npm - decocms - Versions diffs - 4.349.0 → 4.350.1 - Mend

decocms 4.349.0 → 4.350.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (283) hide show

package/dist/server/server.js CHANGED Viewed

@@ -2927,7 +2927,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${G.join(`
 `)}`:X}function Pz6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var wt$=200,Uz6=12,Bz6,Dz6=300,yR0=3;var WG1=D(()=>{oZ();L8();xR0();Bz6={aheadBy:0,behindBy:0,files:[]}});function Tz6($){if(!$||$.includes(".."))return!1;return Az6.test($)}function jt$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!Tz6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function zt$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Az6;var Pt$=D(()=>{Az6=/^[\w./@-]+$/});function B00($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function Tt$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new pL(wZ);let G=await ND($.storage,X,Y);if(G&&await AU($.storage,G)){let F=await aK($,G,{forceRefresh:!0}).catch((U)=>{throw new pL(U instanceof Error?U.message:wZ)});await At$($,Z,Q,F);return}let J=Y.connectionId??G?.legacyConnectionId;if(!J)throw new pL("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await ig({ctx:$,connectionId:J,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:wZ;throw new pL(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await eK(J,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=q6$(F instanceof Error?F.message:String(F));throw U?new pL(N):F});await At$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function At$($,Z,Q,Y){let{cloneUrl:X,gitUserName:G,gitUserEmail:J}=Y,W=Bc($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:G,userEmail:J}},...W?{operator:W}:{}})});if(!K.ok){let H=await cD(K,Rz6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var Rz6=10485760,pL;var KG1=D(()=>{IJ();MR0();So();iQ0();Rt();oZ();pL=class pL extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function Iz6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!qz6.test(Z))throw Error(`Invalid branch name: ${$}`)}function yf($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(kz6)])}async function Sz6($,Z){let Q=$.var.studioContext,Y=WH(Z.branch),X=$.req.query("thread")??Y,G=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=b_(J?.metadata?.runtime);if(W)return W;let K=fw0(Z.virtualMcpMetadata),H=K==="cms"?await lX1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!J&&(H==="gone"||H==="alive"&&K==="cms");if(U&&J)Co(Q,J.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function Cz6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await PY($.var.studioContext)}catch{return null}}function gf($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Ec($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=B00(Z,Q);if(!X)throw new j1({provider:"github",status:404,message:"Project has no GitHub repository"});let G=p(Y);return dg(Y,G.id,X)}function HG1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=B4$(Z);if(Y!==void 0)return $.json({error:Q},429,{...O5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof h5)return $.json({error:Q},409,O5);let X=VJ(Z);if(X!==null){let G=X===404?404:X===409||X===422?409:502;return $.json({error:Q},G,O5)}return $.json({error:Q},502,O5)}async function It$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function Mt$($){try{let Z=await Ec($),Q=await gR0(Z,$.get("vmClaim").branch);return $.json(Q,200,O5)}catch(Z){return HG1($,Z)}}function O00($,Z){let Y=(lR0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return lR0.set($,X),X.finally(()=>{if(lR0.get($)===X)lR0.delete($)}),Y}async function J7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,O5);let Y=Q?.runner??gf($);if(Y instanceof Response)return Y;let{claimName:X,userId:G,projectRef:J}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:G,projectRef:J},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...O5}})}}let O=await B.text(),L=Q?.redactRepoDir?_z6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...O5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function _z6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function cR0($,Z,Q,Y="GET",X){let G=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(G.status===404&&X){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))G=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function vz6($){return kt$.includes($)}var qz6,Rt$=524288,Mz6=65536,kz6=1e4,qt$=2000,Vz6,lR0,O5,kt$,Vt$=()=>{let $=new $1;$.use("/:virtualMcpId/:branch/*",Vz6),$.post("/:virtualMcpId/:branch/write",(Q)=>J7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>J7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>J7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>J7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>J7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>J7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>J7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return J7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return J7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>J7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>J7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!vz6(Y))return Q.json({error:`step must be one of: ${kt$.join(", ")}`},400);let X=Q.get("vmClaim"),G=await lX1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await Cz6(Q);if(!G)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,O5);if(Y==="start"){let J=p(Q.var.studioContext),W=kh(X.virtualMcpMetadata);try{await Sw0({ctx:Q.var.studioContext,runner:G,handle:X.claimName,orgId:J.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return J7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return _N(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return kn$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Mt$(Q);return Z(Q)});let Z=(Q)=>J7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(qt$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Mt$(Q);return J7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(qt$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),G=await Ec(Q),J=await hR0(G,Y.branch,X.base);return Q.json(J,200,O5)}catch(X){return HG1(Q,X)}return J7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,O5);let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:G,connectionIds:J}=Q.get("vmClaim"),W=Q.var.studioContext;return O00(X,async()=>{try{await cX1(W,Y,X);let K=B00(G,J);if(K)await Tt$(W,Y,X,K)}catch(K){if(K instanceof pL)return Q.json({error:K.message},403,O5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,O5)}return J7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return O00(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),G=Array.isArray(X.filepaths)?X.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return Q.json({error:"filepaths is required"},400,O5);try{let J=await Ec(Q);return await Et$(J,Y.branch,G),Q.json({ok:!0},200,O5)}catch(J){let W=VJ(J)===409||J instanceof h5?409:502,K=J instanceof Error?J.message:String(J);return Q.json({error:K},W,O5)}});return O00(Y.claimName,()=>J7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return O00(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Ec(Q),H=W.base??await K.getDefaultBranch();return await uR0(K,Y.branch,H),Q.json({ok:!0},200,O5)}catch(W){return HG1(Q,W)}});let X=gf(Q);if(X instanceof Response)return X;let{claimName:G}=Q.get("vmClaim"),J=Q.var.studioContext;return O00(G,async()=>{try{await cX1(J,X,G)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,O5)}return J7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",S5({maxSize:Rt$,onError:(Q)=>Q.json({error:"Payload too large"},413,O5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=gf(Q);if(H instanceof Response)return H;X=H}let{claimName:G,userId:J,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=iX1(F)&&N?[F,U]:X?await Promise.all([cR0(X,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),cR0(X,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Ec(Q);return Promise.all([gR0(w,Y.branch),hR0(w,Y.branch)])})(),L=await vn$(K,B,O);return Q.json(L,200,O5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,O5);return Q.json({error:F},502,O5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",S5({maxSize:Rt$,onError:(Q)=>Q.json({error:"Payload too large"},413,O5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=gf(Q);if(H instanceof Response)return H;X=H}let{claimName:G,userId:J,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=iX1(F)&&N?