npm - decocms - Versions diffs - 4.353.0 → 4.353.2 - Mend

decocms 4.353.0 → 4.353.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (260) hide show

package/dist/server/server.js CHANGED Viewed

@@ -2927,7 +2927,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${G.join(`
 `)}`:X}function Pz6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var jt$=200,Uz6=12,Bz6,Dz6=300,yR0=3;var HG1=D(()=>{oZ();L8();xR0();Bz6={aheadBy:0,behindBy:0,files:[]}});function Tz6($){if(!$||$.includes(".."))return!1;return Az6.test($)}function Pt$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!Tz6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function At$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Az6;var Tt$=D(()=>{Az6=/^[\w./@-]+$/});function N00($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function qt$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new pL(wZ);let G=await BD($.storage,X,Y);if(G&&await AU($.storage,G)){let F=await aK($,G,{forceRefresh:!0}).catch((U)=>{throw new pL(U instanceof Error?U.message:wZ)});await Rt$($,Z,Q,F);return}let J=Y.connectionId??G?.legacyConnectionId;if(!J)throw new pL("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await ig({ctx:$,connectionId:J,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:wZ;throw new pL(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await eK(J,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=M6$(F instanceof Error?F.message:String(F));throw U?new pL(N):F});await Rt$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function Rt$($,Z,Q,Y){let{cloneUrl:X,gitUserName:G,gitUserEmail:J}=Y,W=Bc($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:G,userEmail:J}},...W?{operator:W}:{}})});if(!K.ok){let H=await dD(K,Rz6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var Rz6=10485760,pL;var FG1=D(()=>{IJ();MR0();So();iQ0();Rt();oZ();pL=class pL extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function Iz6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!qz6.test(Z))throw Error(`Invalid branch name: ${$}`)}function yf($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(kz6)])}async function Sz6($,Z){let Q=$.var.studioContext,Y=WH(Z.branch),X=$.req.query("thread")??Y,G=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=b_(J?.metadata?.runtime);if(W)return W;let K=fw0(Z.virtualMcpMetadata),H=K==="cms"?await dX1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!J&&(H==="gone"||H==="alive"&&K==="cms");if(U&&J)Co(Q,J.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function Cz6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await PY($.var.studioContext)}catch{return null}}function gf($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Ec($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=N00(Z,Q);if(!X)throw new j1({provider:"github",status:404,message:"Project has no GitHub repository"});let G=p(Y);return dg(Y,G.id,X)}function UG1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=D4$(Z);if(Y!==void 0)return $.json({error:Q},429,{...O5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof h5)return $.json({error:Q},409,O5);let X=VJ(Z);if(X!==null){let G=X===404?404:X===409||X===422?409:502;return $.json({error:Q},G,O5)}return $.json({error:Q},502,O5)}async function kt$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function Vt$($){try{let Z=await Ec($),Q=await gR0(Z,$.get("vmClaim").branch);return $.json(Q,200,O5)}catch(Z){return UG1($,Z)}}function B00($,Z){let Y=(lR0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return lR0.set($,X),X.finally(()=>{if(lR0.get($)===X)lR0.delete($)}),Y}async function J7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,O5);let Y=Q?.runner??gf($);if(Y instanceof Response)return Y;let{claimName:X,userId:G,projectRef:J}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:G,projectRef:J},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...O5}})}}let O=await B.text(),L=Q?.redactRepoDir?_z6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...O5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function _z6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function cR0($,Z,Q,Y="GET",X){let G=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(G.status===404&&X){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))G=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function vz6($){return St$.includes($)}var qz6,It$=524288,Mz6=65536,kz6=1e4,Mt$=2000,Vz6,lR0,O5,St$,Ct$=()=>{let $=new $1;$.use("/:virtualMcpId/:branch/*",Vz6),$.post("/:virtualMcpId/:branch/write",(Q)=>J7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>J7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>J7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>J7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>J7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>J7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>J7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:yf(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return J7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return J7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>J7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>J7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!vz6(Y))return Q.json({error:`step must be one of: ${St$.join(", ")}`},400);let X=Q.get("vmClaim"),G=await dX1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await Cz6(Q);if(!G)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,O5);if(Y==="start"){let J=p(Q.var.studioContext),W=kh(X.virtualMcpMetadata);try{await Sw0({ctx:Q.var.studioContext,runner:G,handle:X.claimName,orgId:J.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return J7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return vN(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Sn$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Vt$(Q);return Z(Q)});let Z=(Q)=>J7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Mt$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Vt$(Q);return J7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Mt$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),G=await Ec(Q),J=await hR0(G,Y.branch,X.base);return Q.json(J,200,O5)}catch(X){return UG1(Q,X)}return J7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,O5);let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:G,connectionIds:J}=Q.get("vmClaim"),W=Q.var.studioContext;return B00(X,async()=>{try{await mX1(W,Y,X);let K=N00(G,J);if(K)await qt$(W,Y,X,K)}catch(K){if(K instanceof pL)return Q.json({error:K.message},403,O5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,O5)}return J7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return B00(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),G=Array.isArray(X.filepaths)?X.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return Q.json({error:"filepaths is required"},400,O5);try{let J=await Ec(Q);return await zt$(J,Y.branch,G),Q.json({ok:!0},200,O5)}catch(J){let W=VJ(J)===409||J instanceof h5?409:502,K=J instanceof Error?J.message:String(J);return Q.json({error:K},W,O5)}});return B00(Y.claimName,()=>J7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return B00(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Ec(Q),H=W.base??await K.getDefaultBranch();return await uR0(K,Y.branch,H),Q.json({ok:!0},200,O5)}catch(W){return UG1(Q,W)}});let X=gf(Q);if(X instanceof Response)return X;let{claimName:G}=Q.get("vmClaim"),J=Q.var.studioContext;return B00(G,async()=>{try{await mX1(J,X,G)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,O5)}return J7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",S5({maxSize:It$,onError:(Q)=>Q.json({error:"Payload too large"},413,O5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=gf(Q);if(H instanceof Response)return H;X=H}let{claimName:G,userId:J,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=nX1(F)&&N?[F,U]:X?await Promise.all([cR0(X,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),cR0(X,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Ec(Q);return Promise.all([gR0(w,Y.branch),hR0(w,Y.branch)])})(),L=await bn$(K,B,O);return Q.json(L,200,O5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,O5);return Q.json({error:F},502,O5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",S5({maxSize:It$,onError:(Q)=>Q.json({error:"Payload too large"},413,O5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=gf(Q);if(H instanceof Response)return H;X=H}let{claimName:G,userId:J,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=nX1(F)&&N?[F,U]:X?await Promise.all([cR0(X,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),cR0(X,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Ec(Q);return Promise.all([gR0(w,Y.branch),hR0(w,Y.branch)])})(),L=await yn$(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,O5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,O5);return Q.json({error:F},502,O5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),G=Q.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Q.json({error:"Path not allowed"},403);let J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,"");return kt$(Q,`${W}${G}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",S5({maxSize:Mz6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=gf(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let J;try{J=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return Q.json({error:"Invalid JSON body"},400);let W=Pt$(J);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=At$(G,W.resolveType);return kt$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var _t$=D(()=>{h$();tW();Nc();cX1();Io();Mn$();_J();Vh();kn$();OW();Vn$();Cn$();js0();ko();rX1();gn$();oZ();cZ();HG1();Tt$();FG1();qz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Vz6=IR0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=p0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=p(Q)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{Iz6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(G);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=ot({orgId:X.id,virtualMcpId:G,branch:J}),H=await bo0(Q,J),F=xo0(H,Y),U=In$({userId:F,projectRef:K}),N=W.metadata??null,B=await Sz6($,{claimName:U,branch:J,virtualMcpId:G,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await PY(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});lR0=new Map;O5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};St$=["clone","install","start"]});function vt$($,Z,Q){let Y=NG1.get($);if(!Y)Y={pending:null,running:!1},NG1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[J,W]of Object.entries(Q.set??