npm - decocms - Versions diffs - 4.355.2 → 4.356.0 - Mend

decocms 4.355.2 → 4.356.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (261) hide show

package/dist/server/server.js CHANGED Viewed

@@ -2938,7 +2938,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${J.join(`
 `)}`:X}function nP6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var No$=200,yP6=12,hP6,lP6=300,Fq0=3;var dJ1=D(()=>{sZ();G8();Hq0();hP6={aheadBy:0,behindBy:0,files:[]}});function oP6($){if(!$||$.includes(".."))return!1;return tP6.test($)}function Oo$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!oP6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function Do$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var tP6;var Lo$=D(()=>{tP6=/^[\w./@-]+$/});function b00($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function Eo$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Zw(zZ);let J=await RD($.storage,X,Y);if(J&&await CU($.storage,J)){let F=await GH($,J,{forceRefresh:!0}).catch((U)=>{throw new Zw(U instanceof Error?U.message:zZ)});await wo$($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Zw("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Hh({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:zZ;throw new Zw(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await WH(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=A5$(F instanceof Error?F.message:String(F));throw U?new Zw(N):F});await wo$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function wo$($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Cc($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await aD(K,rP6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var rP6=10485760,Zw;var mJ1=D(()=>{hG();$q0();$r();zY0();nt();sZ();Zw=class Zw extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function aP6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!sP6.test(Z))throw Error(`Invalid branch name: ${$}`)}function sf($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout($A6)])}async function QA6($,Z){let Q=$.var.studioContext,Y=DH(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=n_(G?.metadata?.runtime);if(W)return W;let K=KE0(Z.virtualMcpMetadata),H=K==="cms"?await TJ1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)Zr(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function YA6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await RY($.var.studioContext)}catch{return null}}function af($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function xc($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=b00(Z,Q);if(!X)throw new p0({provider:"github",status:404,message:"Project has no GitHub repository"});let J=p(Y);return Wh(Y,J.id,X)}function iJ1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=Q6$(Z);if(Y!==void 0)return $.json({error:Q},429,{...L5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof D6)return $.json({error:Q},409,L5);let X=cG(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,L5)}return $.json({error:Q},502,L5)}async function Po$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function Ao$($){try{let Z=await xc($),Q=await Uq0(Z,$.get("vmClaim").branch);return $.json(Q,200,L5)}catch(Z){return iJ1($,Z)}}function x00($,Z){let Y=(Oq0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return Oq0.set($,X),X.finally(()=>{if(Oq0.get($)===X)Oq0.delete($)}),Y}async function K7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,L5);let Y=Q?.runner??af($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...L5}})}}let O=await B.text(),L=Q?.redactRepoDir?XA6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...L5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function XA6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Dq0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function JA6($){return To$.includes($)}var sP6,jo$=524288,eP6=65536,$A6=1e4,zo$=2000,ZA6,Oq0,L5,To$,Ro$=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",ZA6),$.post("/:virtualMcpId/:branch/write",(Q)=>K7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>K7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>K7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>K7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>K7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>K7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>K7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:sf(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!JA6(Y))return Q.json({error:`step must be one of: ${To$.join(", ")}`},400);let X=Q.get("vmClaim"),J=await TJ1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await YA6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,L5);if(Y==="start"){let G=p(Q.var.studioContext),W=ph(X.virtualMcpMetadata);try{await XE0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return K7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return lN(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Tt$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Ao$(Q);return Z(Q)});let Z=(Q)=>K7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(zo$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Ao$(Q);return K7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(zo$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await xc(Q),G=await Nq0(J,Y.branch,X.base);return Q.json(G,200,L5)}catch(X){return iJ1(Q,X)}return K7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,L5);let Y=af(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return x00(X,async()=>{try{await RJ1(W,Y,X);let K=b00(J,G);if(K)await Eo$(W,Y,X,K)}catch(K){if(K instanceof Zw)return Q.json({error:K.message},403,L5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,L5)}return K7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return x00(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,L5);try{let G=await xc(Q);return await Bo$(G,Y.branch,J),Q.json({ok:!0},200,L5)}catch(G){let W=cG(G)===409||G instanceof D6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,L5)}});return x00(Y.claimName,()=>K7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return x00(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await xc(Q),H=W.base??await K.getDefaultBranch();return await Bq0(K,Y.branch,H),Q.json({ok:!0},200,L5)}catch(W){return iJ1(Q,W)}});let X=af(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return x00(J,async()=>{try{await RJ1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,L5)}return K7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",v5({maxSize:jo$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=af(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=MJ1(F)&&N?[F,U]:X?await Promise.all([Dq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Dq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await xc(Q);return Promise.all([Uq0(w,Y.branch),Nq0(w,Y.branch)])})(),L=await kt$(K,B,O);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",v5({maxSize:jo$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=af(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=MJ1(F)&&N?[F,U]:X?await Promise.all([Dq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Dq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await xc(Q);return Promise.all([Uq0(w,Y.branch),Nq0(w,Y.branch)])})(),L=await St$(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=af(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return Po$(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",v5({maxSize:eP6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=af(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=Oo$(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=Do$(J,W.resolveType);return Po$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var qo$=D(()=>{h$();YK();Sc();AJ1();ro();zt$();pG();nh();Pt$();TW();At$();Rt$();Ya0();ao();SJ1();Ct$();sZ();t5();dJ1();Lo$();mJ1();sP6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;ZA6=eR0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=n0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=p(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{aP6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=Eo({orgId:X.id,virtualMcpId:J,branch:G}),H=await Pr0(Q,G),F=Ar0(H,Y),U=jt$({userId:F,projectRef:K}),N=W.metadata??null,B=await QA6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await RY(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});Oq0=new Map;L5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};To$=["clone","install","start"]});function Io$($,Z,Q){let Y=pJ1.get($);if(!Y)Y={pending:null,running:!1},pJ1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)WA6($,Y);return J}async function WA6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await KA6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)pJ1.delete($)}}async function KA6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await bc(Z,Q),W=await Z.listDecofileEntries(G,Y),K=uJ1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=lJ1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await Ko$(Z.repo,L);let w=O[0]??