[F,U]:X?await Promise.all([cR0(X,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),cR0(X,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Ec(Q);return Promise.all([gR0(w,Y.branch),hR0(w,Y.branch)])})(),L=await bn$(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,O5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,O5);return Q.json({error:F},502,O5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),G=Q.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Q.json({error:"Path not allowed"},403);let J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,"");return It$(Q,`${W}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",S5({maxSize:Mz6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let J;try{J=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return Q.json({error:"Invalid JSON body"},400);let W=jt$(J);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=zt$(G,W.resolveType);return It$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var St$=D(()=>{h$();tW();Nc();uX1();Io();qn$();_J();Vh();In$();OW();Mn$();Vn$();js0();ko();tX1();xn$();oZ();cZ();WG1();Pt$();KG1();qz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Vz6=IR0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=p0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=p(Q)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{Iz6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(G);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=ot({orgId:X.id,virtualMcpId:G,branch:J}),H=await bo0(Q,J),F=xo0(H,Y),U=Rn$({userId:F,projectRef:K}),N=W.metadata??null,B=await Sz6($,{claimName:U,branch:J,virtualMcpId:G,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await PY(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});lR0=new Map;O5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};kt$=["clone","install","start"]});function Ct$($,Z,Q){let Y=FG1.get($);if(!Y)Y={pending:null,running:!1},FG1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[J,W]of Object.entries(Q.set??{}))X.set.set(J,W),X.del.delete(J);for(let J of Q.delete??[])X.del.add(J),X.set.delete(J);let G=new Promise((J,W)=>{X.resolvers.push(J),X.rejecters.push(W)});if(!Y.running)bz6($,Y);return G}async function bz6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await xz6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)FG1.delete($)}}async function xz6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let G=0;;G++){let J=await wc(Z,Q),W=await Z.listDecofileEntries(J,Y),K=XG1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=GG1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await Bt$(Z.repo,L);let w=O[0]??`${bR0(Y)}/${sX1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of GG1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return J;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Ot$(Z,F.values(),X),{decofile:B,skipped:O}=K00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:WW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:yz6($),expectedHead:J,changes:H});return N}catch(N){if(!(N instanceof h5)||G>=fz6-1)throw N;await z$(H7(2000,200,G,2,0.5))}}}function yz6($){let Z=(X)=>{let G=X.slice(0,3).join(", ");return X.length>3?`${G} (+${X.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Ko0(Y,$.deps.coAuthor)}var fz6=3,FG1;var _t$=D(()=>{EL0();VR0();u5();L8();oZ();xR0();FG1=new Map});import{createHmac as vt$,randomBytes as gz6,timingSafeEqual as hz6}from"crypto";function ft$(){if(dR0)return dR0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return dR0=$?Buffer.from($):gz6(32),dR0}function UG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+uz6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=vt$("sha256",ft$()).update(Y).digest("base64url");return`${Y}.${X}`}function bt$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),G=Buffer.from(vt$("sha256",ft$()).update(Y).digest("base64url"));if(X.length!==G.length||!hz6(X,G))return!1;let J;try{J=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var uz6=21600000,dR0=null;var xt$=D(()=>{E$()});import{z as jc}from"zod";function cz6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&lz6.test($)}function lt$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function D00($){let Z=$.get("decofileScope");return dg($.var.studioContext,Z.organizationId,Z.githubRepo)}function L00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof h5)return $.json({error:Q},409);let Y=VJ(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function ct$(){let $=new $1;return $.use("/:virtualMcpId/:branch",ut$),$.use("/:virtualMcpId/:branch/*",ut$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Dt$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(X.decofile,200,{...G,"content-type":"application/json"});let J=UG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(lt$(Z))},"decofile":${X.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Y){return L00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await D00(Z),G=await X.readFileAtRef(Q.branch,Y);if(G===null){let J=await X.getDefaultBranch();if(J!==Q.branch)G=await X.readFileAtRef(J,Y)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return L00(Z,X)}}),$.patch("/:virtualMcpId/:branch",mz6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=iz6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let G=X.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{kR0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(rX1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await D00(Z),W=await Ct$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Bc(Y)},G),K=UG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:lt$(Z)})}catch(J){return L00(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await Y.mergeBranches(X,Q.branch,G)}catch(W){if(VJ(W)!==409)throw W;await uR0(Y,Q.branch,X),J=await Y.mergeBranches(X,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(VJ(J)===409)return Z.json({error:"merge-conflict"},409);if(VJ(J)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw J}}catch(Y){return L00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:G,behindBy:J,lastCommitAt:W?.committedAt??null})}catch(G){if(VJ(G)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Y){return L00(Z,Y)}}),$}var lz6,yt$=500,gt$=1048576,ht$=1024,dz6=8388608,mz6,iz6,ut$;var dt$=D(()=>{zs0();VR0();h$();tW();uX1();MR0();KG1();oZ();_t$();xt$();WG1();xR0();lz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mz6=S5({maxSize:dz6,onError:($)=>$.json({error:"Payload too large"},413)}),iz6=jc.object({set:jc.record(jc.string(),jc.unknown()).optional(),delete:jc.array(jc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=yt$,{message:`Patch cannot touch more than ${yt$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=gt$),{message:`Each block must be at most ${gt$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=ht$),{message:`Each block key must be at most ${ht$} characters`}),ut$=IR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!X||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!cz6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!bt$(B,{organizationId:Y.id,virtualMcpId:X,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!vw0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=B00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var mt$=($)=>{let Z=new $1;if(Z.use("*",Af),Z.use("*",Vd$),Z.route("/",h20()),Z.route("/",Wm$()),Z.route("/",sd$()),Z.route("/",Un$()),Z.route("/",Kn$()),Z.route("/",TR0()),Z.route("/tools",En$()),Z.route("/",Dn$()),Z.route("/",up$({kvStorage:$.kvStorage})),Z.route("/",gp$()),Z.route("/fs",ep$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Vt$()),Z.route("/decofile",ct$()),Z.route("/",Gn$()),Z.route("/",Zn$()),Z.route("/deco-sites",l20()),Z.route("/hosting",ud$()),Z.route("/monitor",nd$()),Z.route("/sso",v20()),Z.route("/",RR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",bd$()),$.mountDevAssets)Z.route("/dev-assets",i20({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",iu$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Yn$()),Z.route("/mcp",yj0()),Z.route("/mcp/self",AR0()),Z.route("/mcp",uj0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var it$=D(()=>{h$();Sd$();R20();xd$();JY1();ld$();td$();p20();_e();ZY1();OY1();hp$();lp$();$n$();Qn$();fr();oQ1();lj0();vX1();Xn$();Jn$();Hn$();Nn$();Ln$();bX1();jn$();xX1();gj0();St$();dt$()});function pz6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var nz6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pt$=()=>{let $=new $1;return $.use("*",nz6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let G=await xX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:pz6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var nt$=D(()=>{h$();E$();CT0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function YP6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function XP6($,Z,Q){try{return JSON.parse($)}catch{throw new rt$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function GP6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:XP6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function JP6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?RG(Q.function.parameters):RG({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function WP6($){if(!