{}))X.set.set(J,W),X.del.delete(J);for(let J of Q.delete??[])X.del.add(J),X.set.delete(J);let G=new Promise((J,W)=>{X.resolvers.push(J),X.rejecters.push(W)});if(!Y.running)bz6($,Y);return G}async function bz6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await xz6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)NG1.delete($)}}async function xz6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let G=0;;G++){let J=await wc(Z,Q),W=await Z.listDecofileEntries(J,Y),K=JG1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=WG1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await Dt$(Z.repo,L);let w=O[0]??`${bR0(Y)}/${eX1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of WG1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return J;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Lt$(Z,F.values(),X),{decofile:B,skipped:O}=W00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:WW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:yz6($),expectedHead:J,changes:H});return N}catch(N){if(!(N instanceof h5)||G>=fz6-1)throw N;await z$(H7(2000,200,G,2,0.5))}}}function yz6($){let Z=(X)=>{let G=X.slice(0,3).join(", ");return X.length>3?`${G} (+${X.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Ko0(Y,$.deps.coAuthor)}var fz6=3,NG1;var ft$=D(()=>{EL0();VR0();u5();L8();oZ();xR0();NG1=new Map});import{createHmac as bt$,randomBytes as gz6,timingSafeEqual as hz6}from"crypto";function xt$(){if(dR0)return dR0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return dR0=$?Buffer.from($):gz6(32),dR0}function BG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+uz6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=bt$("sha256",xt$()).update(Y).digest("base64url");return`${Y}.${X}`}function yt$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),G=Buffer.from(bt$("sha256",xt$()).update(Y).digest("base64url"));if(X.length!==G.length||!hz6(X,G))return!1;let J;try{J=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var uz6=21600000,dR0=null;var gt$=D(()=>{E$()});import{z as jc}from"zod";function cz6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&lz6.test($)}function dt$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function O00($){let Z=$.get("decofileScope");return dg($.var.studioContext,Z.organizationId,Z.githubRepo)}function D00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof h5)return $.json({error:Q},409);let Y=VJ(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function mt$(){let $=new $1;return $.use("/:virtualMcpId/:branch",ct$),$.use("/:virtualMcpId/:branch/*",ct$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await wt$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(X.decofile,200,{...G,"content-type":"application/json"});let J=BG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(dt$(Z))},"decofile":${X.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Y){return D00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await O00(Z),G=await X.readFileAtRef(Q.branch,Y);if(G===null){let J=await X.getDefaultBranch();if(J!==Q.branch)G=await X.readFileAtRef(J,Y)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return D00(Z,X)}}),$.patch("/:virtualMcpId/:branch",mz6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=iz6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let G=X.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{kR0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(aX1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await O00(Z),W=await vt$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Bc(Y)},G),K=BG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:dt$(Z)})}catch(J){return D00(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await Y.mergeBranches(X,Q.branch,G)}catch(W){if(VJ(W)!==409)throw W;await uR0(Y,Q.branch,X),J=await Y.mergeBranches(X,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(VJ(J)===409)return Z.json({error:"merge-conflict"},409);if(VJ(J)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw J}}catch(Y){return D00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:G,behindBy:J,lastCommitAt:W?.committedAt??null})}catch(G){if(VJ(G)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Y){return D00(Z,Y)}}),$}var lz6,ht$=500,ut$=1048576,lt$=1024,dz6=8388608,mz6,iz6,ct$;var it$=D(()=>{zs0();VR0();h$();tW();cX1();MR0();FG1();oZ();ft$();gt$();HG1();xR0();lz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mz6=S5({maxSize:dz6,onError:($)=>$.json({error:"Payload too large"},413)}),iz6=jc.object({set:jc.record(jc.string(),jc.unknown()).optional(),delete:jc.array(jc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=ht$,{message:`Patch cannot touch more than ${ht$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=ut$),{message:`Each block must be at most ${ut$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=lt$),{message:`Each block key must be at most ${lt$} characters`}),ct$=IR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!X||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!cz6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!yt$(B,{organizationId:Y.id,virtualMcpId:X,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!vw0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=N00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var pt$=($)=>{let Z=new $1;if(Z.use("*",Af),Z.use("*",Cd$),Z.route("/",h20()),Z.route("/",Hm$()),Z.route("/",ed$()),Z.route("/",Bn$()),Z.route("/",Fn$()),Z.route("/",TR0()),Z.route("/tools",zn$()),Z.route("/",wn$()),Z.route("/",cp$({kvStorage:$.kvStorage})),Z.route("/",up$()),Z.route("/fs",Zn$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ct$()),Z.route("/decofile",mt$()),Z.route("/",Wn$()),Z.route("/",Yn$()),Z.route("/deco-sites",l20()),Z.route("/hosting",cd$()),Z.route("/monitor",od$()),Z.route("/sso",v20()),Z.route("/",RR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",yd$()),$.mountDevAssets)Z.route("/dev-assets",i20({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",nu$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Gn$()),Z.route("/mcp",yj0()),Z.route("/mcp/self",AR0()),Z.route("/mcp",uj0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var nt$=D(()=>{h$();_d$();R20();gd$();KY1();dd$();rd$();p20();Ce();YY1();LY1();lp$();dp$();Qn$();Xn$();vr();sQ1();lj0();bX1();Jn$();Kn$();Un$();On$();En$();yX1();Pn$();gX1();gj0();_t$();it$()});function pz6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var nz6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},tt$=()=>{let $=new $1;return $.use("*",nz6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let G=await xX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:pz6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var ot$=D(()=>{h$();E$();CT0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function YP6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function XP6($,Z,Q){try{return JSON.parse($)}catch{throw new at$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function GP6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:XP6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function JP6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?RG(Q.function.parameters):RG({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function WP6($){if(!$)return;return{openai:{response_format:$}}}function KP6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function rt$($,Z,Q,Y,X,G){let J={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:G};return X?{...J,providerOptions:X}:J}function st$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var tz6=256,oz6,rz6,sz6,az6,ez6,$P6,ZP6,QP6,at$,et$,$o$;var Zo$=D(()=>{S4();h$();Nc();HN();oz6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),rz6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),sz6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(rz6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),az6=M1.object({type:M1.literal("text")}),ez6=M1.object({type:M1.literal("json_object")}),$P6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),ZP6=M1.union([az6,ez6,$P6]),QP6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(sz6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(oz6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:ZP6.optional(),user:M1.string().optional()});at$=class at$ extends Error{constructor($){super($);this.name="MessageConversionError"}};et$=new $1;et$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=QP6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=X.data,J=YP6(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QE(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=GP6(G.messages),N=G.tools?JP6(G.tools):void 0,B=WP6(G.response_format),O=KP6(),L=Math.floor(Date.now()/1000);if(G.stream)return vN($,async(w)=>{let E=rt$(F,U,N,G,B,$.req.raw.signal);try{let j=gD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=tz6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:st$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=rt$(F,U,N,G,B,$.req.raw.signal),E=await xD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:st$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(GF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(GF(X.message,"server_error"),500)}});$o$=et$});function HP6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Qo$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!UY(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of J){if(!H.slug||B9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(Q8$(U)!==G)continue;if(!HP6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Yo$=D(()=>{h$();OU()});var Go$;var Xo$=D(()=>{Go$={name:"decocms",version:"4.353.