`${Kq0(Y)}/${vJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of lJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Ho$(Z,F.values(),X),{decofile:B,skipped:O}=S00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:LW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:HA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=GA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function HA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return to0(Y,$.deps.coAuthor)}var GA6=3,pJ1;var Mo$=D(()=>{nL0();Qq0();c6();G8();sZ();Hq0();pJ1=new Map});import{createHmac as ko$,randomBytes as FA6,timingSafeEqual as UA6}from"crypto";function Vo$(){if(Lq0)return Lq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Lq0=$?Buffer.from($):FA6(32),Lq0}function nJ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+NA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=ko$("sha256",Vo$()).update(Y).digest("base64url");return`${Y}.${X}`}function So$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(ko$("sha256",Vo$()).update(Y).digest("base64url"));if(X.length!==J.length||!UA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var NA6=21600000,Lq0=null;var Co$=D(()=>{E$()});import{z as yc}from"zod";function OA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&BA6.test($)}function xo$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function y00($){let Z=$.get("decofileScope");return Wh($.var.studioContext,Z.organizationId,Z.githubRepo)}function g00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=cG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function yo$(){let $=new Z1;return $.use("/:virtualMcpId/:branch",bo$),$.use("/:virtualMcpId/:branch/*",bo$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Fo$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=nJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(xo$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return g00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await y00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return g00(Z,X)}}),$.patch("/:virtualMcpId/:branch",LA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=wA6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Zq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(_J1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await y00(Z),W=await Io$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Cc(Y)},J),K=nJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:xo$(Z)})}catch(G){return g00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(cG(W)!==409)throw W;await Bq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(cG(G)===409)return Z.json({error:"merge-conflict"},409);if(cG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return g00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(cG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return g00(Z,Y)}}),$}var BA6,_o$=500,vo$=1048576,fo$=1024,DA6=8388608,LA6,wA6,bo$;var go$=D(()=>{Xa0();Qq0();h$();YK();AJ1();$q0();mJ1();sZ();Mo$();Co$();dJ1();Hq0();BA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;LA6=v5({maxSize:DA6,onError:($)=>$.json({error:"Payload too large"},413)}),wA6=yc.object({set:yc.record(yc.string(),yc.unknown()).optional(),delete:yc.array(yc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=_o$,{message:`Patch cannot touch more than ${_o$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=vo$),{message:`Each block must be at most ${vo$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=fo$),{message:`Each block key must be at most ${fo$} characters`}),bo$=eR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!OA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!So$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!WE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=b00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var ho$=($)=>{let Z=new Z1;if(Z.use("*",ff),Z.use("*",Pm$),Z.route("/",UR0()),Z.route("/",Qi$()),Z.route("/",dm$()),Z.route("/",Gt$()),Z.route("/",Yt$()),Z.route("/",rR0()),Z.route("/tools",Bt$()),Z.route("/",Ft$()),Z.route("/",bn$({kvStorage:$.kvStorage})),Z.route("/",vn$()),Z.route("/fs",tn$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ro$()),Z.route("/decofile",yo$()),Z.route("/",$t$()),Z.route("/",rn$()),Z.route("/deco-sites",BR0()),Z.route("/hosting",_m$()),Z.route("/monitor",hm$()),Z.route("/sso",JR0()),Z.route("/",sR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Mm$()),$.mountDevAssets)Z.route("/dev-assets",wR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",yl$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",an$()),Z.route("/mcp",Hz0()),Z.route("/mcp/self",oR0()),Z.route("/mcp",Nz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var uo$=D(()=>{h$();Am$();rT0();km$();mY1();vm$();um$();ER0();Z00();hY1();rY1();fn$();xn$();on$();sn$();Ys();vY1();Bz0();DJ1();en$();Zt$();Xt$();Wt$();Ut$();wJ1();Ot$();EJ1();Fz0();qo$();go$()});function EA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},lo$=()=>{let $=new Z1;return $.use("*",jA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:EA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var co$=D(()=>{h$();E$();YT0()});import{z as M1}from"zod";function BF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function VA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function SA6($,Z,Q){try{return JSON.parse($)}catch{throw new io$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function CA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:SA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function _A6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?fJ(Q.function.parameters):fJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function vA6($){if(!$)return;return{openai:{response_format:$}}}function fA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function do$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mo$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var zA6=256,PA6,AA6,TA6,RA6,qA6,IA6,MA6,kA6,io$,po$,no$;var to$=D(()=>{S4();h$();Sc();wN();PA6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),AA6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),TA6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(AA6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),RA6=M1.object({type:M1.literal("text")}),qA6=M1.object({type:M1.literal("json_object")}),IA6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),MA6=M1.union([RA6,qA6,IA6]),kA6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(TA6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(PA6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:MA6.optional(),user:M1.string().optional()});io$=class io$ extends Error{constructor($){super($);this.name="MessageConversionError"}};po$=new Z1;po$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(BF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(BF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(BF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=kA6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(BF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=VA6(J.model);if(!G)return $.json(BF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>UE(j.providerId));if(!E)return $.json(BF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(BF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=CA6(J.messages),N=J.tools?_A6(J.tools):void 0,B=vA6(J.response_format),O=fA6(),L=Math.floor(Date.now()/1000);if(J.stream)return lN($,async(w)=>{let E=do$(F,U,N,J,B,$.req.raw.signal);try{let j=oD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=zA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:mo$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=do$(F,U,N,J,B,$.req.raw.signal),E=await nD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:mo$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(BF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(BF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(BF(X.message,"server_error"),500)}});no$=po$});function bA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function oo$(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!OY(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||D9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(d8$(U)!==J)continue;if(!bA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var ro$=D(()=>{h$();PU()});var ao$;var so$=D(()=>{ao$={name:"decocms",version:"4.355.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function gA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??yA6}}var eo$,yA6="https://ph.studio.decocms.com",$r$;var Zr$=D(()=>{h$();wn();Ev();P5();E$();jY1();so$();eo$=new Z1;eo$.get("/",($)=>{let Z={version:ao$.version,theme:Br1(),...JW().logo&&{logo:JW().logo},...XN()&&{internalUrl:Mx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:zd$(),posthog:gA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:p00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});$r$=eo$});function gc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function tJ1($){return(gc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Yr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(gc($))}&sz=${Z}`}function Qr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Xr$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Qr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Qr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var ef,hA6,uA6,lA6,cA6,Jr$;var Gr$=D(()=>{ef=c0.enum(["good","bad","neutral"]),hA6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:ef.