$)return;return{openai:{response_format:$}}}function KP6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tt$($,Z,Q,Y,X,G){let J={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:G};return X?{...J,providerOptions:X}:J}function ot$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var tz6=256,oz6,rz6,sz6,az6,ez6,$P6,ZP6,QP6,rt$,st$,at$;var et$=D(()=>{S4();h$();Nc();HN();oz6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),rz6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),sz6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(rz6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),az6=M1.object({type:M1.literal("text")}),ez6=M1.object({type:M1.literal("json_object")}),$P6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),ZP6=M1.union([az6,ez6,$P6]),QP6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(sz6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(oz6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:ZP6.optional(),user:M1.string().optional()});rt$=class rt$ extends Error{constructor($){super($);this.name="MessageConversionError"}};st$=new $1;st$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=QP6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=X.data,J=YP6(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QE(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=GP6(G.messages),N=G.tools?JP6(G.tools):void 0,B=WP6(G.response_format),O=KP6(),L=Math.floor(Date.now()/1000);if(G.stream)return _N($,async(w)=>{let E=tt$(F,U,N,G,B,$.req.raw.signal);try{let j=yD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=tz6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ot$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tt$(F,U,N,G,B,$.req.raw.signal),E=await bD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ot$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(GF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(GF(X.message,"server_error"),500)}});at$=st$});function HP6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function $o$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!UY(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of J){if(!H.slug||o9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if($8$(U)!==G)continue;if(!HP6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Zo$=D(()=>{h$();OU()});var Yo$;var Qo$=D(()=>{Yo$={name:"decocms",version:"4.349.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function NP6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??UP6}}var Xo$,UP6="https://ph.studio.decocms.com",Go$;var Jo$=D(()=>{h$();lZ0();Wv();v5();E$();bQ1();Qo$();Xo$=new $1;Xo$.get("/",($)=>{let Z={version:Yo$.version,theme:To1(),...KU().logo&&{logo:KU().logo},...rU()&&{internalUrl:ib1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:kc$(),posthog:NP6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:R00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Go$=Xo$});function zc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function NG1($){return(zc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Ko$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zc($))}&sz=${Z}`}function Wo$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Ho$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,G=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Wo$(`${X.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Wo$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var hf,BP6,OP6,DP6,LP6,Fo$;var Uo$=D(()=>{hf=c0.enum(["good","bad","neutral"]),BP6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:hf.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),OP6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(BP6)),DP6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},LP6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:hf.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:hf.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(OP6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:hf.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:hf.optional()})).min(1)})]),Fo$=c0.object({...DP6,template:LP6})});function mR0($){let Z=[],Q=[...$.sections].sort((X,G)=>X.position-G.position).map((X)=>{let G=Fo$.safeParse(X.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var BG1=D(()=>{Uo$()});import{join as No$}from"path";async function EP6($){try{let Z=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(wP6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=mR0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),G=X?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Y.meta.brand?.trim()||NG1($),score:Y.meta.scores?.cover??J?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function dG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function jP6($,Z){let Q=zc($),Y=Z?.brand?.trim()||NG1(Q),X=Ko$(Q,128),J=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Ho$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${dG(W)}</title>`,`<meta name="description" content="${dG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${dG(W)}" />`,`<meta property="og:description" content="${dG(K)}" />`,`<meta property="og:url" content="${dG(J)}" />`,`<meta property="og:image" content="${dG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${dG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${dG(W)}" />`,`<meta name="twitter:description" content="${dG(K)}" />`,`<meta name="twitter:image" content="${dG(H)}" />`,`<meta name="twitter:image:alt" content="${dG(F)}" />`,`<link rel="canonical" href="${dG(J)}" />`,`<link rel="icon" href="${dG(X)}" sizes="any" />`].join(`
+`;await Bt$(Z.repo,L);let w=O[0]??`${bR0(Y)}/${sX1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of GG1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return J;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Ot$(Z,F.values(),X),{decofile:B,skipped:O}=K00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:WW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:yz6($),expectedHead:J,changes:H});return N}catch(N){if(!(N instanceof h5)||G>=fz6-1)throw N;await z$(H7(2000,200,G,2,0.5))}}}function yz6($){let Z=(X)=>{let G=X.slice(0,3).join(", ");return X.length>3?`${G} (+${X.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Ko0(Y,$.deps.coAuthor)}var fz6=3,FG1;var _t$=D(()=>{EL0();VR0();u5();L8();oZ();xR0();FG1=new Map});import{createHmac as vt$,randomBytes as gz6,timingSafeEqual as hz6}from"crypto";function ft$(){if(dR0)return dR0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return dR0=$?Buffer.from($):gz6(32),dR0}function UG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+uz6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=vt$("sha256",ft$()).update(Y).digest("base64url");return`${Y}.${X}`}function bt$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),G=Buffer.from(vt$("sha256",ft$()).update(Y).digest("base64url"));if(X.length!==G.length||!hz6(X,G))return!1;let J;try{J=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var uz6=21600000,dR0=null;var xt$=D(()=>{E$()});import{z as jc}from"zod";function cz6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&lz6.test($)}function lt$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function D00($){let Z=$.get("decofileScope");return dg($.var.studioContext,Z.organizationId,Z.githubRepo)}function L00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof h5)return $.json({error:Q},409);let Y=VJ(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function ct$(){let $=new $1;return $.use("/:virtualMcpId/:branch",ut$),$.use("/:virtualMcpId/:branch/*",ut$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Dt$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(X.decofile,200,{...G,"content-type":"application/json"});let J=UG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(lt$(Z))},"decofile":${X.