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function NP6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??UP6}}var Jo$,UP6="https://ph.studio.decocms.com",Wo$;var Ko$=D(()=>{h$();uZ0();Wv();v5();E$();yQ1();Xo$();Jo$=new $1;Jo$.get("/",($)=>{let Z={version:Go$.version,theme:qo1(),...KU().logo&&{logo:KU().logo},...rU()&&{internalUrl:nb1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:Sc$(),posthog:NP6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:T00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Wo$=Jo$});function zc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function OG1($){return(zc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Fo$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zc($))}&sz=${Z}`}function Ho$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Uo$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,G=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Ho$(`${X.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Ho$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var hf,BP6,OP6,DP6,LP6,No$;var Bo$=D(()=>{hf=c0.enum(["good","bad","neutral"]),BP6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:hf.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),OP6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(BP6)),DP6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},LP6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:hf.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:hf.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(OP6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:hf.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:hf.optional()})).min(1)})]),No$=c0.object({...DP6,template:LP6})});function mR0($){let Z=[],Q=[...$.sections].sort((X,G)=>X.position-G.position).map((X)=>{let G=No$.safeParse(X.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var DG1=D(()=>{Bo$()});import{join as Oo$}from"path";async function EP6($){try{let Z=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(wP6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=mR0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),G=X?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Y.meta.brand?.trim()||OG1($),score:Y.meta.scores?.cover??J?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function dG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function jP6($,Z){let Q=zc($),Y=Z?.brand?.trim()||OG1(Q),X=Fo$(Q,128),J=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Uo$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${dG(W)}</title>`,`<meta name="description" content="${dG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${dG(W)}" />`,`<meta property="og:description" content="${dG(K)}" />`,`<meta property="og:url" content="${dG(J)}" />`,`<meta property="og:image" content="${dG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${dG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${dG(W)}" />`,`<meta name="twitter:description" content="${dG(K)}" />`,`<meta name="twitter:image" content="${dG(H)}" />`,`<meta name="twitter:image:alt" content="${dG(F)}" />`,`<link rel="canonical" href="${dG(J)}" />`,`<link rel="icon" href="${dG(X)}" sizes="any" />`].join(`
+`;await Dt$(Z.repo,L);let w=O[0]??`${bR0(Y)}/${eX1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of WG1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return J;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Lt$(Z,F.values(),X),{decofile:B,skipped:O}=W00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:WW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:yz6($),expectedHead:J,changes:H});return N}catch(N){if(!(N instanceof h5)||G>=fz6-1)throw N;await z$(H7(2000,200,G,2,0.5))}}}function yz6($){let Z=(X)=>{let G=X.slice(0,3).join(", ");return X.length>3?`${G} (+${X.length-3} more)`:G},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Ko0(Y,$.deps.coAuthor)}var fz6=3,NG1;var ft$=D(()=>{EL0();VR0();u5();L8();oZ();xR0();NG1=new Map});import{createHmac as bt$,randomBytes as gz6,timingSafeEqual as hz6}from"crypto";function xt$(){if(dR0)return dR0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return dR0=$?Buffer.from($):gz6(32),dR0}function BG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+uz6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=bt$("sha256",xt$()).update(Y).digest("base64url");return`${Y}.${X}`}function yt$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),G=Buffer.from(bt$("sha256",xt$()).update(Y).digest("base64url"));if(X.length!==G.length||!hz6(X,G))return!1;let J;try{J=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var uz6=21600000,dR0=null;var gt$=D(()=>{E$()});import{z as jc}from"zod";function cz6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&lz6.test($)}function dt$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function O00($){let Z=$.get("decofileScope");return dg($.var.studioContext,Z.organizationId,Z.githubRepo)}function D00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof h5)return $.json({error:Q},409);let Y=VJ(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function mt$(){let $=new $1;return $.use("/:virtualMcpId/:branch",ct$),$.use("/:virtualMcpId/:branch/*",ct$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await wt$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),G={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,G);if(!Q.userId)return Z.body(X.decofile,200,{...G,"content-type":"application/json"});let J=BG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(dt$(Z))},"decofile":${X.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Y){return D00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await O00(Z),G=await X.readFileAtRef(Q.branch,Y);if(G===null){let J=await X.getDefaultBranch();if(J!==Q.branch)G=await X.readFileAtRef(J,Y)}if(G===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(G,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return D00(Z,X)}}),$.patch("/:virtualMcpId/:branch",mz6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=iz6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let G=X.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{kR0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);if(aX1(J))return Z.json({error:`Block key "${J}" collides with a framework resolver module and cannot be written`},400)}try{let J=await O00(Z),W=await vt$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:J,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Bc(Y)},G),K=BG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:dt$(Z)})}catch(J){return D00(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${Q.branch}`;try{let J;try{J=await Y.mergeBranches(X,Q.branch,G)}catch(W){if(VJ(W)!==409)throw W;await uR0(Y,Q.branch,X),J=await Y.mergeBranches(X,Q.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(VJ(J)===409)return Z.json({error:"merge-conflict"},409);if(VJ(J)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw J}}catch(Y){return D00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await O00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:G,behindBy:J},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:G,behindBy:J,lastCommitAt:W?.committedAt??null})}catch(G){if(VJ(G)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw G}}catch(Y){return D00(Z,Y)}}),$}var lz6,ht$=500,ut$=1048576,lt$=1024,dz6=8388608,mz6,iz6,ct$;var it$=D(()=>{zs0();VR0();h$();tW();cX1();MR0();FG1();oZ();ft$();gt$();HG1();xR0();lz6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mz6=S5({maxSize:dz6,onError:($)=>$.json({error:"Payload too large"},413)}),iz6=jc.object({set:jc.record(jc.string(),jc.unknown()).optional(),delete:jc.array(jc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=ht$,{message:`Patch cannot touch more than ${ht$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=ut$),{message:`Each block must be at most ${ut$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=lt$),{message:`Each block key must be at most ${lt$} characters`}),ct$=IR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!X||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!cz6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=Q.auth?.user?.id??null;if(!J){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!yt$(B,{organizationId:Y.id,virtualMcpId:X,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!vw0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=N00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:G,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:J}),Z()})});var pt$=($)=>{let Z=new $1;if(Z.use("*",Af),Z.use("*",Cd$),Z.route("/",h20()),Z.route("/",Hm$()),Z.route("/",ed$()),Z.route("/",Bn$()),Z.route("/",Fn$()),Z.route("/",TR0()),Z.route("/tools",zn$()),Z.route("/",wn$()),Z.route("/",cp$({kvStorage:$.kvStorage})),Z.route("/",up$()),Z.route("/fs",Zn$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ct$()),Z.route("/decofile",mt$()),Z.route("/",Wn$()),Z.route("/",Yn$()),Z.route("/deco-sites",l20()),Z.route("/hosting",cd$()),Z.route("/monitor",od$()),Z.route("/sso",v20()),Z.route("/",RR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",yd$()),$.mountDevAssets)Z.route("/dev-assets",i20({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",nu$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Gn$()),Z.route("/mcp",yj0()),Z.route("/mcp/self",AR0()),Z.route("/mcp",uj0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var nt$=D(()=>{h$();_d$();R20();gd$();KY1();dd$();rd$();p20();Ce();YY1();LY1();lp$();dp$();Qn$();Xn$();vr();sQ1();lj0();bX1();Jn$();Kn$();Un$();On$();En$();yX1();Pn$();gX1();gj0();_t$();it$()});function pz6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var nz6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},tt$=()=>{let $=new $1;return $.use("*",nz6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let G=await xX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:pz6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var ot$=D(()=>{h$();E$();CT0()});import{z as M1}from"zod";function GF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function YP6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function XP6($,Z,Q){try{return JSON.parse($)}catch{throw new at$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function GP6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:XP6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function JP6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?RG(Q.function.parameters):RG({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function WP6($){if(!