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),uA6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(hA6)),lA6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},cA6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:ef.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:ef.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:ef.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:ef.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(uA6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:ef.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:ef.optional()})).min(1)})]),Jr$=c0.object({...lA6,template:cA6})});function wq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=Jr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var oJ1=D(()=>{Gr$()});import{join as Wr$}from"path";async function mA6($){try{let Z=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(dA6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=wq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||tJ1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function eJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function iA6($,Z){let Q=gc($),Y=Z?.brand?.trim()||tJ1(Q),X=Yr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Xr$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${eJ(W)}</title>`,`<meta name="description" content="${eJ(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${eJ(W)}" />`,`<meta property="og:description" content="${eJ(K)}" />`,`<meta property="og:url" content="${eJ(G)}" />`,`<meta property="og:image" content="${eJ(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${eJ(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${eJ(W)}" />`,`<meta name="twitter:description" content="${eJ(K)}" />`,`<meta name="twitter:image" content="${eJ(H)}" />`,`<meta name="twitter:image:alt" content="${eJ(F)}" />`,`<link rel="canonical" href="${eJ(G)}" />`,`<link rel="icon" href="${eJ(X)}" sizes="any" />`].join(`
+`;await Ko$(Z.repo,L);let w=O[0]??`${Kq0(Y)}/${vJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of lJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Ho$(Z,F.values(),X),{decofile:B,skipped:O}=S00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:LW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:HA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=GA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function HA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return to0(Y,$.deps.coAuthor)}var GA6=3,pJ1;var Mo$=D(()=>{nL0();Qq0();c6();G8();sZ();Hq0();pJ1=new Map});import{createHmac as ko$,randomBytes as FA6,timingSafeEqual as UA6}from"crypto";function Vo$(){if(Lq0)return Lq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Lq0=$?Buffer.from($):FA6(32),Lq0}function nJ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+NA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=ko$("sha256",Vo$()).update(Y).digest("base64url");return`${Y}.${X}`}function So$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(ko$("sha256",Vo$()).update(Y).digest("base64url"));if(X.length!==J.length||!UA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var NA6=21600000,Lq0=null;var Co$=D(()=>{E$()});import{z as yc}from"zod";function OA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&BA6.test($)}function xo$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function y00($){let Z=$.get("decofileScope");return Wh($.var.studioContext,Z.organizationId,Z.githubRepo)}function g00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=cG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function yo$(){let $=new Z1;return $.use("/:virtualMcpId/:branch",bo$),$.use("/:virtualMcpId/:branch/*",bo$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Fo$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=nJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(xo$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return g00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await y00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return g00(Z,X)}}),$.patch("/:virtualMcpId/:branch",LA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=wA6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Zq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(_J1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await y00(Z),W=await Io$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Cc(Y)},J),K=nJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:xo$(Z)})}catch(G){return g00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(cG(W)!==409)throw W;await Bq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(cG(G)===409)return Z.json({error:"merge-conflict"},409);if(cG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return g00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await y00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(cG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return g00(Z,Y)}}),$}var BA6,_o$=500,vo$=1048576,fo$=1024,DA6=8388608,LA6,wA6,bo$;var go$=D(()=>{Xa0();Qq0();h$();YK();AJ1();$q0();mJ1();sZ();Mo$();Co$();dJ1();Hq0();BA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;LA6=v5({maxSize:DA6,onError:($)=>$.json({error:"Payload too large"},413)}),wA6=yc.object({set:yc.record(yc.string(),yc.unknown()).optional(),delete:yc.array(yc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=_o$,{message:`Patch cannot touch more than ${_o$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=vo$),{message:`Each block must be at most ${vo$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=fo$),{message:`Each block key must be at most ${fo$} characters`}),bo$=eR0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!OA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!So$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!WE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=b00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var ho$=($)=>{let Z=new Z1;if(Z.use("*",ff),Z.use("*",Pm$),Z.route("/",UR0()),Z.route("/",Qi$()),Z.route("/",dm$()),Z.route("/",Gt$()),Z.route("/",Yt$()),Z.route("/",rR0()),Z.route("/tools",Bt$()),Z.route("/",Ft$()),Z.route("/",bn$({kvStorage:$.kvStorage})),Z.route("/",vn$()),Z.route("/fs",tn$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Ro$()),Z.route("/decofile",yo$()),Z.route("/",$t$()),Z.route("/",rn$()),Z.route("/deco-sites",BR0()),Z.route("/hosting",_m$()),Z.route("/monitor",hm$()),Z.route("/sso",JR0()),Z.route("/",sR0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Mm$()),$.mountDevAssets)Z.route("/dev-assets",wR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",yl$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",an$()),Z.route("/mcp",Hz0()),Z.route("/mcp/self",oR0()),Z.route("/mcp",Nz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var uo$=D(()=>{h$();Am$();rT0();km$();mY1();vm$();um$();ER0();Z00();hY1();rY1();fn$();xn$();on$();sn$();Ys();vY1();Bz0();DJ1();en$();Zt$();Xt$();Wt$();Ut$();wJ1();Ot$();EJ1();Fz0();qo$();go$()});function EA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},lo$=()=>{let $=new Z1;return $.use("*",jA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:EA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var co$=D(()=>{h$();E$();YT0()});import{z as M1}from"zod";function BF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function VA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function SA6($,Z,Q){try{return JSON.parse($)}catch{throw new io$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function CA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:SA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function _A6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?fJ(Q.function.parameters):fJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function vA6($){if(!$)return;return{openai:{response_format:$}}}function fA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function do$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mo$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var zA6=256,PA6,AA6,TA6,RA6,qA6,IA6,MA6,kA6,io$,po$,no$;var to$=D(()=>{S4();h$();Sc();wN();PA6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),AA6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),TA6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(AA6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),RA6=M1.object({type:M1.literal("text")}),qA6=M1.object({type:M1.literal("json_object")}),IA6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),MA6=M1.union([RA6,qA6,IA6]),kA6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(TA6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(PA6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:MA6.optional(),user:M1.string().optional()});io$=class io$ extends Error{constructor($){super($);this.name="MessageConversionError"}};po$=new Z1;po$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(BF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(BF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(BF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=kA6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(BF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=VA6(J.model);if(!G)return $.json(BF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>UE(j.providerId));if(!E)return $.json(BF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(BF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=CA6(J.messages),N=J.tools?