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Y){return L00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await D00(Z),G=await X.readFileAtRef(Q.branch,Y);if(G===null){let J=await X.getDefaultBranch();if(J!==Q.branch)G=await X.readFileAtRef(J,Y)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return L00(Z,X)}}),$.patch("/:virtualMcpId/:branch",mz6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=iz6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let G=X.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{kR0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(rX1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await D00(Z),W=await Ct$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Bc(Y)},G),K=UG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:lt$(Z)})}catch(J){return L00(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await Y.mergeBranches(X,Q.branch,G)}catch(W){if(VJ(W)!==409)throw W;await uR0(Y,Q.branch,X),J=await Y.mergeBranches(X,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(VJ(J)===409)return Z.json({error:"merge-conflict"},409);if(VJ(J)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw J}}catch(Y){return L00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await D00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:G,behindBy:J,lastCommitAt:W?.committedAt??null})}catch(G){if(VJ(G)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Y){return L00(Z,Y)}}),$}var lz6,yt$=500,gt$=1048576,ht$=1024,dz6=8388608,mz6,iz6,ut$;var dt$=D(()=>{zs0();VR0();h$();tW();uX1();MR0();KG1();oZ();_t$();xt$();WG1();xR0();lz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mz6=S5({maxSize:dz6,onError:($)=>$.json({error:"Payload too large"},413)}),iz6=jc.object({set:jc.record(jc.string(),jc.unknown()).optional(),delete:jc.array(jc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=yt$,{message:`Patch cannot touch more than ${yt$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=gt$),{message:`Each block must be at most ${gt$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=ht$),{message:`Each block key must be at most ${ht$} characters`}),ut$=IR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!X||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!cz6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!bt$(B,{organizationId:Y.id,virtualMcpId:X,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!vw0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=B00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var mt$=($)=>{let Z=new $1;if(Z.use("*",Af),Z.use("*",Vd$),Z.route("/",h20()),Z.route("/",Wm$()),Z.route("/",sd$()),Z.route("/",Un$()),Z.route("/",Kn$()),Z.route("/",TR0()),Z.route("/tools",En$()),Z.route("/",Dn$()),Z.route("/",up$({kvStorage:$.kvStorage})),Z.route("/",gp$()),Z.route("/fs",ep$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Vt$()),Z.route("/decofile",ct$()),Z.route("/",Gn$()),Z.route("/",Zn$()),Z.route("/deco-sites",l20()),Z.route("/hosting",ud$()),Z.route("/monitor",nd$()),Z.route("/sso",v20()),Z.route("/",RR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",bd$()),$.mountDevAssets)Z.route("/dev-assets",i20({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",iu$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Yn$()),Z.route("/mcp",yj0()),Z.route("/mcp/self",AR0()),Z.route("/mcp",uj0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var it$=D(()=>{h$();Sd$();R20();xd$();JY1();ld$();td$();p20();_e();ZY1();OY1();hp$();lp$();$n$();Qn$();fr();oQ1();lj0();vX1();Xn$();Jn$();Hn$();Nn$();Ln$();bX1();jn$();xX1();gj0();St$();dt$()});function pz6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var nz6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pt$=()=>{let $=new $1;return $.use("*",nz6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let G=await xX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:pz6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var nt$=D(()=>{h$();E$();CT0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function YP6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function XP6($,Z,Q){try{return JSON.parse($)}catch{throw new rt$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function GP6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:XP6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function JP6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?RG(Q.function.parameters):RG({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function WP6($){if(!$)return;return{openai:{response_format:$}}}function KP6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tt$($,Z,Q,Y,X,G){let J={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:G};return X?{...J,providerOptions:X}:J}function ot$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var tz6=256,oz6,rz6,sz6,az6,ez6,$P6,ZP6,QP6,rt$,st$,at$;var et$=D(()=>{S4();h$();Nc();HN();oz6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),rz6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),sz6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(rz6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),az6=M1.object({type:M1.literal("text")}),ez6=M1.object({type:M1.literal("json_object")}),$P6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),ZP6=M1.union([az6,ez6,$P6]),QP6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(sz6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(oz6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:ZP6.optional(),user:M1.string().optional()});rt$=class rt$ extends Error{constructor($){super($);this.name="MessageConversionError"}};st$=new $1;st$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=QP6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=X.data,J=YP6(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QE(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=GP6(G.messages),N=G.tools?JP6(G.tools):void 0,B=WP6(G.response_format),O=KP6(),L=Math.floor(Date.now()/1000);if(G.stream)return _N($,async(w)=>{let E=tt$(F,U,N,G,B,$.req.raw.signal);try{let j=yD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=tz6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ot$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tt$(F,U,N,G,B,$.req.raw.signal),E=await bD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ot$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(GF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(GF(X.message,"server_error"),500)}});at$=st$});function HP6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function $o$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!UY(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of J){if(!H.slug||o9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if($8$(U)!==G)continue;if(!HP6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Zo$=D(()=>{h$();OU()});var Yo$;var Qo$=D(()=>{Yo$={name:"decocms",version:"4.350.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function NP6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??UP6}}var Xo$,UP6="https://ph.studio.decocms.com",Go$;var Jo$=D(()=>{h$();lZ0();Wv();v5();E$();bQ1();Qo$();Xo$=new $1;Xo$.get("/",($)=>{let Z={version:Yo$.version,theme:To1(),...KU().logo&&{logo:KU().logo},...rU()&&{internalUrl:ib1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:kc$(),posthog:NP6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:R00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Go$=Xo$});function zc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function NG1($){return(zc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Ko$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zc($))}&sz=${Z}`}function Wo$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Ho$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,G=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Wo$(`${X.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Wo$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var hf,BP6,OP6,DP6,LP6,Fo$;var Uo$=D(()=>{hf=c0.enum(["good","bad","neutral"]),BP6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:hf.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),OP6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(BP6)),DP6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},LP6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:hf.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:hf.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(OP6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:hf.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:hf.optional()})).min(1)})]),Fo$=c0.object({...DP6,template:LP6})});function mR0($){let Z=[],Q=[...