"font-medium text-foreground":"text-muted-foreground hover:bg-accent hover:text-accent-foreground"),children:f})]},`${f}-${r}`)})}):o.jsx("span",{className:"text-sm font-medium",children:dt});let j;t[42]!==W?(j=o.jsx(Lt,{isPending:W,isError:!1}),t[42]=W,t[43]=j):j=t[43];let B;t[44]!==nt||t[45]!==j?(B=o.jsxs("div",{className:yt,children:[nt,j]}),t[44]=nt,t[45]=j,t[46]=B):B=t[46];let _;t[47]!==p||t[48]!==m||t[49]!==g||t[50]!==l||t[51]!==it||t[52]!==et||t[53]!==k||t[54]!==E||t[55]!==st||t[56]!==mt||t[57]!==J||t[58]!==a||t[59]!==s||t[60]!==Y||t[61]!==b||t[62]!==D||t[63]!==h||t[64]!==c||t[65]!==G||t[66]!==i?(_=o.jsx(Nt,{className:"min-h-0 min-w-0 flex-1 [&_[data-slot=scroll-area-viewport]>div]:!block",children:o.jsx("div",{className:"px-6 py-6",children:o.jsx("div",{className:"mx-auto max-w-xl",children:J?o.jsx(It,{schema:b,value:it,onChange:st,basePath:"",breadcrumbPath:g,onBreadcrumbChange:E,decofile:l,meta:a,onSaveReferencedBlock:Y,previewBaseUrl:h,onAddSectionItem:k,onRequestAddSection:mt,sandbox:{orgSlug:s,virtualMcpId:i,branch:m,threadId:G}},`${p}:${et}`):D?o.jsxs("div",{className:"flex flex-col items-center gap-2 py-6 text-center text-xs text-muted-foreground",children:[o.jsx(wt,{className:"size-4"}),c("sandbox.appEditor.loadingSchema")]}):o.jsx("div",{className:"py-6 text-center text-xs text-muted-foreground",children:c("sandbox.appEditor.noEditableSchema")})})})}),t[47]=p,t[48]=m,t[49]=g,t[50]=l,t[51]=it,t[52]=et,t[53]=k,t[54]=E,t[55]=st,t[56]=mt,t[57]=J,t[58]=a,t[59]=s,t[60]=Y,t[61]=b,t[62]=D,t[63]=h,t[64]=c,t[65]=G,t[66]=i,t[67]=_):_=t[67];let w;t[68]!==ot||t[69]!==l||t[70]!==pt||t[71]!==a||t[72]!==h||t[73]!==d?(w=h&&o.jsx(Tt,{open:ot,onOpenChange:e=>{d(e),e||(O.current=null)},meta:a,decofile:l,previewBaseUrl:h,onSelect:e=>{pt(e)}}),t[68]=ot,t[69]=l,t[70]=pt,t[71]=a,t[72]=h,t[73]=d,t[74]=w):w=t[74];let M;return t[75]!==B||t[76]!==_||t[77]!==w?(M=o.jsxs("div",{className:gt,children:[B,_,w]}),t[75]=B,t[76]=_,t[77]=w,t[78]=M):M=t[78],M}function qt(n){return n+1}function Mt(n){return n+1}export{Zr as AppEditor};