_A6(J.tools):void 0,B=vA6(J.response_format),O=fA6(),L=Math.floor(Date.now()/1000);if(J.stream)return lN($,async(w)=>{let E=do$(F,U,N,J,B,$.req.raw.signal);try{let j=oD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=zA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:mo$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=do$(F,U,N,J,B,$.req.raw.signal),E=await nD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:mo$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(BF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(BF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(BF(X.message,"server_error"),500)}});no$=po$});function bA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function oo$(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!OY(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||D9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(d8$(U)!==J)continue;if(!bA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var ro$=D(()=>{h$();PU()});var ao$;var so$=D(()=>{ao$={name:"decocms",version:"4.356.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function gA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??yA6}}var eo$,yA6="https://ph.studio.decocms.com",$r$;var Zr$=D(()=>{h$();wn();Ev();P5();E$();jY1();so$();eo$=new Z1;eo$.get("/",($)=>{let Z={version:ao$.version,theme:Br1(),...JW().logo&&{logo:JW().logo},...XN()&&{internalUrl:Mx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:zd$(),posthog:gA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:p00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});$r$=eo$});function gc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function tJ1($){return(gc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Yr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(gc($))}&sz=${Z}`}function Qr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Xr$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Qr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Qr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var ef,hA6,uA6,lA6,cA6,Jr$;var Gr$=D(()=>{ef=c0.enum(["good","bad","neutral"]),hA6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:ef.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),uA6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(hA6)),lA6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},cA6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:ef.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:ef.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:ef.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:ef.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(uA6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:ef.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:ef.optional()})).min(1)})]),Jr$=c0.object({...lA6,template:cA6})});function wq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=Jr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var oJ1=D(()=>{Gr$()});import{join as Wr$}from"path";async function mA6($){try{let Z=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(dA6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=wq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||tJ1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function eJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function iA6($,Z){let Q=gc($),Y=Z?.brand?.trim()||tJ1(Q),X=Yr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Xr$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${eJ(W)}</title>`,`<meta name="description" content="${eJ(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${eJ(W)}" />`,`<meta property="og:description" content="${eJ(K)}" />`,`<meta property="og:url" content="${eJ(G)}" />`,`<meta property="og:image" content="${eJ(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${eJ(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${eJ(W)}" />`,`<meta name="twitter:description" content="${eJ(K)}" />`,`<meta name="twitter:image" content="${eJ(H)}" />`,`<meta name="twitter:image:alt" content="${eJ(F)}" />`,`<link rel="canonical" href="${eJ(G)}" />`,`<link rel="icon" href="${eJ(X)}" sizes="any" />`].join(`
     `)}function pA6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Kr$($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=gc(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(Wr$($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(nA6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?Wr$($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await mA6(gc(Y)),K=iA6(Y,W);return Q.html(pA6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var dA6=2500,nA6=1e4;var Hr$=D(()=>{h$();oJ1();Pj();E$()});function h00($,Z){return fetch(`${nK({})}${$}`,Z)}async function tA6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",J=await h00(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(J.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!J.ok)throw Error(`report read HTTP ${J.status}`);let G=await J.json(),{deck:W,drops:K}=wq0(G);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:G.scanned_at,drops:K}}var oA6,dN,Fr$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Ur$;var Nr$=D(()=>{h$();jJ();Pj();oJ1();oA6=new Set(["complete","errored","terminated","unknown"]),dN=new Z1;dN.use("*",async($,Z)=>{let Q=await Q8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});dN.use("/link-token/*",Fr$);dN.use("/suggest",Fr$);dN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let J=await tA6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!J.deck)return $.json(J);return $.json({...J,deck:{...J.deck,slides:J.deck.slides.slice(0,1)},truncated:J.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});dN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,J=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let G=await h00("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${zj({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:J})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});dN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await h00(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${zj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:oA6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});dN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await h00(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});dN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await h00(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});Ur$=dN});import{createHmac as rA6,timingSafeEqual as sA6}from"crypto";function Or$($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>aA6)return!1;let W=rA6("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&sA6(K,F)})}function Dr$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=A3(Z),Y=A3(A3(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:OF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function Lr$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function OF($){return typeof $==="string"?$:void 0}function A3($){return typeof $==="object"&&$!==null?$:void 0}function Eq0($){return typeof $==="number"?new Date($*1000):null}function aJ1($){return OF($)??OF(A3($)?.id)}function eA6($){return aJ1($.subscription)??OF(A3(A3($.parent)?.subscription_details)?.subscription)}function $26($){let Z=Eq0($.current_period_end);if(Z)return Z;let Q=A3($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=A3(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function rJ1($,Z){let Q=Eq0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function sJ1($,Z){let Q=Eq0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function Z26($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=OF(A3(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(OF(A3(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(OF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let G=OF(Q.id);if(!G)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let W=Number(A3(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:A3(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:W,referenceId:`stripe-topup:${G}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(OF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.getBilling(Y);if(!X)return{handled:!1,reason:"unknown org"};let J=aJ1(Q.subscription);if(X.stripeSubscriptionId&&J&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};if(rJ1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y,{stripeCustomerId:aJ1(Q.customer),stripeSubscriptionId:J,status:"active",lastStripeEventAt:sJ1(Z,X)}),{handled:!0,organizationId:Y}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=OF(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&rJ1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":Lr$(Q.status);return await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:$26(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:sJ1(Z,X)}),{handled:!0,organizationId:X.organizationId}}case"invoice.paid":{let Y=eA6(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(rJ1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:Eq0(Q.period_end),lastStripeEventAt:sJ1(Z,X)}),{handled:!0,organizationId:X.