$.sections].sort((X,G)=>X.position-G.position).map((X)=>{let G=Fo$.safeParse(X.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var BG1=D(()=>{Uo$()});import{join as No$}from"path";async function EP6($){try{let Z=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(wP6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=mR0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),G=X?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Y.meta.brand?.trim()||NG1($),score:Y.meta.scores?.cover??J?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function dG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function jP6($,Z){let Q=zc($),Y=Z?.brand?.trim()||NG1(Q),X=Ko$(Q,128),J=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Ho$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${dG(W)}</title>`,`<meta name="description" content="${dG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${dG(W)}" />`,`<meta property="og:description" content="${dG(K)}" />`,`<meta property="og:url" content="${dG(J)}" />`,`<meta property="og:image" content="${dG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${dG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${dG(W)}" />`,`<meta name="twitter:description" content="${dG(K)}" />`,`<meta name="twitter:image" content="${dG(H)}" />`,`<meta name="twitter:image:alt" content="${dG(F)}" />`,`<link rel="canonical" href="${dG(J)}" />`,`<link rel="icon" href="${dG(X)}" sizes="any" />`].join(`
     `)}function zP6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Bo$($){let Z=new $1;return Z.get("/:domain/og.png",async(Q)=>{let Y=zc(Q.req.param("domain")),X=async()=>{let G=$?Bun.file(No$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return Q.notFound();return Q.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(PP6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return X();return Q.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?No$($,"index.html"):null,G=X?Bun.file(X):null;if(!G||!await G.exists())return Q.notFound();let J=await G.text();try{let W=await EP6(zc(Y)),K=jP6(Y,W);return Q.html(zP6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(J)}}),Z}var wP6=2500,PP6=1e4;var Oo$=D(()=>{h$();BG1();Hj();E$()});function w00($,Z){return fetch(`${hK({})}${$}`,Z)}async function AP6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",G=await w00(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=mR0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var TP6,fN,Do$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Lo$;var wo$=D(()=>{h$();UG();Hj();BG1();TP6=new Set(["complete","errored","terminated","unknown"]),fN=new $1;fN.use("*",async($,Z)=>{let Q=await Q8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});fN.use("/link-token/*",Do$);fN.use("/suggest",Do$);fN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let G=await AP6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});fN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,G=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let J=await w00("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Kj({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});fN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await w00(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${Kj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",G={done:TP6.has(X),status:X};return $.json(G)}catch{return $.json({error:"status failed"},502)}});fN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await w00(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});fN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await w00(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});Lo$=fN});import{createHmac as RP6,timingSafeEqual as qP6}from"crypto";function jo$($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,G=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")G.push(N)}if(!X||G.length===0)return!1;let J=Number(X);if(!Number.isFinite(J)||Math.abs(Y/1000-J)>IP6)return!1;let W=RP6("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&qP6(K,F)})}function zo$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=F3(Z),Y=F3(F3(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:JF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function Po$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function JF($){return typeof $==="string"?$:void 0}function F3($){return typeof $==="object"&&$!==null?$:void 0}function iR0($){return typeof $==="number"?new Date($*1000):null}function LG1($){return JF($)??JF(F3($)?.id)}function MP6($){return LG1($.subscription)??JF(F3(F3($.parent)?.subscription_details)?.subscription)}function kP6($){let Z=iR0($.current_period_end);if(Z)return Z;let Q=F3($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let G=F3(X)?.current_period_end;if(typeof G==="number"&&G>Y)Y=G}return Y>0?new Date(Y*1000):null}function OG1($,Z){let Q=iR0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function DG1($,Z){let Q=iR0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function VP6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=JF(F3(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(JF(F3(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(JF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=JF(Q.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let W=Number(F3(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:F3(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(JF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.getBilling(Y);if(!X)return{handled:!1,reason:"unknown org"};let G=LG1(Q.subscription);if(X.stripeSubscriptionId&&G&&X.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(OG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y,{stripeCustomerId:LG1(Q.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:DG1(Z,X)}),{handled:!0,organizationId:Y}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=JF(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&OG1(Z,X))return{handled:!1,reason:"stale event"};let J=G?"canceled":Po$(Q.status);return await $.updateStripeState(X.organizationId,{status:J,currentPeriodEnd:kP6(Q),...G&&{stripeSubscriptionId:null},lastStripeEventAt:DG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}case"invoice.paid":{let Y=MP6(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(OG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:iR0(Q.period_end),lastStripeEventAt:DG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function SP6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Po$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function Eo$($,Z){let Q=SP6($,Z);if(!Q)return;JG({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:Cs1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function Ao$($){let Z=new bK(Z8().db),Q=await VP6(Z,$);if(!(Q.handled&&Q.topUp))Eo$($,Q);if(Q.handled&&Q.topUp)await tT$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),Eo$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await o8$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(Y){if(!(Y instanceof NG&&(Y.status===400||Y.status===404)))throw Y}return Q}var IP6=300;var To$=D(()=>{PJ();g4();TZ0();Cj();F41()});var CP6=1048576,wG1;var Ro$=D(()=>{h$();tW();E$();To$();wG1=new $1;wG1.post("/webhook",S5({maxSize:CP6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=M0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!jo$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=zo$(Q);if(!X)return $.json({error:"invalid payload"},400);let G=await Ao$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as _P6}from"crypto";function bP6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return _P6(Buffer.from(X),Buffer.from(Y))}function xP6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let G=[];if($==="check_suite"){if(Q.action!=="completed")return[];let J=Q.check_suite?.pull_requests;for(let W of Array.isArray(J)?J:[]){let K=W?.number;if(typeof K==="number")G.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let J=Q.issue.number;if(typeof J==="number")G.push(J)}return[...new Set(G)].map((J)=>({repoOwner:X,repoName:Y,number:J}))}function qo$($){let Z=new $1;return Z.post("/webhook",S5({maxSize:vP6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!bP6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let G=Q.req.header("x-github-event");if(G!=="push"&&!fP6.has(G??""))return Q.json({ok:!0,ignored:"event"});let J;try{J=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(G==="push"){let H=J.ref,F=J.