$)return;return{openai:{response_format:$}}}function KP6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function rt$($,Z,Q,Y,X,G){let J={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:G};return X?{...J,providerOptions:X}:J}function st$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var tz6=256,oz6,rz6,sz6,az6,ez6,$P6,ZP6,QP6,at$,et$,$o$;var Zo$=D(()=>{S4();h$();Nc();HN();oz6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),rz6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),sz6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(rz6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),az6=M1.object({type:M1.literal("text")}),ez6=M1.object({type:M1.literal("json_object")}),$P6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),ZP6=M1.union([az6,ez6,$P6]),QP6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(sz6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(oz6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:ZP6.optional(),user:M1.string().optional()});at$=class at$ extends Error{constructor($){super($);this.name="MessageConversionError"}};et$=new $1;et$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(GF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(GF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(GF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=QP6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(GF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=X.data,J=YP6(G.model);if(!J)return $.json(GF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QE(j.providerId));if(!E)return $.json(GF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(GF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=GP6(G.messages),N=G.tools?JP6(G.tools):void 0,B=WP6(G.response_format),O=KP6(),L=Math.floor(Date.now()/1000);if(G.stream)return vN($,async(w)=>{let E=rt$(F,U,N,G,B,$.req.raw.signal);try{let j=gD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=tz6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:st$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=rt$(F,U,N,G,B,$.req.raw.signal),E=await xD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:st$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(GF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(GF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(GF(X.message,"server_error"),500)}});$o$=et$});function HP6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Qo$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!UY(G))return Z.json({error:"Invalid site slug"},400);let J=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of J){if(!H.slug||B9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(Q8$(U)!==G)continue;if(!HP6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Yo$=D(()=>{h$();OU()});var Go$;var Xo$=D(()=>{Go$={name:"decocms",version:"4.353.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function NP6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??UP6}}var Jo$,UP6="https://ph.studio.decocms.com",Wo$;var Ko$=D(()=>{h$();uZ0();Wv();v5();E$();yQ1();Xo$();Jo$=new $1;Jo$.get("/",($)=>{let Z={version:Go$.version,theme:qo1(),...KU().logo&&{logo:KU().logo},...rU()&&{internalUrl:nb1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:Sc$(),posthog:NP6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:T00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Wo$=Jo$});function zc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function OG1($){return(zc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Fo$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zc($))}&sz=${Z}`}function Ho$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Uo$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,G=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Ho$(`${X.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Ho$(`How does ${Q} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var hf,BP6,OP6,DP6,LP6,No$;var Bo$=D(()=>{hf=c0.enum(["good","bad","neutral"]),BP6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:hf.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),OP6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(BP6)),DP6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},LP6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:hf.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:hf.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:hf.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(OP6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:hf.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:hf.optional()})).min(1)})]),No$=c0.object({...DP6,template:LP6})});function mR0($){let Z=[],Q=[...$.sections].sort((X,G)=>X.position-G.position).map((X)=>{let G=No$.safeParse(X.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var DG1=D(()=>{Bo$()});import{join as Oo$}from"path";async function EP6($){try{let Z=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(wP6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=mR0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),G=X?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Y.meta.brand?.trim()||OG1($),score:Y.meta.scores?.cover??J?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function dG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function jP6($,Z){let Q=zc($),Y=Z?.brand?.trim()||OG1(Q),X=Fo$(Q,128),J=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Uo$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${dG(W)}</title>`,`<meta name="description" content="${dG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${dG(W)}" />`,`<meta property="og:description" content="${dG(K)}" />`,`<meta property="og:url" content="${dG(J)}" />`,`<meta property="og:image" content="${dG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${dG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${dG(W)}" />`,`<meta name="twitter:description" content="${dG(K)}" />`,`<meta name="twitter:image" content="${dG(H)}" />`,`<meta name="twitter:image:alt" content="${dG(F)}" />`,`<link rel="canonical" href="${dG(J)}" />`,`<link rel="icon" href="${dG(X)}" sizes="any" />`].join(`
     `)}function zP6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Do$($){let Z=new $1;return Z.get("/:domain/og.png",async(Q)=>{let Y=zc(Q.req.param("domain")),X=async()=>{let G=$?Bun.file(Oo$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return Q.notFound();return Q.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${hK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(PP6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return X();return Q.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?Oo$($,"index.html"):null,G=X?Bun.file(X):null;if(!G||!await G.exists())return Q.notFound();let J=await G.text();try{let W=await EP6(zc(Y)),K=jP6(Y,W);return Q.html(zP6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(J)}}),Z}var wP6=2500,PP6=1e4;var Lo$=D(()=>{h$();DG1();Hj();E$()});function L00($,Z){return fetch(`${hK({})}${$}`,Z)}async function AP6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",G=await L00(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=mR0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var TP6,bN,wo$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Eo$;var jo$=D(()=>{h$();UG();Hj();DG1();TP6=new Set(["complete","errored","terminated","unknown"]),bN=new $1;bN.use("*",async($,Z)=>{let Q=await Q8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});bN.use("/link-token/*",wo$);bN.use("/suggest",wo$);bN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let G=await AP6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});bN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,G=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let J=await L00("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Kj({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});bN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await L00(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${Kj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",G={done:TP6.has(X),status:X};return $.json(G)}catch{return $.json({error:"status failed"},502)}});bN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await L00(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});bN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await L00(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});Eo$=bN});import{createHmac as RP6,timingSafeEqual as qP6}from"crypto";function Po$($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,G=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")G.push(N)}if(!X||G.length===0)return!1;let J=Number(X);if(!Number.isFinite(J)||Math.abs(Y/1000-J)>IP6)return!1;let W=RP6("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&qP6(K,F)})}function Ao$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=F3(Z),Y=F3(F3(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:JF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function To$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function JF($){return typeof $==="string"?$:void 0}function F3($){return typeof $==="object"&&$!==null?$:void 0}function iR0($){return typeof $==="number"?new Date($*1000):null}function EG1($){return JF($)??JF(F3($)?.id)}function MP6($){return EG1($.subscription)??JF(F3(F3($.parent)?.subscription_details)?.subscription)}function kP6($){let Z=iR0($.current_period_end);if(Z)return Z;let Q=F3($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let G=F3(X)?.current_period_end;if(typeof G==="number"&&G>Y)Y=G}return Y>0?new Date(Y*1000):null}function LG1($,Z){let Q=iR0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function wG1($,Z){let Q=iR0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function VP6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=JF(F3(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(JF(F3(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(JF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=JF(Q.