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function Q26($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Lr$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function Br$($,Z){let Q=Q26($,Z);if(!Q)return;UJ({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:Pa1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function wr$($){let Z=new dK(Z8().db),Q=await Z26(Z,$);if(!(Q.handled&&Q.topUp))Br$($,Q);if(Q.handled&&Q.topUp)await uT$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),Br$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await g4$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(Y){if(!(Y instanceof zJ&&(Y.status===400||Y.status===404)))throw Y}return Q}var aA6=300;var Er$=D(()=>{fG();h4();iZ0();dj();p41()});var Y26=1048576,eJ1;var jr$=D(()=>{h$();YK();E$();Er$();eJ1=new Z1;eJ1.post("/webhook",v5({maxSize:Y26,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=M0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!Or$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=Dr$(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await wr$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as X26}from"crypto";function W26($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return X26(Buffer.from(X),Buffer.from(Y))}function K26($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function zr$($){let Z=new Z1;return Z.post("/webhook",v5({maxSize:J26,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!W26(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!G26.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await Er0())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=K26(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await H26($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function H26($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await wD$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var J26=5242880,G26;var Pr$=D(()=>{h$();YK();TW();IZ();G26=new Set(["check_suite","issue_comment"])});function Ar$($){let Z=new CN($.db,new QY($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=yB$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new yJ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var Tr$=D(()=>{h$();fB();Ca0();Qv()});function Rr$($){let Z=new CN($.db,new QY($.encryptionKey));async function Q(X,J){let G=jx$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await VH($.db,W.organizationId);if(!K)return;if(await JT0(K,W,G)==="started")console.log(`[jira-webhook] started a run for ${G.issueKey} entering "${G.toStatus}"`)}let Y=new Z1;return Y.post("/webhook/:secret",v5({maxSize:F26}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var F26=1048576;var qr$=D(()=>{h$();YK();fB();GT0();Ju()});import{DBOS as jq0,SchedulerMode as U26}from"@dbos-inc/dbos-sdk";function Mr$($){ZG1=$}function kr$(){if(!ZG1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return ZG1}function Vr$(){let $=kr$();return new CN($.db,new QY($.encryptionKey))}async function O26($,Z){try{let Q=await Vr$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await VH(kr$().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let J=new yJ(Q.siteUrl,Q.email,Q.apiToken),W=`(${await J.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${Ir$}m"`,K=0,H;for(let F=0;F<B26;F++){let U=await J.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=zx$(N,N.changelog?.histories??[],Z);for(let O of B)if(await JT0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function D26($,Z){let Q=new Date($.getTime()-Ir$*60000),Y=await jq0.runStep(()=>Vr$().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((J)=>jq0.runStep(()=>O26(J,Q),{name:`sweepJira:${J}`})));for(let J of X)if(J.error)console.warn(`[jira-trigger] integration ${J.integrationId} failed: ${J.error}`);else if(J.started>0)console.log(`[jira-trigger] integration ${J.integrationId} started ${J.started} run(s) the webhook missed`)}function Sr$(){if($G1)return;$G1=jq0.registerWorkflow(D26,{name:"jiraTriggerSweepWorkflow"}),jq0.registerScheduled($G1,{name:"jiraTriggerSweepWorkflow",crontab:N26,mode:U26.ExactlyOncePerIntervalWhenActive})}var N26="7-59/10 * * * *",Ir$=15,B26=5,ZG1=null,$G1=null;var Cr$=D(()=>{fB();Ju();Qv();GT0()});function _r$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var vr$,L26,w26,fr$;var br$=D(()=>{h$();XW();Hu();Vj();vr$=new Z1,L26=["range","if-none-match","if-modified-since"],w26=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];vr$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Gc($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Y$(401,{message:"Authentication required"})}if(!Q)throw new Y$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new Y$(400,{message:"Missing file key"});let X=await kr(Y,Z);if(!X)throw new Y$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&$X()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Y$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return _r$(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of L26){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new Y$(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new Y$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of w26){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),_r$(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});fr$=vr$});var u00=_(($b)=>{var E26=$b&&$b.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),j26=$b&&$b.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))E26(Z,$,Q)};Object.defineProperty($b,"__esModule",{value:!0});j26(oX(),$b)});var gr$=_((xr$)=>{Object.defineProperty(xr$,"__esModule",{value:!0});xr$.version=void 0;xr$.version="3.4.0"});var lr$=_((DF)=>{var z26=DF&&DF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(DF,"__esModule",{value:!0});DF.NodeTransport=DF.VERSION=void 0;DF.nodeResolveHost=I26;var W5=u00(),P26=z0("net"),QG1=z0("tls"),A26=z0("path"),hr$=z0("fs"),T26=z26(z0("dns")),R26=gr$();DF.VERSION=R26.version;var q26="nats.js";class ur${socket;version;lang;yields=[];signal=(0,W5.deferred)();closedNotification=(0,W5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=q26,this.version=DF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,W5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw W5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new W5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new W5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,W5.deferred)(),Q,Y=(0,P26.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,W5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=W5.DataBuffer.concat(...this.yields),X=(0,W5.extractProtocolMessage)(Y);if(X!=="")try{let J=W5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,W5.deferred)();try{if($=(0,A26.resolve)($),!(0,hr$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,hr$.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,W5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,W5.deferred)();try{let X=(0,QG1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,W5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,W5.deferred)();try{let Y=(0,QG1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,W5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,W5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof QG1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,W5.render)($)}`);let Z=(0,W5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}DF.NodeTransport=ur$;function I26($){let Z=(0,W5.deferred)();return T26.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var pr$=_((ir$)=>{Object.defineProperty(ir$,"__esModule",{value:!0});ir$.connect=M26;var cr$=lr$(),dr$=u00(),mr$=u00();function M26($={}){if((0,mr$.hasWsProtocol)($))return Promise.reject(mr$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,dr$.setTransportFactory)({factory:()=>{return new cr$.NodeTransport},dnsResolveFn:cr$.nodeResolveHost}),dr$.NatsConnectionImpl.connect($)}});var nr$=_((mN)=>{var V26=mN&&mN.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),S26=mN&&mN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))V26(Z,$,Q)};Object.defineProperty(mN,"__esModule",{value:!0});mN.connect=void 0;var C26=pr$();Object.defineProperty(mN,"connect",{enumerable:!0,get:function(){return C26.connect}});S26(u00(),mN)});function sr$($){let Z=$?.connectFn??b26,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:f26,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(v26,_26,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?tr$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=rr$.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function b26($){return or$.connect($)}var tr$,or$,rr$,_26=100,v26=3000,f26=3000;var ar$=D(()=>{G8();tr$=V(Hd(),1),or$=V(nr$(),1),rr$=V(qF(),1)});function YG1($,Z){return`${$}.${Z}`}class XG1{cache;constructor($){this.cache=ol({ttlMs:$?.ttlMs??x26,maxSize:$?.maxSize??y26})}async get($,Z){return this.cache.get(YG1($,Z))??null}async set($,Z,Q){this.cache.set(YG1($,Z),Q)}async invalidate($,Z){this.cache.delete(YG1($,Z))}teardown(){this.cache.clear()}}var x26=600000,y26=5000;var er$=()=>{};function zq0($,Z){return`${$}:${Z}`}function JG1($){let Z=ol({ttlMs:$?.ttlMs??g26,maxSize:$?.maxSize??h26}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish($s$,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(zq0(K,H))},set(K,H,F){Z.set(zq0(K,H),F)},invalidate(K,H){Z.delete(zq0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe($s$),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(zq0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var $s$="studio.ai-provider-keys.invalidate",g26=30000,h26=5000;var Zs$=()=>{};class GG1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Qs$=($)=>{let Z;return()=>Z??=$()},WG1,KG1;var Ys$=D(()=>{X6();WG1=Qs$(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),KG1=Qs$(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function p26($=Gs$){return{name:xH,subjects:[`${Z11}.>`],storage:GK.StorageType.File,max_age:c26,max_bytes:m26,max_msgs_per_subject:i26,discard:GK.DiscardPolicy.Old,retention:GK.RetentionPolicy.Limits,duplicate_window:d26,num_replicas:$}}class Ws${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Xs$($){let Z=Js$.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function r26($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,l26().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function s26($,Z){return $.info?.cluster?Z:1}function a26($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class HG1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=p26(X);try{await Y.streams.info(xH),await Y.streams.update(xH,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(xH,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(xH),await Y.streams.add(J);else throw G}},Q=await b8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await GK.jetstreamManager($),X=s26($,Gs$);try{await Z(Y,X)}catch(J){if(X<=1||!a26(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:zu});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=r26(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=kj$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=Y11(H,{runId:Z}),N=performance.now()-F;WG1().record(N),KG1().add(1,{"org.id":Y??"unknown"}),o26?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?Xs$(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),t26)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await b8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Xs$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:zu}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=Y11(Z,{runId:$,dedup:Q});WG1().record(performance.now()-X),KG1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Mj$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?GK.DeliverPolicy.New:GK.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=NL($),W;try{W=await b8(async()=>{return(await Y.consumers.get(xH,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:zu})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=dj0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(hj0()).pipeThrough(uj0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(xH,{filter:NL($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var GK,Js$,u26=($)=>{let Z;return()=>Z??=$()},l26,c26=86400000000000,d26=120000000000,m26=4294967296,Gs$,i26=500000,n26,t26,o26;var Ks$=D(()=>{G8();X11();mj0();lj0();X6();Ys$();GK=V(qF(),1),Js$=V(Hd(),1),l26=u26(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Gs$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);n26=process.env.STREAM_ENCODE_TRACE==="1",t26=process.env.DECOPILOT_STREAM_TRACE==="1";o26=n26?new Ws$:null});function Pq0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,IK(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var Hs$=D(()=>{V8()});class FG1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function e26($,Z){let Q=$.startsWith("thread:")?RW($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function Fs$($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await LH($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await Ih($,{threadId:X,runBranch:G?.branch}),K=e26(W,await Qw0($,X)),H=await dt($,Q,pn0(J)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await aG(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var Us$=D(()=>{sZ();pG();IZ()});async function Ns$($,Z,Q){let Y=Z.organizationId;if(!RX(Z))return!1;if(!Kv(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=YH(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await S6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),H8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var Bs$=D(()=>{j4();MQ();Yu();fW();Y9()});function GT6($){return $ instanceof wY}function WT6($,Z){return Z-$>=XT6}class UG1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??$T6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??QT6,Q=this.options.itemIntervalMs??ZT6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-qa0),ye0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-JT6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await fe0(this.taskBoard,X,Y),await be0(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==A$.progress||G.assigneeId!==n$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await bW(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),GT6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+YT6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==A$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),H8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!WT6(IU(Q,Z.reviewCycleStartedAt),Date.now()))return;await MH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!RX(Y))return!1;let X=Y.assigneeId===n$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await Fs$(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Gu(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Ns$(G,Y,W))return!0;if(await Ez$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!Se0(W))return!1;return await oE0(G,Y,{previewMatchesHead:Ce0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await XL($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var $T6=60000,ZT6=300000,QT6=50,YT6=60000,XT6=900000,JT6=120000;var Os$=D(()=>{j4();Ee0();Us$();kH();or();fW();Bs$();Y9();lG();ge0();IZ();Rr();Xu()});import{readdir as KT6,rm as Aq0}from"fs/promises";import{join as Tq0}from"path";async function Rq0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-HT6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Zb($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await Ds$($,X,Z);else if(!X.startsWith(".")){let J=Tq0($,X),G=await Zb(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await Ds$(J,K,Z)}if((await Zb(J)).length===0)await Aq0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function Ds$($,Z,Q){let Y=0,X=Tq0($,Z),J=await Zb(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Tq0(X,W),H=await Zb(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=Tq0(K,U);await Aq0(B,{recursive:!0,force:!0}),Y++}}if((await Zb(K)).length===0)await Aq0(K,{recursive:!0,force:!0})}if((await Zb(X)).length===0)await Aq0(X,{recursive:!0,force:!0});return Y}async function Zb($){try{return(await KT6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var HT6=30;var NG1=()=>{};import{DBOS as BG1,SchedulerMode as FT6}from"@dbos-inc/dbos-sdk";async function NT6(){let $=[T3(),Qb(),EF()],Z=0;for(let Q of $)try{Z+=await Rq0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function BT6($,Z){await BG1.runStep(()=>NT6(),{name:"monitoringRetention"})}function ws$(){if(Ls$)return;Ls$=!0;let $=BG1.registerWorkflow(BT6,{name:"monitoringRetentionWorkflow"});BG1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:UT6,mode:FT6.ExactlyOncePerIntervalWhenActive})}var UT6="23 4 * * *",Ls$=!1;var Es$=D(()=>{JG();NG1()});function js$($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await _7.