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await _o0())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=xP6(G??"",J);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await yP6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function yP6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),G;try{G=await X.findPrLinks(Y)}catch(J){console.error("[github-webhook] pr link lookup failed:",J);continue}for(let J of G)try{let W=await X.getById(J.taskBoardItemId,J.organizationId),K=W?await $.contextFactory()(J.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await IO$(K,J.organizationId,J.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${J.taskBoardItemId}:`,W)}}return Q}var vP6=5242880,fP6;var Io$=D(()=>{h$();tW();OW();TZ();fP6=new Set(["check_suite","issue_comment"])});function Mo$($){let Z=new TN($.db,new eQ($.encryptionKey)),Q=new $1;return Q.get("/attachments/:token",async(Y)=>{let X=mN$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let G=await Z.getByOrg(X.organizationId);if(!G)return Y.json({error:"Jira is not connected"},404);let W=await new MG(G.siteUrl,G.email,G.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var ko$=D(()=>{h$();qB();ns0();m_()});function Vo$($){let Z=new TN($.db,new eQ($.encryptionKey));async function Q(X,G){let J=Mb$(G);if(!J)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await PH($.db,W.organizationId);if(!K)return;if(await vT0(K,W,J)==="started")console.log(`[jira-webhook] started a run for ${J.issueKey} entering "${J.toStatus}"`)}let Y=new $1;return Y.post("/webhook/:secret",S5({maxSize:gP6}),async(X)=>{let G=X.req.param("secret");if(!await Z.getByWebhookSecret(G))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(G,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var gP6=1048576;var So$=D(()=>{h$();tW();qB();fT0();lh()});import{DBOS as pR0,SchedulerMode as hP6}from"@dbos-inc/dbos-sdk";function _o$($){jG1=$}function vo$(){if(!jG1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return jG1}function fo$(){let $=vo$();return new TN($.db,new eQ($.encryptionKey))}async function cP6($,Z){try{let Q=await fo$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await PH(vo$().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let G=new MG(Q.siteUrl,Q.email,Q.apiToken),W=`(${await G.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${Co$}m"`,K=0,H;for(let F=0;F<lP6;F++){let U=await G.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=kb$(N,N.changelog?.histories??[],Z);for(let O of B)if(await vT0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function dP6($,Z){let Q=new Date($.getTime()-Co$*60000),Y=await pR0.runStep(()=>fo$().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((G)=>pR0.runStep(()=>cP6(G,Q),{name:`sweepJira:${G}`})));for(let G of X)if(G.error)console.warn(`[jira-trigger] integration ${G.integrationId} failed: ${G.error}`);else if(G.started>0)console.log(`[jira-trigger] integration ${G.integrationId} started ${G.started} run(s) the webhook missed`)}function bo$(){if(EG1)return;EG1=pR0.registerWorkflow(dP6,{name:"jiraTriggerSweepWorkflow"}),pR0.registerScheduled(EG1,{name:"jiraTriggerSweepWorkflow",crontab:uP6,mode:hP6.ExactlyOncePerIntervalWhenActive})}var uP6="7-59/10 * * * *",Co$=15,lP6=5,jG1=null,EG1=null;var xo$=D(()=>{qB();lh();m_();fT0()});function yo$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var go$,mP6,iP6,ho$;var uo$=D(()=>{h$();n3();ih();wj();go$=new $1,mP6=["range","if-none-match","if-modified-since"],iP6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];go$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(dl($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Y$(401,{message:"Authentication required"})}if(!Q)throw new Y$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new Y$(400,{message:"Missing file key"});let X=await Gr(Y,Z);if(!X)throw new Y$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&rY()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Y$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return yo$(N,H),new Response(U,{status:200,headers:N})}let G=new Headers;for(let K of mP6){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(X,{headers:G});if(J.status===403||J.status===404)throw new Y$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Y),new Y$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of iP6){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),yo$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});ho$=go$});var E00=_((uf)=>{var pP6=uf&&uf.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),nP6=uf&&uf.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))pP6(Z,$,Q)};Object.defineProperty(uf,"__esModule",{value:!0});nP6(mX(),uf)});var do$=_((lo$)=>{Object.defineProperty(lo$,"__esModule",{value:!0});lo$.version=void 0;lo$.version="3.4.0"});var po$=_((WF)=>{var tP6=WF&&WF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(WF,"__esModule",{value:!0});WF.NodeTransport=WF.VERSION=void 0;WF.nodeResolveHost=$A6;var G5=E00(),oP6=z0("net"),zG1=z0("tls"),rP6=z0("path"),mo$=z0("fs"),sP6=tP6(z0("dns")),aP6=do$();WF.VERSION=aP6.version;var eP6="nats.js";class io${socket;version;lang;yields=[];signal=(0,G5.deferred)();closedNotification=(0,G5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=eP6,this.version=WF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,G5.checkOptions)(X,Z);let{tls_required:G,tls_available:J}=X,W=J===!0&&Z.tls!==null;if(!Y&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw G5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let G=X;if(!G)G=new G5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new G5.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,G5.deferred)(),Q,Y=(0,oP6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,G5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=G5.DataBuffer.concat(...this.yields),X=(0,G5.extractProtocolMessage)(Y);if(X!=="")try{let G=G5.INFO.exec(X);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,G5.deferred)();try{if($=(0,rP6.resolve)($),!(0,mo$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,mo$.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,G5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new G5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,G5.deferred)();try{let X=(0,zG1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(G)=>{Z=G}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new G5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,G5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new G5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,G5.deferred)();try{let Y=(0,zG1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new G5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,G5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,G5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof zG1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,G5.render)($)}`);let Z=(0,G5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,G5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,G5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}WF.NodeTransport=io$;function $A6($){let Z=(0,G5.deferred)();return sP6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let G of Y)X.push(G.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var so$=_((ro$)=>{Object.defineProperty(ro$,"__esModule",{value:!0});ro$.connect=ZA6;var no$=po$(),to$=E00(),oo$=E00();function ZA6($={}){if((0,oo$.hasWsProtocol)($))return Promise.reject(oo$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,to$.setTransportFactory)({factory:()=>{return new no$.NodeTransport},dnsResolveFn:no$.nodeResolveHost}),to$.NatsConnectionImpl.connect($)}});var ao$=_((bN)=>{var YA6=bN&&bN.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),XA6=bN&&bN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))YA6(Z,$,Q)};Object.defineProperty(bN,"__esModule",{value:!0});bN.connect=void 0;var GA6=so$();Object.defineProperty(bN,"connect",{enumerable:!0,get:function(){return GA6.connect}});XA6(E00(),bN)});function Qr$($){let Z=$?.connectFn??HA6,Q=null,Y=null,X=!1,G=!1,J=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!G)try{Q=await Z({servers:N,timeout:KA6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,J=!1,F(Q),H();return}catch{O++;let L=H7(WA6,JA6,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,G=!1;let O=B?.creds?eo$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=Zr$.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(G=!0,X=!1,Y=null,J=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function HA6($){return $r$.connect($)}var eo$,$r$,Zr$,JA6=100,WA6=3000,KA6=3000;var Yr$=D(()=>{L8();eo$=V(ic(),1),$r$=V(ao$(),1),Zr$=V(EF(),1)});function PG1($,Z){return`${$}.