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let W=Number(F3(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:F3(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(JF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.getBilling(Y);if(!X)return{handled:!1,reason:"unknown org"};let G=EG1(Q.subscription);if(X.stripeSubscriptionId&&G&&X.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(LG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y,{stripeCustomerId:EG1(Q.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:wG1(Z,X)}),{handled:!0,organizationId:Y}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=JF(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&LG1(Z,X))return{handled:!1,reason:"stale event"};let J=G?"canceled":To$(Q.status);return await $.updateStripeState(X.organizationId,{status:J,currentPeriodEnd:kP6(Q),...G&&{stripeSubscriptionId:null},lastStripeEventAt:wG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}case"invoice.paid":{let Y=MP6(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(LG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:iR0(Q.period_end),lastStripeEventAt:wG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function SP6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:To$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function zo$($,Z){let Q=SP6($,Z);if(!Q)return;JG({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:vs1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function Ro$($){let Z=new bK(Z8().db),Q=await VP6(Z,$);if(!(Q.handled&&Q.topUp))zo$($,Q);if(Q.handled&&Q.topUp)await rT$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),zo$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await s8$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(Y){if(!(Y instanceof NG&&(Y.status===400||Y.status===404)))throw Y}return Q}var IP6=300;var qo$=D(()=>{PJ();g4();AZ0();Cj();N41()});var CP6=1048576,jG1;var Io$=D(()=>{h$();tW();E$();qo$();jG1=new $1;jG1.post("/webhook",S5({maxSize:CP6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=M0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!Po$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=Ao$(Q);if(!X)return $.json({error:"invalid payload"},400);let G=await Ro$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as _P6}from"crypto";function bP6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return _P6(Buffer.from(X),Buffer.from(Y))}function xP6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let G=[];if($==="check_suite"){if(Q.action!=="completed")return[];let J=Q.check_suite?.pull_requests;for(let W of Array.isArray(J)?J:[]){let K=W?.number;if(typeof K==="number")G.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let J=Q.issue.number;if(typeof J==="number")G.push(J)}return[...new Set(G)].map((J)=>({repoOwner:X,repoName:Y,number:J}))}function Mo$($){let Z=new $1;return Z.post("/webhook",S5({maxSize:vP6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!bP6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let G=Q.req.header("x-github-event");if(G!=="push"&&!fP6.has(G??""))return Q.json({ok:!0,ignored:"event"});let J;try{J=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(G==="push"){let H=J.ref,F=J.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await _o0())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=xP6(G??"",J);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await yP6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function yP6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),G;try{G=await X.findPrLinks(Y)}catch(J){console.error("[github-webhook] pr link lookup failed:",J);continue}for(let J of G)try{let W=await X.getById(J.taskBoardItemId,J.organizationId),K=W?await $.contextFactory()(J.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await kO$(K,J.organizationId,J.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${J.taskBoardItemId}:`,W)}}return Q}var vP6=5242880,fP6;var ko$=D(()=>{h$();tW();OW();TZ();fP6=new Set(["check_suite","issue_comment"])});function Vo$($){let Z=new TN($.db,new eQ($.encryptionKey)),Q=new $1;return Q.get("/attachments/:token",async(Y)=>{let X=pN$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let G=await Z.getByOrg(X.organizationId);if(!G)return Y.json({error:"Jira is not connected"},404);let W=await new MG(G.siteUrl,G.email,G.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var So$=D(()=>{h$();IB();ns0();m_()});function Co$($){let Z=new TN($.db,new eQ($.encryptionKey));async function Q(X,G){let J=Vb$(G);if(!J)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await PH($.db,W.organizationId);if(!K)return;if(await vT0(K,W,J)==="started")console.log(`[jira-webhook] started a run for ${J.issueKey} entering "${J.toStatus}"`)}let Y=new $1;return Y.post("/webhook/:secret",S5({maxSize:gP6}),async(X)=>{let G=X.req.param("secret");if(!await Z.getByWebhookSecret(G))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(G,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var gP6=1048576;var _o$=D(()=>{h$();tW();IB();fT0();lh()});import{DBOS as pR0,SchedulerMode as hP6}from"@dbos-inc/dbos-sdk";function fo$($){PG1=$}function bo$(){if(!PG1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return PG1}function xo$(){let $=bo$();return new TN($.db,new eQ($.encryptionKey))}async function cP6($,Z){try{let Q=await xo$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await PH(bo$().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let G=new MG(Q.siteUrl,Q.email,Q.apiToken),W=`(${await G.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${vo$}m"`,K=0,H;for(let F=0;F<lP6;F++){let U=await G.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=Sb$(N,N.changelog?.histories??[],Z);for(let O of B)if(await vT0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function dP6($,Z){let Q=new Date($.getTime()-vo$*60000),Y=await pR0.runStep(()=>xo$().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((G)=>pR0.runStep(()=>cP6(G,Q),{name:`sweepJira:${G}`})));for(let G of X)if(G.error)console.warn(`[jira-trigger] integration ${G.integrationId} failed: ${G.error}`);else if(G.started>0)console.log(`[jira-trigger] integration ${G.integrationId} started ${G.started} run(s) the webhook missed`)}function yo$(){if(zG1)return;zG1=pR0.registerWorkflow(dP6,{name:"jiraTriggerSweepWorkflow"}),pR0.registerScheduled(zG1,{name:"jiraTriggerSweepWorkflow",crontab:uP6,mode:hP6.ExactlyOncePerIntervalWhenActive})}var uP6="7-59/10 * * * *",vo$=15,lP6=5,PG1=null,zG1=null;var go$=D(()=>{IB();lh();m_();fT0()});function ho$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var uo$,mP6,iP6,lo$;var co$=D(()=>{h$();n3();ih();wj();uo$=new $1,mP6=["range","if-none-match","if-modified-since"],iP6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];uo$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(dl($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Y$(401,{message:"Authentication required"})}if(!Q)throw new Y$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new Y$(400,{message:"Missing file key"});let X=await Xr(Y,Z);if(!X)throw new Y$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&rY()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Y$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return ho$(N,H),new Response(U,{status:200,headers:N})}let G=new Headers;for(let K of mP6){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(X,{headers:G});if(J.status===403||J.status===404)throw new Y$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Y),new Y$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of iP6){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),ho$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});lo$=uo$});var w00=_((uf)=>{var pP6=uf&&uf.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),nP6=uf&&uf.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))pP6(Z,$,Q)};Object.defineProperty(uf,"__esModule",{value:!0});nP6(mX(),uf)});var io$=_((do$)=>{Object.defineProperty(do$,"__esModule",{value:!0});do$.version=void 0;do$.version="3.4.0"});var to$=_((WF)=>{var tP6=WF&&WF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(WF,"__esModule",{value:!0});WF.NodeTransport=WF.VERSION=void 0;WF.nodeResolveHost=$A6;var G5=w00(),oP6=z0("net"),AG1=z0("tls"),rP6=z0("path"),po$=z0("fs"),sP6=tP6(z0("dns")),aP6=io$();WF.VERSION=aP6.version;var eP6="nats.js";class no${socket;version;lang;yields=[];signal=(0,G5.deferred)();closedNotification=(0,G5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=eP6,this.version=WF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,G5.checkOptions)(X,Z);let{tls_required:G,tls_available:J}=X,W=J===!0&&Z.tls!==null;if(!Y&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw G5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let G=X;if(!G)G=new G5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new G5.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,G5.deferred)(),Q,Y=(0,oP6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,G5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=G5.DataBuffer.concat(...this.yields),X=(0,G5.extractProtocolMessage)(Y);if(X!=="")try{let G=G5.INFO.exec(X);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,G5.deferred)();try{if($=(0,rP6.resolve)($),!(0,po$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,po$.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,G5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new G5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,G5.deferred)();try{let X=(0,AG1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(G)=>{Z=G}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new G5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,G5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new G5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,G5.deferred)();try{let Y=(0,AG1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new G5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,G5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,G5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof AG1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,G5.render)($)}`);let Z=(0,G5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,G5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,G5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}WF.NodeTransport=no$;function $A6($){let Z=(0,G5.deferred)();return sP6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let G of Y)X.push(G.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var eo$=_((ao$)=>{Object.defineProperty(ao$,"__esModule",{value:!0});ao$.connect=ZA6;var oo$=to$(),ro$=w00(),so$=w00();function ZA6($={}){if((0,so$.hasWsProtocol)($))return Promise.reject(so$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,ro$.setTransportFactory)({factory:()=>{return new oo$.NodeTransport},dnsResolveFn:oo$.nodeResolveHost}),ro$.NatsConnectionImpl.connect($)}});var $r$=_((xN)=>{var YA6=xN&&xN.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),XA6=xN&&xN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))YA6(Z,$,Q)};Object.defineProperty(xN,"__esModule",{value:!0});xN.connect=void 0;var GA6=eo$();Object.defineProperty(xN,"connect",{enumerable:!0,get:function(){return GA6.connect}});XA6(w00(),xN)});function Xr$($){let Z=$?.connectFn??HA6,Q=null,Y=null,X=!1,G=!1,J=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!G)try{Q=await Z({servers:N,timeout:KA6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,J=!1,F(Q),H();return}catch{O++;let L=H7(WA6,JA6,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,G=!1;let O=B?.creds?Zr$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=Yr$.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(G=!0,X=!1,Y=null,J=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function HA6($){return Qr$.connect($)}var Zr$,Qr$,Yr$,JA6=100,WA6=3000,KA6=3000;var Gr$=D(()=>{L8();Zr$=V(ic(),1),Qr$=V($r$(),1),Yr$=V(EF(),1)});function TG1($,Z){return`${$}.${Z}`}class RG1{cache;constructor($){this.cache=_l({ttlMs:$?.ttlMs??FA6,maxSize:$?.maxSize??UA6})}async get($,Z){return this.cache.get(TG1($,Z))??null}async set($,Z,Q){this.cache.set(TG1($,Z),Q)}async invalidate($,Z){this.cache.delete(TG1($,Z))}teardown(){this.cache.clear()}}var FA6=600000,UA6=5000;var Jr$=()=>{};function nR0($,Z){return`${$}:${Z}`}function qG1($){let Z=_l({ttlMs:$?.ttlMs??NA6,maxSize:$?.maxSize??BA6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(Wr$,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(nR0(K,H))},set(K,H,F){Z.set(nR0(K,H),F)},invalidate(K,H){Z.delete(nR0(K,H)),W(K,H)},start(){if(J)return;let K=Q?.();if(!K)return;J=K.subscribe(Wr$),(async()=>{for await(let H of J)try{let F=JSON.parse(G.decode(H.data));if(F.originId===Y)continue;Z.delete(nR0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Wr$="studio.ai-provider-keys.invalidate",NA6=30000,BA6=5000;var Kr$=()=>{};class IG1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let G=JSON.parse(Q.decode(X.data));if(G.originId===this.originId)continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Hr$=($)=>{let Z;return()=>Z??=$()},MG1,kG1;var Fr$=D(()=>{Y6();MG1=Hr$(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),kG1=Hr$(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function zA6($=Br$){return{name:kH,subjects:[`${P01}.>`],storage:aW.StorageType.File,max_age:LA6,max_bytes:EA6,max_msgs_per_subject:jA6,discard:aW.DiscardPolicy.Old,retention:aW.RetentionPolicy.Limits,duplicate_window:wA6,num_replicas:$}}class Or${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Ur$($){let Z=Nr$.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function RA6($,Z){let Q=0;return{publish(Y,X,G,J){Y.publish(X,G,J?{headers:J}:void 0).catch((W)=>{if(Q++,DA6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function qA6($,Z){return $.info?.cluster?Z:1}function IA6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class VG1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let G=zA6(X);try{await Y.streams.info(kH),await Y.streams.update(kH,G)}catch(J){if(J instanceof Error&&J.message.includes("stream not found"))await Y.streams.add(G),await Y.streams.update(kH,G);else if(J instanceof Error&&/can ?not change.*storage|storage type/i.test(J.message))await Y.streams.delete(kH),await Y.streams.add(G);else throw J}},Q=await N4(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await aW.jetstreamManager($),X=qA6($,Br$);try{await Z(Y,X)}catch(G){if(X<=1||!IA6(G))throw G;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${G.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Qu});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=RA6(Z,Y),J=!1,W=()=>{if(J)return;J=!0;let H=hE$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=T01(H,{runId:Z}),N=performance.now()-F;MG1().record(N),kG1().add(1,{"org.id":Y??"unknown"}),TA6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)G.publish(X,B.subject,B.data,B.headers?Ur$(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),AA6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:G.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await N4(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Ur$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Qu}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),G=T01(Z,{runId:$,dedup:Q});MG1().record(performance.now()-X),kG1().add(1);for(let J of G)if(!await this.publishSerialized(Y,J))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=gE$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?aW.DeliverPolicy.New:aW.DeliverPolicy.All,G=Q?.closeOnDone??!1,J=YL($),W;try{W=await N4(async()=>{return(await Y.consumers.get(kH,{filter_subjects:J,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Qu})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=wj0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Bj0()).pipeThrough(Oj0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(G){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(kH,{filter:YL($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var aW,Nr$,OA6=($)=>{let Z;return()=>Z??=$()},DA6,LA6=86400000000000,wA6=120000000000,EA6=4294967296,Br$,jA6=500000,PA6,AA6,TA6;var Dr$=D(()=>{L8();R01();Ej0();Dj0();Y6();Fr$();aW=V(EF(),1),Nr$=V(ic(),1),DA6=OA6(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Br$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);PA6=process.env.STREAM_ENCODE_TRACE==="1",AA6=process.env.DECOPILOT_STREAM_TRACE==="1";TA6=PA6?new Or$:null});function tR0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,EK(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var Lr$=D(()=>{V8()});class SG1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function MA6($,Z){let Q=$.startsWith("thread:")?DW($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function wr$($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let G=await KH($,X);if(!G?.owner||!G?.name)continue;let J=await $.storage.threads.get(X),W=await Kh($,{threadId:X,runBranch:J?.branch}),K=MA6(W,await ML0($,X)),H=await zt($,Q,Jn0(G)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${G.owner}/${G.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await uJ(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var Er$=D(()=>{oZ();_J();TZ()});async function jr$($,Z,Q){let Y=Z.organizationId;if(!jX(Z))return!1;if(!s_(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),G=oK(X?.flags),J=await $.storage.taskBoard.update(Z.id,Y,{status:G},Z.updatedBy);return await k6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:G,reason:"pr_merged"}}),K8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${G}`),!0}var zr$=D(()=>{j4();RQ();hh();qW();$9()});function fA6($){return $ instanceof DY}function bA6($,Z){return Z-$>=_A6}class CG1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??kA6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??SA6,Q=this.options.itemIntervalMs??VA6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),G=X.at(-1);this.cursor=X.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of X)try{if(await this.reconcileItem(J,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-ls0),Ye0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-vA6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await $e0(this.taskBoard,X,Y),await Ze0(this.taskBoard,this.billing,X,Y)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,G)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:G}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let J=await this.taskBoard.getById(Y,X);if(!J||J.status!==A$.progress||J.assigneeId!==n$)continue;let W=await this.contextFactory(X,J.assignedBy??J.createdBy);if(!W)continue;await IW(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,J),fA6(J)){await this.returnToTodo(Y,X,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Y,X,G,new Date(Date.now()+CA6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==A$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),K8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!bA6(jU(Q,Z.reviewCycleStartedAt),Date.now()))return;await jH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!jX(Y))return!1;let X=Y.assigneeId===n$,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!J)return!1;if(G.length===0){if(await wr$(J,Y))G=await this.taskBoard.listPrs($,Z);if(G.length===0){if(X)await this.handOffReviewWithoutPr(J,Y);return!1}}let W=await Promise.all(G.map(async(K)=>({...K,...await ch(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await jr$(J,Y,W))return!0;if(await kj$(J,Y))return!0;if(await this.resolveConflictFromSweep(J,Y,W))return!0;if(!X)return!1;if(!ra0(W))return!1;return await TE0(J,Y,{previewMatchesHead:sa0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await oD($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var kA6=60000,VA6=300000,SA6=50,CA6=60000,_A6=900000,vA6=120000;var Pr$=D(()=>{j4();ga0();Er$();zH();qr();qW();zr$();$9();kJ();Xe0();TZ();$r();uh()});import{readdir as xA6,rm as oR0}from"fs/promises";import{join as rR0}from"path";async function sR0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-yA6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await lf($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await Ar$($,X,Z);else if(!X.startsWith(".")){let G=rR0($,X),J=await lf(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;Q+=await Ar$(G,K,Z)}if((await lf(G)).length===0)await oR0(G,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function Ar$($,Z,Q){let Y=0,X=rR0($,Z),G=await lf(X);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=rR0(X,W),H=await lf(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=rR0(K,U);await oR0(B,{recursive:!0,force:!0}),Y++}}if((await lf(K)).length===0)await oR0(K,{recursive:!0,force:!0})}if((await lf(X)).length===0)await oR0(X,{recursive:!0,force:!0});return Y}async function lf($){try{return(await xA6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var yA6=30;var _G1=()=>{};import{DBOS as vG1,SchedulerMode as gA6}from"@dbos-inc/dbos-sdk";async function uA6(){let $=[N3(),cf(),UF()],Z=0;for(let Q of $)try{Z+=await sR0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function lA6($,Z){await vG1.runStep(()=>uA6(),{name:"monitoringRetention"})}function Rr$(){if(Tr$)return;Tr$=!0;let $=vG1.registerWorkflow(lA6,{name:"monitoringRetentionWorkflow"});vG1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:hA6,mode:gA6.ExactlyOncePerIntervalWhenActive})}var hA6="23 4 * * *",Tr$=!1;var qr$=D(()=>{tG();_G1()});function Ir$($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await qQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let G=await Kr($.db,Z,Y.role);return X.boundAuth=zQ1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:G,userId:Q}),X.access=new XE(Q,void 0,X.boundAuth,Y.role,"self"),rD(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var Mr$=D(()=>{oF();tU()});function cA6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function dA6(){return{services:cA6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function iA6(){for(let $ of mA6)$()}function kr$($){let Z=[...fG1.logs,$];fG1={...fG1,logs:Z.length>500?Z.slice(-500):Z},iA6()}function bG1(){return pA6}var fG1,mA6,pA6=!1;var xG1=D(()=>{fG1=dA6(),mA6=new Set});import{EventEmitter as nA6}from"events";var yG1;var Vr$=D(()=>{xG1();yG1=new nA6;yG1.on("request",($)=>{kr$($)})});function Sr$(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let G="",J=!1;if(X.startsWith("/mcp")&&Y==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Pc(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((E)=>Pc(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${D5.tool}${B}${D5.dim}(${w})${D5.reset}`}else if(N.method)G=`${D5.dim}${Pc(N.method)}${D5.reset}`}}catch{}}let W=Pc(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${D5.mcp}${Pc(F.slice(0,12))}\u2026${D5.reset}`}else if(X==="/mcp")W=`${D5.mcp}/mcp${D5.reset}`;else if(X==="/mcp/registry")W=`${D5.mcp}/mcp/registry${D5.reset}`;let K=oA6(Y),H=J?"\u25C0":"\u2190";if(!bG1())console.log(`${D5.dim}${H}${D5.reset} ${K}${Y}${D5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=tA6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!bG1())console.log(`${D5.dim}${O}${D5.reset} ${K}${Y}${D5.reset} ${W}${G?` ${G}`:""} ${N}${U}${D5.reset} ${D5.duration}${B}${D5.reset}`);yG1.emit("request",{method:Y,path:Pc(X),status:U,duration:F,timestamp:new Date})}}}var D5,tA6=($)=>{if($>=500)return D5.serverError;if($>=400)return D5.clientError;if($>=300)return D5.redirect;return D5.ok},oA6=($)=>{return D5[$]||D5.reset},Pc=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Cr$=D(()=>{xG1();Vr$();D5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as br$}from"crypto";import{mkdir as rA6,readdir as sA6,rm as _r$,stat as xr$}from"fs/promises";import{join as hG1,relative as aA6}from"path";import{z as M$}from"zod";function gr$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return hG1(eA6,Z)}function hr$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function gG1($,Z){let Q=gr$($),Y=hr$(Z);return hG1(Q,Y)}function $T6($,Z,Q,Y){let X=M0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`;return br$("sha256",X).update(G).digest("hex")}function fr$($,Z,Q,Y,X){let G=Math.floor(Date.now()/1000)+Y,J=$T6(Z,Q,G,X),W=new URL(`/api/dev-assets/${Z}/${hr$(Q)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",X),W.toString()}function ur$($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${br$("md5","etag").update(Y).digest("hex")}"`}async function lr$($,Z,Q,Y,X){try{let G=await sA6($,{withFileTypes:!0});for(let J of G){let W=hG1($,J.name),H=aA6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(J.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await lr$(W,Z,Q,Y,X);else if(J.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await xr$(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:ur$(W,F.mtime,F.size)})}catch{}}}}catch{}}function cr$($,Z){let Y=p($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:M$.object({prefix:M$.string().optional(),maxKeys:M$.number().optional().default(1000),continuationToken:M$.string().optional(),delimiter:M$.string().optional()}),outputSchema:M$.object({objects:M$.array(M$.object({key:M$.string(),size:M$.number(),lastModified:M$.string(),etag:M$.string()})),nextContinuationToken:M$.string().optional(),isTruncated:M$.boolean(),commonPrefixes:M$.array(M$.string()).optional()}),handler:async(X)=>{let G=X,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,F=gr$(Y);await rA6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await lr$(F,F,J,K,U),U.objects.sort((w,E)=>w.key.localeCompare(E.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:M$.object({key:M$.string()}),outputSchema:M$.object({contentType:M$.string().optional(),contentLength:M$.number(),lastModified:M$.string(),etag:M$.string(),metadata:M$.record(M$.string(),M$.string()).optional()}),handler:async(X)=>{let G=X,J=gG1(Y,G.key),W=await xr$(J);return{contentType:NY1(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:ur$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:M$.object({key:M$.string(),expiresIn:M$.number().optional()}),outputSchema:M$.object({url:M$.string(),expiresIn:M$.number()}),handler:async(X)=>{let G=X,J=G.expiresIn??vr$;return{url:fr$(Z,Y,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:M$.object({key:M$.string(),expiresIn:M$.number().optional(),contentType:M$.string().optional()}),outputSchema:M$.object({url:M$.string(),expiresIn:M$.number()}),handler:async(X)=>{let G=X,J=G.expiresIn??vr$;return{url:fr$(Z,Y,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:M$.object({key:M$.string()}),outputSchema:M$.object({success:M$.boolean(),key:M$.string()}),handler:async(X)=>{let G=X,J=gG1(Y,G.key);try{return await _r$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:M$.object({keys:M$.array(M$.string()).max(1000)}),outputSchema:M$.object({deleted:M$.array(M$.string()),errors:M$.array(M$.object({key:M$.string(),message:M$.string()}))}),handler:async(X)=>{let G=X,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=gG1(Y,K);try{await _r$(H),J.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function uG1($,Z,Q){let Y=cr$(Z,Q),X=new IK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:z5});for(let J of Y){let W="shape"in J.inputSchema?J.inputSchema.shape:M$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:M$.object({}).shape;X.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let F=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let G=new RY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(G),tJ(X,G,$,"mcp:dev-assets")}async function dr$($,Z,Q,Y){let G=cr$(Q,Y).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var eA6="./data/assets",vr$=3600,yr$,mr$;var ir$=D(()=>{E$();Ku();h$();Li();Rv();XQ();p20();yr$=new $1;yr$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return uG1($.req.raw,Z,Y)});mr$=yr$});var pr$={};T4(pr$,{mountDevRoutes:()=>ZT6});function ZT6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),G=new URL(Y.req.url),J=`${G.protocol}//${G.host}`;return uG1(Y.req.raw,X,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),G=new URL(Y.req.url),J=`${G.protocol}//${G.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await dr$(W,K,X,J);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",mr$);let Q=new $1;Q.use("*",oW({mountPath:"/api/dev-assets"})),Q.route("/",i20({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var nr$=D(()=>{h$();XY1();p20();ir$()});import{sql as QT6}from"kysely";import{randomUUID as tr$}from"crypto";import{z as YT6}from"zod";async function GT6($){let Z=new Date().toISOString(),Q=tr$(),Y=g8.SELF($.organizationId),X="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:tr$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await QT6`SELECT
       pg_notify('studio_events', ${Q}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.353.0",
+  "version": "4.353.2",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/api-keys-C3bN47iA.js DELETED Viewed

@@ -1 +0,0 @@

- import{c as o,j as r}from"./index-CAxyiWUX.js";import{O as m}from"./api-keys-mRCNl8fQ.js";import{R as p}from"./require-capability-Bu1T_yDo.js";import"./AlertCircle-CMbZRyyx.js";import"./Copy01-DJ6YIZzP.js";import"./Key01-CGrwBg5t.js";import"./Plus-D8PEuEgy.js";import"./Trash01-C_Vel1r1.js";import"./alert-dialog-BqNLZYNg.js";import"./dialog-D-uKwXFm.js";import"./input-CitSvqgT.js";import"./label-7SaWrgYE.js";import"./use-mcp-client-BmITSWDc.js";import"./auth-DG9IEB0V.js";import"./access-gate-DIa93VYf.js";import"./capability-load-error-4BGIkSS4.js";function k(){const t=o.c(1);let i;return t[0]===Symbol.for("react.memo_cache_sentinel")?(i=r.jsx(p,{capability:"api-keys:manage",area:"api-keys",children:r.jsx(m,{})}),t[0]=i):i=t[0],i}export{k as default};

package/dist/client/assets/app-editor-CuN05X2t.js DELETED Viewed

@@ -1 +0,0 @@

- import{c as jt,b as Bt,r as A,j as o,l as _t,h as wt,t as ht}from"./index-CAxyiWUX.js";import{b as At}from"./chat-context-BCJQflxC.js";import{i as Et}from"./ChevronRight-BHiyCeas.js";import{S as Nt}from"./scroll-area-Dkowaycv.js";import{u as Rt,A as Tt}from"./use-section-preview-base-P1QgVb19.js";import{n as Ct,r as Kt,c as Pt,d as Ft,e as Ot,g as Ut,h as $t,S as It,i as zt,j as Lt}from"./index-Kh6VnT2D.js";import"./use-panel-navigate-85HGXGn5.js";import"./use-destination-route-DDkyeLXx.js";import"./autosend-BEGnkY84.js";import"./thread-intent-DTzLO3tp.js";import"./slugify-CEUa2lfQ.js";import"./hooks-xKYDzXmT.js";import"./use-mcp-client-BmITSWDc.js";import"./auth-DG9IEB0V.js";import"./delay-CnY5UFtP.js";import"./backoff-CrEUbyZT.js";import"./decopilot-sse-pool-CjBfWywC.js";import"./task-board-BkZ3ZsEu.js";import"./schema-CI82sAmn.js";import"./use-is-desktop-app-BNujXJc_.js";import"./use-virtual-mcp-CMCUUQtS.js";import"./use-ai-providers-D4l2pJBE.js";import"./location-oTTXFrSF.js";import"./use-decopilot-events-ClpFiFWE.js";import"./thread-route-BSCCkF_C.js";import"./dialog-D-uKwXFm.js";import"./Check-DobcY0eV.js";import"./Copy01-DJ6YIZzP.js";import"./Download01-B-xCoyh9.js";import"./use-organization-settings-DKZN8RUD.js";import"./select-B319mTcJ.js";import"./ChevronUp-CMgbFVj1.js";import"./agent-icon-CUvxlB2H.js";import"./AlertCircle-CMbZRyyx.js";import"./Tool01-lhbmtMl1.js";import"./ArrowUp-Kp8iOYqA.js";import"./ArrowLeft-D6wg9dRX.js";import"./Tool02-DzjxjRKe.js";import"./ArrowRight-S9PiBhNR.js";import"./TrendUp01-BLLPVsmc.js";import"./ZoomOut-CENrF5Nr.js";import"./Users03-CGlyslgC.js";import"./CheckCircle-BfaYLY9R.js";import"./ChevronSelectorVertical-WdXmtxZR.js";import"./DotsVertical-CcCXKjDQ.js";import"./UserSquare-SrVzzZLD.js";import"./CreditCard01-DUewWiH3.js";import"./Settings02-CSMvEGdm.js";import"./Eye-C7WUgC8R.js";import"./Share07-CGs29l88.js";import"./GitBranch01-BJ0mK5px.js";import"./Globe01-Dj_gIo3g.js";import"./XClose-BieaBilB.js";import"./HardDrive-CipJx2oY.js";import"./Image01-DNsdL6t3.js";import"./Key01-CGrwBg5t.js";import"./Link01-LzgEXOLF.js";import"./LinkExternal01-Cze-Sz0L.js";import"./Monitor01-ByszFew3.js";import"./Sun-CWqe54Xb.js";import"./Package-Bm6sqwo4.js";import"./Palette-C08pCl2b.js";import"./Play-0UyS0cyA.js";import"./Plus-D8PEuEgy.js";import"./SearchLg-U_q5JUZG.js";import"./SearchMd-DYC_WQcU.js";import"./Shield01-CsXEChUa.js";import"./Stars01-DwlxBP_x.js";import"./Trash01-C_Vel1r1.js";import"./Upload01-D_0fYmyw.js";import"./User01-Ca62JORv.js";import"./Users01-p40208rr.js";import"./XCircle-B3rJLgWV.js";import"./Zap-BLGTK6tv.js";import"./input-CitSvqgT.js";import"./automation-runs-B-qtHPJI.js";import"./useInfiniteQuery-DWWv6g11.js";import"./infiniteQueryObserver-B_nP0mf8.js";import"./use-connection-CgHONo8e.js";import"./table-D8Qd6N0C.js";import"./empty-state-vKsTAbhp.js";import"./use-infinite-scroll-Bh9tLO8G.js";import"./use-members-Cly6ZRuF.js";import"./use-org-auth-client-vLBbes5N.js";import"./use-automations-DXl-o9Ng.js";import"./useSuspenseInfiniteQuery-BqxnvA9n.js";import"./avatar-BksZI35j.js";import"./format-time-BtXRrtv4.js";import"./differenceInSeconds-C3x8sHUj.js";import"./use-copy-DwA3jMXs.js";import"./markdown-CDl5OTvh.js";import"./monaco-editor-BVbF1NdG.js";import"./editor-oto4G8T3.js";import"./mcp-app-renderer-DIiBD5lK.js";import"./types-B_x_XnPM.js";import"./shell-layout-DQdhvYRd.js";import"./project-icon-Bh8XJJ5v.js";import"./github-repo-CTPv5ZM2.js";import"./source-system-tabs-CnEGUb4r.js";import"./command-DzUmiEwN.js";import"./index-CH-Bj-Ip.js";import"./required-auth-layout-B77LUmsG.js";import"./use-org-sso-CGyaUDmi.js";import"./use-org-notice-B9--X4Uj.js";import"./integration-icon-CzkopEn-.js";import"./use-navigate-to-agent-BAIm5fDQ.js";import"./use-mcp-prompts-C-RpeOl9.js";import"./form-CbV5KIyp.js";import"./label-7SaWrgYE.js";import"./file-type-icon-CALFZkPK.js";import"./drawer-Bp8C8-qH.js";import"./collection-search-CCHSO3Rn.js";import"./tabs-i46LKPV5.js";import"./toggle-group-BsolqnFB.js";import"./task-route-DohuS8Ym.js";import"./extract-connection-data-D6IairXX.js";import"./metadata-dUsYcpuu.js";import"./connection-iWW5aACQ.js";import"./connection-card-Q8pg1BfH.js";import"./use-registry-connections-BKlOxkfQ.js";import"./retry-CErkP7V6.js";import"./connection-slug-CITJ0kGN.js";import"./textarea-DqwsyaOF.js";import"./connection-form-helpers-gBL9Nxes.js";import"./authenticate-and-persist-oauth-BnVeb5VN.js";import"./mcp-oauth-DobgGAI3.js";import"./collection-tabs-B_oQWXK5.js";import"./badge-jb7Eney9.js";import"./use-file-configs-D3SICNe7.js";import"./site-slug-uya6Wp4-.js";import"./dropdown-menu-DMelZ0yv.js";import"./popover-BVzbVAEC.js";import"./github-icon-CazNbiZj.js";import"./get-initials-D-f_fDFw.js";import"./select-model-sqeiRACB.js";import"./checkbox-Bi_Uot6u.js";import"./ai-providers-logos-DD3qZ33J.js";import"./folder-icon-RZCrj3jj.js";import"./question-004-sINsf4GQ.js";import"./use-status-sounds-BA0_daQ8.js";import"./toolbar-Bcj-GM8-.js";import"./use-mcp-tools-qKKyzcTI.js";import"./skill-preview-Du1lClro.js";import"./use-date-fns-locale-BXoRYQdg.js";import"./alert-dialog-BqNLZYNg.js";import"./use-debounced-autosave-DOPE8JMy.js";import"./search-input-Cg9gyJ02.js";import"./use-mcp-auth-status-BZ_EmIXq.js";import"./switch-DXcrBQXR.js";import"./breadcrumb-qkauQmWa.js";import"./repository-import-picker-VQJQIiOj.js";import"./repository-picker-D1QzRNsl.js";import"./use-debounced-value-EfFezSsf.js";import"./use-secrets-DaS9Knm4.js";import"./client-icons-CSMXdACR.js";import"./connect-layout-CfXYson4.js";import"./self-tool-result-DOfFUIit.js";import"./provision-repo-scoped-github-connection-WQFARyHG.js";import"./track-Bb8KTegC.js";import"./use-tags-Ctbe89zh.js";import"./toolbar-icon-button-CdtOfW41.js";import"./safe-image-url-D5z803Ot.js";import"./automation-list-row-DBtRma3A.js";import"./site-error--i37Vnuw.js";import"./cards-CYkzIkKR.js";function Vt(n,t){const m=(n.title||n.resolveType.split("/").pop()||"").replace(/\.(tsx?|jsx?)$/,"").replace(/[^A-Za-z0-9_-]/g,""),i=/^[A-Za-z]/.test(m)&&m.length>0?m:"Section",s=Ct(t,i);return{blockKey:s,data:{__resolveType:n.resolveType,name:s}}}function Jr(n){const t=jt.c(79),{orgSlug:m,virtualMcpId:i,branch:s,blockKey:p,block:x,meta:a,decofile:l,title:bt,excludeFields:Z,schemaPending:lt,previewBaseUrl:ct}=n,D=lt===void 0?!1:lt,H=ct===void 0?null:ct,G=At()?.taskId??null,c=Bt();let N;t[0]!==H||t[1]!==i?(N={virtualMcpId:i,sandboxUrl:H},t[0]=H,t[1]=i,t[2]=N):N=t[2];const h=Rt(N),v=typeof x?.__resolveType=="string"?x.__resolveType:"";let R;t[3]!==Z||t[4]!==a||t[5]!==v?(R=Kt(v,a,Z),t[3]=Z,t[4]=a,t[5]=v,t[6]=R):R=t[6];const b=R;let T;t[7]!==b?(T=!!b&&Object.keys(b.properties??{}).length>0,t[7]=b,t[8]=T):T=t[8];const J=T,dt=bt??(x?Pt(p,x,a):p);let C;t[9]!==s||t[10]!==m||t[11]!==i?(C={orgSlug:m,virtualMcpId:i,branch:s},t[9]=s,t[10]=m,t[11]=i,t[12]=C):C=t[12];const{save:S,flush:Q,isPending:W}=Ft(C);let K;t[13]!==s||t[14]!==m||t[15]!==i?(K={orgSlug:m,virtualMcpId:i,branch:s},t[13]=s,t[14]=m,t[15]=i,t[16]=K):K=t[16];const X=Ot(K);let P;t[17]!==S?(P=zt((e,r)=>S(e,r)),t[17]=S,t[18]=P):P=t[18];const Y=P,[vt,St]=A.useState(p),[tt,ut]=A.useState(null),[et,ft]=A.useState(0);let F;t[19]===Symbol.for("react.memo_cache_sentinel")?(F=[],t[19]=F):F=t[19];const[g,xt]=A.useState(F),[ot,d]=A.useState(!1),O=A.useRef(null);vt!==p&&(St(p),ut(null),ft(Mt),xt([]));let U;t[20]!==x?(U=x??{},t[20]=x,t[21]=U):U=t[21];const rt=U;let y;t[22]!==tt?(y=tt??{},t[22]=tt,t[23]=y):y=t[23];let $;t[24]!==rt||t[25]!==y?($={...rt,...y},t[24]=rt,t[25]=y,t[26]=$):$=t[26];const it=$;let I;t[27]!==p||t[28]!==v||t[29]!==S?(I=e=>{const r=e;ut(r),S(p,{...r,__resolveType:v})},t[27]=p,t[28]=v,t[29]=S,t[30]=I):I=t[30];const mt=I;let z;t[31]===Symbol.for("react.memo_cache_sentinel")?(z=e=>{xt(e)},t[31]=z):z=t[31];const E=z;let L;t[32]!==l||t[33]!==Q||t[34]!==X||t[35]!==c?(L=async(e,r)=>{try{const{blockKey:u,data:f}=Vt(e,l);await X.mutateAsync({blockKey:u,data:f}),ht.success(c("sandbox.appEditor.createdSection",{name:u})),r({__resolveType:u}),Q()}catch(u){const f=u,kt=f instanceof Error?f.message:c("sandbox.appEditor.failedAddSection");throw ht.error(kt),f}},t[32]=l,t[33]=Q,t[34]=X,t[35]=c,t[36]=L):L=t[36];const k=L;let V;t[37]!==d?(V=e=>{O.current=e.append,d(!0)},t[37]=d,t[38]=V):V=t[38];const st=V;let q;t[39]!==k||t[40]!==d?(q=async e=>{const r=O.current;if(r)try{await k(e,u=>{r(u),d(!1),O.current=null})}catch{}},t[39]=k,t[40]=d,t[41]=q):q=t[41];const pt=q,at=g.length>0?[dt,...g]:[],gt="flex h-full flex-col",yt="flex h-12 shrink-0 items-center justify-between border-b px-6",nt=at.length>0?o.jsx("nav",{"aria-label":c("sandbox.appEditor.editingBreadcrumb"),className:"flex min-w-0 flex-1 items-center gap-1 overflow-hidden text-sm",children:at.map((e,r)=>{const u=r===at.length-1,f=Ut(e);return o.jsxs("span",{className:"flex min-w-0 items-center gap-1 overflow-hidden",children:[r>0&&o.jsx(Et,{className:"size-3 shrink-0 text-muted-foreground/60"}),o.jsx("button",{type:"button",onClick:()=>{E(r===0?[]:$t(g,r)),ft(qt)},title:f,className:_t("min-w-0 truncate rounded-md px-1 py-0.5 text-left transition-colors",u?"font-medium text-foreground":"text-muted-foreground hover:bg-accent hover:text-accent-foreground"),children:f})]},`${f}-${r}`)})}):o.jsx("span",{className:"text-sm font-medium",children:dt});let j;t[42]!==W?(j=o.jsx(Lt,{isPending:W,isError:!1}),t[42]=W,t[43]=j):j=t[43];let B;t[44]!==nt||t[45]!==j?(B=o.jsxs("div",{className:yt,children:[nt,j]}),t[44]=nt,t[45]=j,t[46]=B):B=t[46];let _;t[47]!==p||t[48]!==s||t[49]!==g||t[50]!==l||t[51]!==it||t[52]!==et||t[53]!==k||t[54]!==E||t[55]!==mt||t[56]!==st||t[57]!==J||t[58]!==a||t[59]!==m||t[60]!==Y||t[61]!==b||t[62]!==D||t[63]!==h||t[64]!==c||t[65]!==G||t[66]!==i?(_=o.jsx(Nt,{className:"min-h-0 min-w-0 flex-1 [&_[data-slot=scroll-area-viewport]>div]:!block",children:o.jsx("div",{className:"px-6 py-6",children:o.jsx("div",{className:"mx-auto max-w-xl",children:J?o.jsx(It,{schema:b,value:it,onChange:mt,basePath:"",breadcrumbPath:g,onBreadcrumbChange:E,decofile:l,meta:a,onSaveReferencedBlock:Y,previewBaseUrl:h,onAddSectionItem:k,onRequestAddSection:st,sandbox:{orgSlug:m,virtualMcpId:i,branch:s,threadId:G}},`${p}:${et}`):D?o.jsxs("div",{className:"flex flex-col items-center gap-2 py-6 text-center text-xs text-muted-foreground",children:[o.jsx(wt,{className:"size-4"}),c("sandbox.appEditor.loadingSchema")]}):o.jsx("div",{className:"py-6 text-center text-xs text-muted-foreground",children:c("sandbox.appEditor.noEditableSchema")})})})}),t[47]=p,t[48]=s,t[49]=g,t[50]=l,t[51]=it,t[52]=et,t[53]=k,t[54]=E,t[55]=mt,t[56]=st,t[57]=J,t[58]=a,t[59]=m,t[60]=Y,t[61]=b,t[62]=D,t[63]=h,t[64]=c,t[65]=G,t[66]=i,t[67]=_):_=t[67];let w;t[68]!==ot||t[69]!==l||t[70]!==pt||t[71]!==a||t[72]!==h||t[73]!==d?(w=h&&o.jsx(Tt,{open:ot,onOpenChange:e=>{d(e),e||(O.current=null)},meta:a,decofile:l,previewBaseUrl:h,onSelect:e=>{pt(e)}}),t[68]=ot,t[69]=l,t[70]=pt,t[71]=a,t[72]=h,t[73]=d,t[74]=w):w=t[74];let M;return t[75]!==B||t[76]!==_||t[77]!==w?(M=o.jsxs("div",{className:gt,children:[B,_,w]}),t[75]=B,t[76]=_,t[77]=w,t[78]=M):M=t[78],M}function qt(n){return n+1}function Mt(n){return n+1}export{Jr as AppEditor};