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await _r($.db,Z,Y.role);return X.boundAuth=QY1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new BE(Q,void 0,X.boundAuth,Y.role,"self"),JL(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var zs$=D(()=>{QU();QN()});function OT6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function DT6(){return{services:OT6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function wT6(){for(let $ of LT6)$()}function Ps$($){let Z=[...OG1.logs,$];OG1={...OG1,logs:Z.length>500?Z.slice(-500):Z},wT6()}function DG1(){return ET6}var OG1,LT6,ET6=!1;var LG1=D(()=>{OG1=DT6(),LT6=new Set});import{EventEmitter as jT6}from"events";var wG1;var As$=D(()=>{LG1();wG1=new jT6;wG1.on("request",($)=>{Ps$($)})});function Ts$(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=hc(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((E)=>hc(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${w5.tool}${B}${w5.dim}(${w})${w5.reset}`}else if(N.method)J=`${w5.dim}${hc(N.method)}${w5.reset}`}}catch{}}let W=hc(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${w5.mcp}${hc(F.slice(0,12))}\u2026${w5.reset}`}else if(X==="/mcp")W=`${w5.mcp}/mcp${w5.reset}`;else if(X==="/mcp/registry")W=`${w5.mcp}/mcp/registry${w5.reset}`;let K=PT6(Y),H=G?"\u25C0":"\u2190";if(!DG1())console.log(`${w5.dim}${H}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=zT6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!DG1())console.log(`${w5.dim}${O}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""} ${N}${U}${w5.reset} ${w5.duration}${B}${w5.reset}`);wG1.emit("request",{method:Y,path:hc(X),status:U,duration:F,timestamp:new Date})}}}var w5,zT6=($)=>{if($>=500)return w5.serverError;if($>=400)return w5.clientError;if($>=300)return w5.redirect;return w5.ok},PT6=($)=>{return w5[$]||w5.reset},hc=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Rs$=D(()=>{LG1();As$();w5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as ks$}from"crypto";import{mkdir as AT6,readdir as TT6,rm as qs$,stat as Vs$}from"fs/promises";import{join as jG1,relative as RT6}from"path";import{z as k$}from"zod";function Cs$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return jG1(qT6,Z)}function _s$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function EG1($,Z){let Q=Cs$($),Y=_s$(Z);return jG1(Q,Y)}function IT6($,Z,Q,Y){let X=M0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return ks$("sha256",X).update(J).digest("hex")}function Ms$($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=IT6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${_s$(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function vs$($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${ks$("md5","etag").update(Y).digest("hex")}"`}async function fs$($,Z,Q,Y,X){try{let J=await TT6($,{withFileTypes:!0});for(let G of J){let W=jG1($,G.name),H=RT6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await fs$(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await Vs$(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:vs$(W,F.mtime,F.size)})}catch{}}}}catch{}}function bs$($,Z){let Y=p($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:k$.object({prefix:k$.string().optional(),maxKeys:k$.number().optional().default(1000),continuationToken:k$.string().optional(),delimiter:k$.string().optional()}),outputSchema:k$.object({objects:k$.array(k$.object({key:k$.string(),size:k$.number(),lastModified:k$.string(),etag:k$.string()})),nextContinuationToken:k$.string().optional(),isTruncated:k$.boolean(),commonPrefixes:k$.array(k$.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=Cs$(Y);await AT6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await fs$(F,F,G,K,U),U.objects.sort((w,E)=>w.key.localeCompare(E.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({contentType:k$.string().optional(),contentLength:k$.number(),lastModified:k$.string(),etag:k$.string(),metadata:k$.record(k$.string(),k$.string()).optional()}),handler:async(X)=>{let J=X,G=EG1(Y,J.key),W=await Vs$(G);return{contentType:tY1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:vs$(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??Is$;return{url:Ms$(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional(),contentType:k$.string().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??Is$;return{url:Ms$(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({success:k$.boolean(),key:k$.string()}),handler:async(X)=>{let J=X,G=EG1(Y,J.key);try{return await qs$(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:k$.object({keys:k$.array(k$.string()).max(1000)}),outputSchema:k$.object({deleted:k$.array(k$.string()),errors:k$.array(k$.object({key:k$.string(),message:k$.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=EG1(Y,K);try{await qs$(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function zG1($,Z,Q){let Y=bs$(Z,Q),X=new fK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:T5});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:k$.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:k$.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new MY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),G3(X,J,$,"mcp:dev-assets")}async function xs$($,Z,Q,Y){let J=bs$(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var qT6="./data/assets",Is$=3600,Ss$,ys$;var gs$=D(()=>{E$();qu();h$();fi();xv();WQ();ER0();Ss$=new Z1;Ss$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return zG1($.req.raw,Z,Y)});ys$=Ss$});var hs$={};T4(hs$,{mountDevRoutes:()=>MT6});function MT6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return zG1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await xs$(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ys$);let Q=new Z1;Q.use("*",XK({mountPath:"/api/dev-assets"})),Q.route("/",wR0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var us$=D(()=>{h$();uY1();ER0();gs$()});import{sql as kT6}from"kysely";import{randomUUID as ls$}from"crypto";import{z as VT6}from"zod";async function CT6($){let Z=new Date().toISOString(),Q=ls$(),Y=h8.SELF($.organizationId),X="registry.publish_request.created",J={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(J),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let G=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(G.length>0)await $.db.insertInto("event_deliveries").values(G.map((W)=>({id:ls$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await kT6`SELECT
       pg_notify('studio_events', ${Q}),

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "4.355.2",
+  "version": "4.356.0",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/api-keys-Cdmmw61O.js DELETED Viewed

@@ -1 +0,0 @@

- import{c as o,j as r}from"./index-D6kz3ebr.js";import{O as m}from"./api-keys-Cq2DDoKg.js";import{R as p}from"./require-capability-BkcUyh1H.js";import"./AlertCircle-C2I0CPt8.js";import"./Copy01-BzbXBjHv.js";import"./Key01-DquPZpqN.js";import"./Plus-5jblmb5M.js";import"./Trash01-D5ciFh4O.js";import"./alert-dialog-BikX6FFY.js";import"./dialog-B0OdXcqs.js";import"./input-SHpohkkd.js";import"./label-rD90jMRy.js";import"./use-mcp-client-BS1HAuw9.js";import"./auth-CNVXmSkG.js";import"./access-gate-B2eHW19E.js";import"./capability-load-error-_DjYgnoI.js";function k(){const t=o.c(1);let i;return t[0]===Symbol.for("react.memo_cache_sentinel")?(i=r.jsx(p,{capability:"api-keys:manage",area:"api-keys",children:r.jsx(m,{})}),t[0]=i):i=t[0],i}export{k as default};

package/dist/client/assets/app-editor-BNKwsB0C.js DELETED Viewed

@@ -1 +0,0 @@

- import{c as jt,b as Bt,r as A,j as o,l as _t,h as wt,t as ht}from"./index-D6kz3ebr.js";import{b as At}from"./chat-context-CvoU8WQ4.js";import{i as Et}from"./ChevronRight-r0gLJbn2.js";import{S as Nt}from"./scroll-area-Bk3bop_C.js";import{u as Rt,A as Tt}from"./use-section-preview-base-CPX3fQrj.js";import{n as Ct,r as Kt,c as Pt,d as Ft,e as Ot,g as Ut,h as $t,S as It,i as zt,j as Lt}from"./index-B5IAGVkM.js";import"./use-panel-navigate-Bnu_Y_WK.js";import"./use-destination-route-DaFWrAHj.js";import"./autosend-D9JhT_oZ.js";import"./thread-intent-CqM5vUU9.js";import"./slugify-CEUa2lfQ.js";import"./hooks-BJUiYjpq.js";import"./use-mcp-client-BS1HAuw9.js";import"./auth-CNVXmSkG.js";import"./delay-CnY5UFtP.js";import"./backoff-CrEUbyZT.js";import"./decopilot-sse-pool-pjl5bOdE.js";import"./task-board-F9nWsjW0.js";import"./schema-DQTSPDPc.js";import"./use-is-desktop-app-BNujXJc_.js";import"./use-virtual-mcp-Ck5PGc0k.js";import"./use-ai-providers-CBAbpFCs.js";import"./location-oTTXFrSF.js";import"./use-decopilot-events-w-PNw0gQ.js";import"./thread-route-B_3hJRNO.js";import"./dialog-B0OdXcqs.js";import"./Check-sicxXYN7.js";import"./Copy01-BzbXBjHv.js";import"./Download01-Db1D2BD0.js";import"./use-organization-settings-zsIQ5yKP.js";import"./select-VruWLBER.js";import"./ChevronUp-CBLrm_OT.js";import"./agent-icon-BMTcgZga.js";import"./AlertCircle-C2I0CPt8.js";import"./Tool01-DCz0PgHD.js";import"./ArrowUp-DF6vzMhN.js";import"./ArrowLeft-DiFtyxtp.js";import"./Tool02-Dx9QVS5U.js";import"./ArrowRight-Cr3akrFT.js";import"./TrendUp01-DjG8w8m_.js";import"./ZoomOut-B_xPvOLH.js";import"./Users03-DPq3XXBm.js";import"./CheckCircle-Cbkf0Hrm.js";import"./ChevronSelectorVertical-CejccrOe.js";import"./DotsVertical-Cyt1EoXA.js";import"./UserSquare-Bi0Jy-6E.js";import"./CreditCard01-C8AQ6_dn.js";import"./Settings02-5WiTDc8b.js";import"./Eye-QPQVcqGb.js";import"./Share07-DzTdSg05.js";import"./GitBranch01-D3Ep4J5o.js";import"./Globe01-dlVOEKaQ.js";import"./XClose-hM3AAAai.js";import"./HardDrive-W8kLhAmw.js";import"./Image01-B1m-gUl3.js";import"./Key01-DquPZpqN.js";import"./Link01-ClTL5UTN.js";import"./LinkExternal01-BepJT7Oz.js";import"./Monitor01-Bndg-M3Y.js";import"./Sun-Bxqb4eKN.js";import"./Package-B2Up-gTH.js";import"./Palette-BsEqDIgy.js";import"./Play-DZtU_bVy.js";import"./Plus-5jblmb5M.js";import"./SearchLg-DFeP1_X8.js";import"./SearchMd-CnBFXj_Z.js";import"./Shield01-qqcKLTxE.js";import"./Stars01-CFR1c-1g.js";import"./Trash01-D5ciFh4O.js";import"./Upload01-Dbydv0Li.js";import"./User01-Dq0QszR-.js";import"./Users01-C_RVSWfd.js";import"./XCircle-CiIZAkGm.js";import"./Zap-Bb7Qo7M3.js";import"./input-SHpohkkd.js";import"./automation-runs-2af22T9w.js";import"./useInfiniteQuery-ctaGuyQM.js";import"./infiniteQueryObserver-Dld3rVqh.js";import"./use-connection-Cxk618DD.js";import"./table-Co1Yo9Ou.js";import"./empty-state-UGFooPJ_.js";import"./use-infinite-scroll-UlP3mdDG.js";import"./use-members-BPrB4_B6.js";import"./use-org-auth-client-BfcHu9OA.js";import"./use-automations-HZOOTOR3.js";import"./useSuspenseInfiniteQuery-IjFUp4RN.js";import"./avatar-CPkw3h7t.js";import"./format-time-BtXRrtv4.js";import"./differenceInSeconds-C3x8sHUj.js";import"./use-copy-JToNQsYl.js";import"./markdown-DOFXhXXc.js";import"./monaco-editor-BncUqSbn.js";import"./editor-DDZRpuBY.js";import"./mcp-app-renderer-DzI0XDOX.js";import"./types-CaQxQn--.js";import"./shell-layout-DtX3xYLo.js";import"./project-icon-DB0uWZzs.js";import"./github-repo-CTPv5ZM2.js";import"./source-system-tabs-CnEGUb4r.js";import"./command-CqNTTNRi.js";import"./index-ObR7HuX3.js";import"./integration-icon-BQARLIol.js";import"./required-auth-layout-BkCbiYhR.js";import"./use-org-sso-BD6r6b1F.js";import"./use-org-notice-CGWZZ-Tj.js";import"./use-navigate-to-agent-yGdOMWOW.js";import"./use-mcp-prompts-Bqus7nV6.js";import"./form-TWkufiDd.js";import"./label-rD90jMRy.js";import"./file-type-icon-DnRMRlEa.js";import"./drawer-C2s6Up5H.js";import"./collection-search-CJb7f2bn.js";import"./tabs-CzhgwOMh.js";import"./toggle-group-C6RmEYNw.js";import"./task-route-C50QtiSH.js";import"./extract-connection-data-BPXLZ9J6.js";import"./metadata-dUsYcpuu.js";import"./connection-DtCer1Uy.js";import"./connection-card-BzEzwA5b.js";import"./use-registry-connections-D6NYr_lo.js";import"./retry-CErkP7V6.js";import"./connection-slug-CITJ0kGN.js";import"./textarea-D5yUmTuo.js";import"./connection-form-helpers-swpd49hK.js";import"./authenticate-and-persist-oauth-DZYDyEg2.js";import"./mcp-oauth-DHIeN6FN.js";import"./collection-tabs-BxnrIEJp.js";import"./badge-C_ARXG3i.js";import"./use-file-configs-BszfQ6Ii.js";import"./site-slug-uya6Wp4-.js";import"./dropdown-menu-CoV3z2Yq.js";import"./popover-DClv4J5a.js";import"./github-icon-DMu-fvNj.js";import"./get-initials-D-f_fDFw.js";import"./select-model-R6GRqP4o.js";import"./checkbox-Cgrb5XJJ.js";import"./ai-providers-logos-DD3qZ33J.js";import"./folder-icon-D1UH1rlz.js";import"./question-004-sINsf4GQ.js";import"./use-status-sounds-BSHc34AF.js";import"./toolbar-DalvtXvG.js";import"./use-mcp-tools-CcPY1kUa.js";import"./skill-preview-Cn_VmuJU.js";import"./use-date-fns-locale-BC9XewCs.js";import"./alert-dialog-BikX6FFY.js";import"./use-debounced-autosave-ChhxmJyP.js";import"./search-input-Cr1xDzOR.js";import"./use-mcp-auth-status-Dm4k96-0.js";import"./switch-D5mDYZzD.js";import"./breadcrumb-CsyYyKv7.js";import"./repository-import-picker-Ds-7ia8x.js";import"./repository-picker-zcqpFECf.js";import"./use-debounced-value-B2sataBb.js";import"./use-secrets-CEAwJE8l.js";import"./client-icons-B-EXG49U.js";import"./connect-layout-TQ2j2S05.js";import"./self-tool-result-B6OwqL4s.js";import"./provision-repo-scoped-github-connection-WQFARyHG.js";import"./track-IbgYjppW.js";import"./use-tags-u-doSjgu.js";import"./toolbar-icon-button-aV5MA64L.js";import"./safe-image-url-D5z803Ot.js";import"./automation-list-row-Dj0Hlwog.js";import"./site-error--i37Vnuw.js";import"./cards-C17dmtwv.js";function Vt(n,t){const m=(n.title||n.resolveType.split("/").pop()||"").replace(/\.(tsx?|jsx?)$/,"").replace(/[^A-Za-z0-9_-]/g,""),i=/^[A-Za-z]/.test(m)&&m.length>0?m:"Section",s=Ct(t,i);return{blockKey:s,data:{__resolveType:n.resolveType,name:s}}}function Jr(n){const t=jt.c(79),{orgSlug:m,virtualMcpId:i,branch:s,blockKey:p,block:x,meta:a,decofile:l,title:bt,excludeFields:Z,schemaPending:lt,previewBaseUrl:ct}=n,D=lt===void 0?!1:lt,H=ct===void 0?null:ct,G=At()?.taskId??null,c=Bt();let N;t[0]!==H||t[1]!==i?(N={virtualMcpId:i,sandboxUrl:H},t[0]=H,t[1]=i,t[2]=N):N=t[2];const h=Rt(N),v=typeof x?.__resolveType=="string"?x.__resolveType:"";let R;t[3]!==Z||t[4]!==a||t[5]!==v?(R=Kt(v,a,Z),t[3]=Z,t[4]=a,t[5]=v,t[6]=R):R=t[6];const b=R;let T;t[7]!==b?(T=!!b&&Object.keys(b.properties??{}).length>0,t[7]=b,t[8]=T):T=t[8];const J=T,dt=bt??(x?Pt(p,x,a):p);let C;t[9]!==s||t[10]!==m||t[11]!==i?(C={orgSlug:m,virtualMcpId:i,branch:s},t[9]=s,t[10]=m,t[11]=i,t[12]=C):C=t[12];const{save:S,flush:Q,isPending:W}=Ft(C);let K;t[13]!==s||t[14]!==m||t[15]!==i?(K={orgSlug:m,virtualMcpId:i,branch:s},t[13]=s,t[14]=m,t[15]=i,t[16]=K):K=t[16];const X=Ot(K);let P;t[17]!==S?(P=zt((e,r)=>S(e,r)),t[17]=S,t[18]=P):P=t[18];const Y=P,[vt,St]=A.useState(p),[tt,ut]=A.useState(null),[et,ft]=A.useState(0);let F;t[19]===Symbol.for("react.memo_cache_sentinel")?(F=[],t[19]=F):F=t[19];const[g,xt]=A.useState(F),[ot,d]=A.useState(!1),O=A.useRef(null);vt!==p&&(St(p),ut(null),ft(Mt),xt([]));let U;t[20]!==x?(U=x??{},t[20]=x,t[21]=U):U=t[21];const rt=U;let y;t[22]!==tt?(y=tt??{},t[22]=tt,t[23]=y):y=t[23];let $;t[24]!==rt||t[25]!==y?($={...rt,...y},t[24]=rt,t[25]=y,t[26]=$):$=t[26];const it=$;let I;t[27]!==p||t[28]!==v||t[29]!==S?(I=e=>{const r=e;ut(r),S(p,{...r,__resolveType:v})},t[27]=p,t[28]=v,t[29]=S,t[30]=I):I=t[30];const mt=I;let z;t[31]===Symbol.for("react.memo_cache_sentinel")?(z=e=>{xt(e)},t[31]=z):z=t[31];const E=z;let L;t[32]!==l||t[33]!==Q||t[34]!==X||t[35]!==c?(L=async(e,r)=>{try{const{blockKey:u,data:f}=Vt(e,l);await X.mutateAsync({blockKey:u,data:f}),ht.success(c("sandbox.appEditor.createdSection",{name:u})),r({__resolveType:u}),Q()}catch(u){const f=u,kt=f instanceof Error?f.message:c("sandbox.appEditor.failedAddSection");throw ht.error(kt),f}},t[32]=l,t[33]=Q,t[34]=X,t[35]=c,t[36]=L):L=t[36];const k=L;let V;t[37]!==d?(V=e=>{O.current=e.append,d(!0)},t[37]=d,t[38]=V):V=t[38];const st=V;let q;t[39]!==k||t[40]!==d?(q=async e=>{const r=O.current;if(r)try{await k(e,u=>{r(u),d(!1),O.current=null})}catch{}},t[39]=k,t[40]=d,t[41]=q):q=t[41];const pt=q,at=g.length>0?[dt,...g]:[],gt="flex h-full flex-col",yt="flex h-12 shrink-0 items-center justify-between border-b px-6",nt=at.length>0?o.jsx("nav",{"aria-label":c("sandbox.appEditor.editingBreadcrumb"),className:"flex min-w-0 flex-1 items-center gap-1 overflow-hidden text-sm",children:at.map((e,r)=>{const u=r===at.length-1,f=Ut(e);return o.jsxs("span",{className:"flex min-w-0 items-center gap-1 overflow-hidden",children:[r>0&&o.jsx(Et,{className:"size-3 shrink-0 text-muted-foreground/60"}),o.jsx("button",{type:"button",onClick:()=>{E(r===0?[]:$t(g,r)),ft(qt)},title:f,className:_t("min-w-0 truncate rounded-md px-1 py-0.5 text-left transition-colors",u?"font-medium text-foreground":"text-muted-foreground hover:bg-accent hover:text-accent-foreground"),children:f})]},`${f}-${r}`)})}):o.jsx("span",{className:"text-sm font-medium",children:dt});let j;t[42]!==W?(j=o.jsx(Lt,{isPending:W,isError:!1}),t[42]=W,t[43]=j):j=t[43];let B;t[44]!==nt||t[45]!==j?(B=o.jsxs("div",{className:yt,children:[nt,j]}),t[44]=nt,t[45]=j,t[46]=B):B=t[46];let _;t[47]!==p||t[48]!==s||t[49]!==g||t[50]!==l||t[51]!==it||t[52]!==et||t[53]!==k||t[54]!==E||t[55]!==mt||t[56]!==st||t[57]!==J||t[58]!==a||t[59]!==m||t[60]!==Y||t[61]!==b||t[62]!==D||t[63]!==h||t[64]!==c||t[65]!==G||t[66]!==i?(_=o.jsx(Nt,{className:"min-h-0 min-w-0 flex-1 [&_[data-slot=scroll-area-viewport]>div]:!block",children:o.jsx("div",{className:"px-6 py-6",children:o.jsx("div",{className:"mx-auto max-w-xl",children:J?o.jsx(It,{schema:b,value:it,onChange:mt,basePath:"",breadcrumbPath:g,onBreadcrumbChange:E,decofile:l,meta:a,onSaveReferencedBlock:Y,previewBaseUrl:h,onAddSectionItem:k,onRequestAddSection:st,sandbox:{orgSlug:m,virtualMcpId:i,branch:s,threadId:G}},`${p}:${et}`):D?o.jsxs("div",{className:"flex flex-col items-center gap-2 py-6 text-center text-xs text-muted-foreground",children:[o.jsx(wt,{className:"size-4"}),c("sandbox.appEditor.loadingSchema")]}):o.jsx("div",{className:"py-6 text-center text-xs text-muted-foreground",children:c("sandbox.appEditor.noEditableSchema")})})})}),t[47]=p,t[48]=s,t[49]=g,t[50]=l,t[51]=it,t[52]=et,t[53]=k,t[54]=E,t[55]=mt,t[56]=st,t[57]=J,t[58]=a,t[59]=m,t[60]=Y,t[61]=b,t[62]=D,t[63]=h,t[64]=c,t[65]=G,t[66]=i,t[67]=_):_=t[67];let w;t[68]!==ot||t[69]!==l||t[70]!==pt||t[71]!==a||t[72]!==h||t[73]!==d?(w=h&&o.jsx(Tt,{open:ot,onOpenChange:e=>{d(e),e||(O.current=null)},meta:a,decofile:l,previewBaseUrl:h,onSelect:e=>{pt(e)}}),t[68]=ot,t[69]=l,t[70]=pt,t[71]=a,t[72]=h,t[73]=d,t[74]=w):w=t[74];let M;return t[75]!==B||t[76]!==_||t[77]!==w?(M=o.jsxs("div",{className:gt,children:[B,_,w]}),t[75]=B,t[76]=_,t[77]=w,t[78]=M):M=t[78],M}function qt(n){return n+1}function Mt(n){return n+1}export{Jr as AppEditor};