${Z}`}class AG1{cache;constructor($){this.cache=_l({ttlMs:$?.ttlMs??FA6,maxSize:$?.maxSize??UA6})}async get($,Z){return this.cache.get(PG1($,Z))??null}async set($,Z,Q){this.cache.set(PG1($,Z),Q)}async invalidate($,Z){this.cache.delete(PG1($,Z))}teardown(){this.cache.clear()}}var FA6=600000,UA6=5000;var Xr$=()=>{};function nR0($,Z){return`${$}:${Z}`}function TG1($){let Z=_l({ttlMs:$?.ttlMs??NA6,maxSize:$?.maxSize??BA6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(Gr$,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(nR0(K,H))},set(K,H,F){Z.set(nR0(K,H),F)},invalidate(K,H){Z.delete(nR0(K,H)),W(K,H)},start(){if(J)return;let K=Q?.();if(!K)return;J=K.subscribe(Gr$),(async()=>{for await(let H of J)try{let F=JSON.parse(G.decode(H.data));if(F.originId===Y)continue;Z.delete(nR0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Gr$="studio.ai-provider-keys.invalidate",NA6=30000,BA6=5000;var Jr$=()=>{};class RG1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let G=JSON.parse(Q.decode(X.data));if(G.originId===this.originId)continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Wr$=($)=>{let Z;return()=>Z??=$()},qG1,IG1;var Kr$=D(()=>{Y6();qG1=Wr$(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),IG1=Wr$(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function zA6($=Ur$){return{name:kH,subjects:[`${j01}.>`],storage:aW.StorageType.File,max_age:LA6,max_bytes:EA6,max_msgs_per_subject:jA6,discard:aW.DiscardPolicy.Old,retention:aW.RetentionPolicy.Limits,duplicate_window:wA6,num_replicas:$}}class Nr${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Hr$($){let Z=Fr$.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function RA6($,Z){let Q=0;return{publish(Y,X,G,J){Y.publish(X,G,J?{headers:J}:void 0).catch((W)=>{if(Q++,DA6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function qA6($,Z){return $.info?.cluster?Z:1}function IA6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class MG1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let G=zA6(X);try{await Y.streams.info(kH),await Y.streams.update(kH,G)}catch(J){if(J instanceof Error&&J.message.includes("stream not found"))await Y.streams.add(G),await Y.streams.update(kH,G);else if(J instanceof Error&&/can ?not change.*storage|storage type/i.test(J.message))await Y.streams.delete(kH),await Y.streams.add(G);else throw J}},Q=await N4(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await aW.jetstreamManager($),X=qA6($,Ur$);try{await Z(Y,X)}catch(G){if(X<=1||!IA6(G))throw G;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${G.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Qu});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=RA6(Z,Y),J=!1,W=()=>{if(J)return;J=!0;let H=yE$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=P01(H,{runId:Z}),N=performance.now()-F;qG1().record(N),IG1().add(1,{"org.id":Y??"unknown"}),TA6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)G.publish(X,B.subject,B.data,B.headers?Hr$(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),AA6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:G.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await N4(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Hr$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Qu}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),G=P01(Z,{runId:$,dedup:Q});qG1().record(performance.now()-X),IG1().add(1);for(let J of G)if(!await this.publishSerialized(Y,J))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=xE$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?aW.DeliverPolicy.New:aW.DeliverPolicy.All,G=Q?.closeOnDone??!1,J=QL($),W;try{W=await N4(async()=>{return(await Y.consumers.get(kH,{filter_subjects:J,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Qu})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=wj0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Bj0()).pipeThrough(Oj0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(G){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(kH,{filter:QL($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var aW,Fr$,OA6=($)=>{let Z;return()=>Z??=$()},DA6,LA6=86400000000000,wA6=120000000000,EA6=4294967296,Ur$,jA6=500000,PA6,AA6,TA6;var Br$=D(()=>{L8();A01();Ej0();Dj0();Y6();Kr$();aW=V(EF(),1),Fr$=V(ic(),1),DA6=OA6(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Ur$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);PA6=process.env.STREAM_ENCODE_TRACE==="1",AA6=process.env.DECOPILOT_STREAM_TRACE==="1";TA6=PA6?new Nr$:null});function tR0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,EK(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var Or$=D(()=>{V8()});class kG1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function MA6($,Z){let Q=$.startsWith("thread:")?DW($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function Dr$($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let G=await KH($,X);if(!G?.owner||!G?.name)continue;let J=await $.storage.threads.get(X),W=await Kh($,{threadId:X,runBranch:J?.branch}),K=MA6(W,await ML0($,X)),H=await zt($,Q,Jn0(G)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${G.owner}/${G.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await uJ(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var Lr$=D(()=>{oZ();_J();TZ()});async function wr$($,Z,Q){let Y=Z.organizationId;if(!jX(Z))return!1;if(!s_(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),G=oK(X?.flags),J=await $.storage.taskBoard.update(Z.id,Y,{status:G},Z.updatedBy);return await k6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G,reason:"pr_merged"}}),K8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${G}`),!0}var Er$=D(()=>{j4();RQ();hh();qW();$9()});function fA6($){return $ instanceof DY}function bA6($,Z){return Z-$>=_A6}class VG1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??kA6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??SA6,Q=this.options.itemIntervalMs??VA6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),G=X.at(-1);this.cursor=X.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of X)try{if(await this.reconcileItem(J,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-ls0),Ze0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-vA6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await aa0(this.taskBoard,X,Y),await ea0(this.taskBoard,this.billing,X,Y)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,G)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:G}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let J=await this.taskBoard.getById(Y,X);if(!J||J.status!==A$.progress||J.assigneeId!==n$)continue;let W=await this.contextFactory(X,J.assignedBy??J.createdBy);if(!W)continue;await IW(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,J),fA6(J)){await this.returnToTodo(Y,X,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Y,X,G,new Date(Date.now()+CA6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==A$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),K8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!bA6(jU(Q,Z.reviewCycleStartedAt),Date.now()))return;await jH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!jX(Y))return!1;let X=Y.assigneeId===n$,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!J)return!1;if(G.length===0){if(await Dr$(J,Y))G=await this.taskBoard.listPrs($,Z);if(G.length===0){if(X)await this.handOffReviewWithoutPr(J,Y);return!1}}let W=await Promise.all(G.map(async(K)=>({...K,...await ch(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await wr$(J,Y,W))return!0;if(await Ij$(J,Y))return!0;if(await this.resolveConflictFromSweep(J,Y,W))return!0;if(!X)return!1;if(!ra0(W))return!1;return await TE0(J,Y,{previewMatchesHead:sa0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await tD($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var kA6=60000,VA6=300000,SA6=50,CA6=60000,_A6=900000,vA6=120000;var jr$=D(()=>{j4();ga0();Lr$();zH();Ir();qW();Er$();$9();kJ();Qe0();TZ();$r();uh()});import{readdir as xA6,rm as oR0}from"fs/promises";import{join as rR0}from"path";async function sR0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-yA6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await lf($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await zr$($,X,Z);else if(!X.startsWith(".")){let G=rR0($,X),J=await lf(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;Q+=await zr$(G,K,Z)}if((await lf(G)).length===0)await oR0(G,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function zr$($,Z,Q){let Y=0,X=rR0($,Z),G=await lf(X);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=rR0(X,W),H=await lf(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=rR0(K,U);await oR0(B,{recursive:!0,force:!0}),Y++}}if((await lf(K)).length===0)await oR0(K,{recursive:!0,force:!0})}if((await lf(X)).length===0)await oR0(X,{recursive:!0,force:!0});return Y}async function lf($){try{return(await xA6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var yA6=30;var SG1=()=>{};import{DBOS as CG1,SchedulerMode as gA6}from"@dbos-inc/dbos-sdk";async function uA6(){let $=[N3(),cf(),UF()],Z=0;for(let Q of $)try{Z+=await sR0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function lA6($,Z){await CG1.runStep(()=>uA6(),{name:"monitoringRetention"})}function Ar$(){if(Pr$)return;Pr$=!0;let $=CG1.registerWorkflow(lA6,{name:"monitoringRetentionWorkflow"});CG1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:hA6,mode:gA6.ExactlyOncePerIntervalWhenActive})}var hA6="23 4 * * *",Pr$=!1;var Tr$=D(()=>{tG();SG1()});function Rr$($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await qQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let G=await Hr($.db,Z,Y.role);return X.boundAuth=EQ1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:G,userId:Q}),X.access=new XE(Q,void 0,X.boundAuth,Y.role,"self"),oD(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var qr$=D(()=>{oF();tU()});function cA6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function dA6(){return{services:cA6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function iA6(){for(let $ of mA6)$()}function Ir$($){let Z=[..._G1.logs,$];_G1={..._G1,logs:Z.length>500?Z.slice(-500):Z},iA6()}function vG1(){return pA6}var _G1,mA6,pA6=!1;var fG1=D(()=>{_G1=dA6(),mA6=new Set});import{EventEmitter as nA6}from"events";var bG1;var Mr$=D(()=>{fG1();bG1=new nA6;bG1.on("request",($)=>{Ir$($)})});function kr$(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let G="",J=!1;if(X.startsWith("/mcp")&&Y==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Pc(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((E)=>Pc(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${D5.tool}${B}${D5.dim}(${w})${D5.reset}`}else if(N.method)G=`${D5.dim}${Pc(N.method)}${D5.reset}`}}catch{}}let W=Pc(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${D5.mcp}${Pc(F.slice(0,12))}\u2026${D5.reset}`}else if(X==="/mcp")W=`${D5.mcp}/mcp${D5.reset}`;else if(X==="/mcp/registry")W=`${D5.mcp}/mcp/registry${D5.reset}`;let K=oA6(Y),H=J?"\u25C0":"\u2190";if(!vG1())console.log(`${D5.dim}${H}${D5.reset} ${K}${Y}${D5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=tA6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!vG1())console.log(`${D5.dim}${O}${D5.reset} ${K}${Y}${D5.reset} ${W}${G?` ${G}`:""} ${N}${U}${D5.reset} ${D5.duration}${B}${D5.reset}`);bG1.emit("request",{method:Y,path:Pc(X),status:U,duration:F,timestamp:new Date})}}}var D5,tA6=($)=>{if($>=500)return D5.serverError;if($>=400)return D5.clientError;if($>=300)return D5.redirect;return D5.ok},oA6=($)=>{return D5[$]||D5.reset},Pc=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Vr$=D(()=>{fG1();Mr$();D5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as vr$}from"crypto";import{mkdir as rA6,readdir as sA6,rm as Sr$,stat as fr$}from"fs/promises";import{join as yG1,relative as aA6}from"path";import{z as M$}from"zod";function xr$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return yG1(eA6,Z)}function yr$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function xG1($,Z){let Q=xr$($),Y=yr$(Z);return yG1(Q,Y)}function $T6($,Z,Q,Y){let X=M0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`;return vr$("sha256",X).update(G).digest("hex")}function _r$($,Z,Q,Y,X){let G=Math.floor(Date.now()/1000)+Y,J=$T6(Z,Q,G,X),W=new URL(`/api/dev-assets/${Z}/${yr$(Q)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",X),W.toString()}function gr$($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${vr$("md5","etag").update(Y).digest("hex")}"`}async function hr$($,Z,Q,Y,X){try{let G=await sA6($,{withFileTypes:!0});for(let J of G){let W=yG1($,J.name),H=aA6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(J.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await hr$(W,Z,Q,Y,X);else if(J.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await fr$(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:gr$(W,F.mtime,F.size)})}catch{}}}}catch{}}function ur$($,Z){let Y=p($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:M$.object({prefix:M$.string().optional(),maxKeys:M$.number().optional().default(1000),continuationToken:M$.string().optional(),delimiter:M$.string().optional()}),outputSchema:M$.object({objects:M$.array(M$.object({key:M$.string(),size:M$.number(),lastModified:M$.string(),etag:M$.string()})),nextContinuationToken:M$.string().optional(),isTruncated:M$.boolean(),commonPrefixes:M$.array(M$.string()).optional()}),handler:async(X)=>{let G=X,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,F=xr$(Y);await rA6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await hr$(F,F,J,K,U),U.objects.sort((w,E)=>w.key.localeCompare(E.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:M$.object({key:M$.string()}),outputSchema:M$.object({contentType:M$.string().optional(),contentLength:M$.number(),lastModified:M$.string(),etag:M$.string(),metadata:M$.record(M$.string(),M$.string()).optional()}),handler:async(X)=>{let G=X,J=xG1(Y,G.key),W=await fr$(J);return{contentType:FY1(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:gr$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:M$.object({key:M$.string(),expiresIn:M$.number().optional()}),outputSchema:M$.object({url:M$.string(),expiresIn:M$.number()}),handler:async(X)=>{let G=X,J=G.expiresIn??Cr$;return{url:_r$(Z,Y,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:M$.object({key:M$.string(),expiresIn:M$.number().optional(),contentType:M$.string().optional()}),outputSchema:M$.object({url:M$.string(),expiresIn:M$.number()}),handler:async(X)=>{let G=X,J=G.expiresIn??Cr$;return{url:_r$(Z,Y,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:M$.object({key:M$.string()}),outputSchema:M$.object({success:M$.boolean(),key:M$.string()}),handler:async(X)=>{let G=X,J=xG1(Y,G.key);try{return await Sr$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:M$.object({keys:M$.array(M$.string()).max(1000)}),outputSchema:M$.object({deleted:M$.array(M$.string()),errors:M$.array(M$.object({key:M$.string(),message:M$.string()}))}),handler:async(X)=>{let G=X,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=xG1(Y,K);try{await Sr$(H),J.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function gG1($,Z,Q){let Y=ur$(Z,Q),X=new IK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:z5});for(let J of Y){let W="shape"in J.inputSchema?J.inputSchema.shape:M$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:M$.object({}).shape;X.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let F=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let G=new RY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(G),tJ(X,G,$,"mcp:dev-assets")}async function lr$($,Z,Q,Y){let G=ur$(Q,Y).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var eA6="./data/assets",Cr$=3600,br$,cr$;var dr$=D(()=>{E$();Ku();h$();Li();Rv();XQ();p20();br$=new $1;br$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return gG1($.req.raw,Z,Y)});cr$=br$});var mr$={};T4(mr$,{mountDevRoutes:()=>ZT6});function ZT6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),G=new URL(Y.req.url),J=`${G.protocol}//${G.host}`;return gG1(Y.req.raw,X,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),G=new URL(Y.req.url),J=`${G.protocol}//${G.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await lr$(W,K,X,J);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",cr$);let Q=new $1;Q.use("*",oW({mountPath:"/api/dev-assets"})),Q.route("/",i20({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var ir$=D(()=>{h$();QY1();p20();dr$()});import{sql as QT6}from"kysely";import{randomUUID as pr$}from"crypto";import{z as YT6}from"zod";async function GT6($){let Z=new Date().toISOString(),Q=pr$(),Y=g8.SELF($.organizationId),X="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:pr$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await QT6`SELECT
       pg_notify('studio_events', ${Q}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.349.0",
+  "version": "4.350.1",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {