decocms 4.357.1 → 4.357.3

package/dist/server/server.js

@@ -2690,7 +2690,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 
 `).trim(),N=F.length>0?`Not executed tools (${F.length}/${$.tools.length}): ${F.join(", ")}`:"",B=[U,N].filter((O)=>O.length>0).join(`
 
-`);return{toolResults:K,agentSummary:B.length>0?B:null,unexecutedTools:F}}finally{await Z.close?.().catch(()=>{})}}async function a71($,Z){let Q=$.storage.registry,Y=$.organization.id,X=await Q.monitorConnections.findByItemId(Y,Z.id);if(X){if(await $.storage.connections.findById(X.connection_id,Y))return X.connection_id}let J=xG6(Z);if(!J)throw Error(`Registry item ${Z.id} has no remote URL`);if(QO(J))throw Error(`Registry item ${Z.id} targets a private network URL, refusing to create a monitor connection`);let G=fG6($),W=bG6(Z),K=await $.storage.connections.create({organization_id:Y,created_by:G,title:`[MCP Tester] ${Z.title}`,description:`Auto-created monitor connection for ${Z.id}`,app_name:"private-registry-monitor",app_id:`${bf}:monitor`,connection_type:W,connection_url:J,metadata:{monitorConnection:!0,registryItemId:Z.id,pluginId:bf}});return await Q.monitorConnections.upsert({organization_id:Y,item_id:Z.id,connection_id:K.id,auth_status:"none"}),K.id}async function pG6($){let Z=$.ctx.storage.registry;switch($.action){case"unlisted":return await Z.items.update($.organizationId,$.item.id,{is_unlisted:!0}),"unlisted";case"remove_public":return await Z.items.update($.organizationId,$.item.id,{is_public:!1}),"removed_public";case"remove_private":case"remove_all":return await Z.items.delete($.organizationId,$.item.id),$.action==="remove_all"?"removed_all":"removed_private";default:return"none"}}async function nG6($){let Z=Date.now();if($.signal.aborted)throw Error("Run cancelled");let Q="passed",Y=!1,X=!1,J=null,G="none",W=null,K=[],H=null,F=async()=>{await $.onProgress?.({status:Q,connectionOk:Y,toolsListed:X,toolResults:[...K],agentSummary:W,errorMessage:J,actionTaken:G,durationMs:Date.now()-Z})};try{let U=await a71($.ctx,$.item);H=await $.ctx.createMCPProxy(U),Y=!0;let B=(await ye(H.listTools?H.listTools():Promise.resolve({tools:[]}),$.monitorConfig.perMcpTimeoutMs,`listTools ${$.item.id}`)).tools??[];if(X=!0,$.monitorConfig.monitorMode!=="health_check")K.push(...B.map((O)=>s71(O.name))),await F();if($.monitorConfig.monitorMode==="full_agent"){let O=await iG6({ctx:$.ctx,monitorConfig:$.monitorConfig,item:$.item,proxy:H,tools:B,signal:$.signal,onProgress:async(L)=>{K.length=0,K.push(...dh$({discoveredTools:B,executedResults:L})),Q=L.some((w)=>!w.success)?"failed":"passed",await F()}});if(K.length=0,K.push(...dh$({discoveredTools:B,executedResults:O.toolResults})),W=O.agentSummary,O.toolResults.some((L)=>!L.success))Q="failed";if(O.unexecutedTools.length>0){if(Q="failed",!J)J=`Agent skipped ${O.unexecutedTools.length} tool(s): ${O.unexecutedTools.join(", ")}`}}else if($.monitorConfig.monitorMode!=="health_check"){for(let O=0;O<B.length;O++){let L=B[O];if(!L||$.signal.aborted)throw Error("Run cancelled");let w=Date.now();try{let E={},j=await ye(H.callTool({name:L.name,arguments:E}),$.monitorConfig.perToolTimeoutMs,`tool ${L.name}`),z=!j.isError,P=Date.now()-w;mh$(K,{toolName:L.name,success:z,input:E,durationMs:P,outputPreview:th$(j.structuredContent??j.content),error:z?null:IT0(j.content?.find((A)=>A.type==="text")?.text?.slice(0,300)??"Tool returned error")}),await F()}catch(E){let j=Date.now()-w,z=E instanceof Error?E.message:String(E);mh$(K,{toolName:L.name,success:!1,durationMs:j,error:IT0(z)}),await F()}}if(K.some((O)=>!O.success))Q="failed"}else for(let O of B)K.push(s71(O.name));if($.canApplyFailureAction&&Q==="failed"&&$.monitorConfig.onFailure!=="none")G=await pG6({ctx:$.ctx,organizationId:$.organizationId,item:$.item,action:$.monitorConfig.onFailure})}catch(U){if(J=U instanceof Error?U.message:String(U),yG6(U))Q="needs_auth",await $.ctx.storage.registry.monitorConnections.updateAuthStatus($.organizationId,$.item.id,"needs_auth");else Q="error"}finally{await H?.close?.().catch(()=>{})}return{status:Q,connectionOk:Y,toolsListed:X,toolResults:K,agentSummary:W,errorMessage:J,actionTaken:G,durationMs:Date.now()-Z}}async function tG6($){let Z=$.ctx.storage.registry,Y=(await Z.items.list($.organizationId,{includeUnlisted:!0})).items.filter((F)=>{if($.monitorConfig.testPublicOnly&&!F.is_public)return!1;if($.monitorConfig.testPrivateOnly&&F.is_public)return!1;return!0}),X=$.monitorConfig.includePendingRequests?(await Z.publishRequests.list($.organizationId,{status:"pending",limit:500})).items.map((F)=>oG6(F)):[],J=[...Y.map((F)=>({item:F,source:"registry_item"})),...X.map((F)=>({item:F,source:"publish_request"}))];if(J.length===0){await Z.monitorRuns.update($.organizationId,$.runId,{total_items:0,status:"completed",started_at:new Date().toISOString(),finished_at:new Date().toISOString()});return}await Z.monitorRuns.update($.organizationId,$.runId,{total_items:J.length,status:"running",started_at:new Date().toISOString()});let G=0,W=0,K=0,H=0;for(let F=0;F<J.length;F++){let U=J[F],N=U?.item;if(!N||$.signal.aborted){await Z.monitorRuns.update($.organizationId,$.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()});return}await Z.monitorRuns.update($.organizationId,$.runId,{current_item_id:N.id});let B=null,O=async(w)=>{if(!B){B=(await Z.monitorResults.create({run_id:$.runId,organization_id:$.organizationId,item_id:N.id,item_title:N.title,status:w.status,error_message:w.errorMessage,connection_ok:w.connectionOk,tools_listed:w.toolsListed,tool_results:w.toolResults,agent_summary:w.agentSummary,duration_ms:w.durationMs,action_taken:w.actionTaken})).id;return}await Z.monitorResults.update($.organizationId,B,{status:w.status,error_message:w.errorMessage,connection_ok:w.connectionOk,tools_listed:w.toolsListed,tool_results:w.toolResults,agent_summary:w.agentSummary,duration_ms:w.durationMs,action_taken:w.actionTaken})},L=await nG6({ctx:$.ctx,organizationId:$.organizationId,item:N,monitorConfig:$.monitorConfig,signal:$.signal,canApplyFailureAction:U.source==="registry_item",onProgress:O});if(await O({status:L.status,connectionOk:L.connectionOk,toolsListed:L.toolsListed,toolResults:L.toolResults,agentSummary:L.agentSummary,errorMessage:L.errorMessage,actionTaken:L.actionTaken,durationMs:L.durationMs}),G+=1,L.status==="passed")W+=1;else if(L.status==="failed"||L.status==="error")K+=1;else H+=1;await Z.monitorRuns.update($.organizationId,$.runId,{tested_items:G,passed_items:W,failed_items:K,skipped_items:H})}await Z.monitorRuns.update($.organizationId,$.runId,{status:"completed",current_item_id:null,finished_at:new Date().toISOString()})}function oG6($){return{id:`${sL}${$.id}`,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}async function rG6($,Z){let Q=vG6($);await Q.access.check();let Y=Q.storage.registry,X=await Y.monitorRuns.create({organization_id:Q.organization.id,status:"pending",config_snapshot:Z,started_at:null}),J=new AbortController;return qT0.set(X.id,J),tG6({ctx:Q,runId:X.id,organizationId:Q.organization.id,monitorConfig:Z,signal:J.signal}).catch(async(G)=>{await Y.monitorRuns.update(Q.organization.id,X.id,{status:"failed",current_item_id:null,finished_at:new Date().toISOString()}).catch(()=>{}),_G6(`Run ${X.id} failed with uncaught error:`,G)}).finally(()=>{qT0.delete(X.id)}),{run:{id:X.id}}}var qT0,VG6="[MONITOR-AGENT]",SG6,CG6="health_check: not called",sh$;var MT0=D(()=>{q0();S4();VE();$c();kN();qT0=new Map,SG6=Ph$;sh$=g({name:"REGISTRY_MONITOR_RUN_START",description:"Start an MCP registry monitor run with an isolated set of monitor connections.",inputSchema:Mh$,outputSchema:kh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Ih$($.config??{}),{run:X}=await rG6(Z,Y),G=await Z.storage.registry.monitorRuns.findById(Q.id,X.id);if(!G)throw Error(`Failed to load monitor run ${X.id}`);return{run:G}}})});var ah$;var eh$=D(()=>{q0();kN();ah$=g({name:"REGISTRY_MONITOR_RUN_LIST",description:"List MCP registry monitor runs",inputSchema:Ch$,outputSchema:_h$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),Z.storage.registry.monitorRuns.list(Q.id,$)}})});var $u$;var Zu$=D(()=>{q0();kN();$u$=g({name:"REGISTRY_MONITOR_RUN_GET",description:"Get details for one MCP registry monitor run",inputSchema:vh$,outputSchema:fh$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),{run:await Z.storage.registry.monitorRuns.findById(Q.id,$.runId)}}})});var Qu$;var Yu$=D(()=>{q0();kN();MT0();Qu$=g({name:"REGISTRY_MONITOR_RUN_CANCEL",description:"Cancel a running MCP registry monitor run",inputSchema:Vh$,outputSchema:Sh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry;if(!await Y.monitorRuns.findById(Q.id,$.runId))throw Error(`Monitor run not found: ${$.runId}`);return nh$($.runId),{run:await Y.monitorRuns.update(Q.id,$.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()})}}})});var Xu$;var Ju$=D(()=>{q0();kN();Xu$=g({name:"REGISTRY_MONITOR_RESULT_LIST",description:"List results for a given MCP registry monitor run",inputSchema:bh$,outputSchema:xh$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),Z.storage.registry.monitorResults.listByRun(Q.id,$.runId,{status:$.status,limit:$.limit,offset:$.offset})}})});var Gu$;var Wu$=D(()=>{q0();kN();$c();Gu$=g({name:"REGISTRY_MONITOR_CONNECTION_LIST",description:"List monitor connection mappings for private registry MCP monitor runs, including auth status",inputSchema:yh$,outputSchema:gh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await Y.monitorConnections.list(Q.id);return{items:await Promise.all(X.map(async(G)=>{let W=await Y.items.findById(Q.id,G.item_id);if(!W&&G.item_id.startsWith(sL)){let F=G.item_id.slice(sL.length),U=await Y.publishRequests.findById(Q.id,F);if(U)W={id:G.item_id,title:U.title,description:U.description,_meta:U._meta,server:U.server,is_public:!1,is_unlisted:!0,created_at:U.created_at,updated_at:U.updated_at}}let K=W?.server.remotes?.find((F)=>F.url)?.url??null,H=G.item_id.startsWith(sL)?"request":"store";return{mapping:G,item:W,remoteUrl:K,source:H}}))}}})});function sG6($){return{id:`${sL}${$.id}`,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}var Ku$;var Hu$=D(()=>{q0();kN();MT0();$c();Ku$=g({name:"REGISTRY_MONITOR_CONNECTION_SYNC",description:"Ensure every registry item has a dedicated monitor connection mapping for MCP monitors",inputSchema:hh$,outputSchema:uh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=(await Y.items.list(Q.id,{includeUnlisted:!0})).items,G=(await Y.publishRequests.list(Q.id,{status:"pending",limit:500})).items.map(sG6),W=[...X,...G],K=await Y.monitorConnections.list(Q.id),H=new Set(K.map((U)=>U.item_id)),F=0;for(let U of W){if(!U.server.remotes?.some((N)=>N.url))continue;try{await a71(Z,U)}catch(N){console.warn(`[REGISTRY_MONITOR_CONNECTION_SYNC] Skipping ${U.id}:`,N instanceof Error?N.message:N);continue}if(!H.has(U.id))F+=1}return{created:F,updated:Math.max(W.length-F,0)}}})});var Fu$;var Uu$=D(()=>{q0();kN();Fu$=g({name:"REGISTRY_MONITOR_CONNECTION_UPDATE_AUTH",description:"Update the auth_status of a monitor connection mapping (by core connection ID)",inputSchema:lh$,outputSchema:ch$,handler:async({connectionId:$,authStatus:Z},Q)=>{let Y=p(Q);await Q.access.check();let X=Q.storage.registry,J=Y.id,G=await X.monitorConnections.findByConnectionId(J,$);if(!G)throw Error(`No monitor connection mapping found for connection ${$}`);return await X.monitorConnections.updateAuthStatus(J,G.item_id,Z),{success:!0}}})});function aG6($){if(!$)return{};if(typeof $==="string")try{return JSON.parse($)}catch{return{}}if(typeof $==="object")return $;return{}}async function ge($,Z){let Y=(await $.db.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",bf).execute()).map((J)=>aG6(J.settings)),X={acceptPublishRequests:Y.some((J)=>J.acceptPublishRequests===!0),requireApiToken:Y.some((J)=>J.requireApiToken===!0),storePrivateOnly:Y.some((J)=>J.storePrivateOnly===!0)};if(X.acceptPublishRequests||X.requireApiToken||X.storePrivateOnly)return X;for(let J of Y)if(Object.keys(J).length>0)return J;return{}}var Nu$=D(()=>{$c()});import{z as e71}from"zod";function eG6($,Z){if(!Z)return $;let Q={field:["is_public"],operator:"eq",value:!1};if(!$)return Q;return{operator:"and",conditions:[$,Q]}}function $36($){let Z=new Map,Q=new Map;for(let X of $){let J=kK(X._meta);for(let G of J?.tags??[])Z.set(G,(Z.get(G)??0)+1);for(let G of J?.categories??[])Q.set(G,(Q.get(G)??0)+1)}let Y=(X)=>Array.from(X.entries()).map(([J,G])=>({value:J,count:G})).sort((J,G)=>J.value.localeCompare(G.value));return{tags:Y(Z),categories:Y(Q)}}var Bu$,Ou$,Du$,Lu$;var wu$=D(()=>{q0();I9();Nu$();Bu$=g({name:"COLLECTION_REGISTRY_APP_LIST",description:"List registry items for Store discovery. Supports private-only mode from plugin settings.",inputSchema:ol,outputSchema:rl,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id);return Y.items.list(Q.id,{...$,where:eG6($.where,X.storePrivateOnly===!0)})}}),Ou$=g({name:"COLLECTION_REGISTRY_APP_GET",description:"Get a registry item for Store details. Respects private-only mode from plugin settings.",inputSchema:KF,outputSchema:ff,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id),J=$.id??$.name;if(!J)return{item:null};let G=await Y.items.findByIdOrName(Q.id,J);if(!G)return{item:null};if(X.storePrivateOnly&&G.is_public)return{item:null};return{item:G}}}),Du$=g({name:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get registry item versions for Store details. Respects private-only mode from plugin settings.",inputSchema:KF,outputSchema:e71.object({versions:e71.array(ZK)}),handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id),J=$.id??$.name;if(!J)return{versions:[]};let G=await Y.items.findByIdOrName(Q.id,J);if(!G)return{versions:[]};if(X.storePrivateOnly&&G.is_public)return{versions:[]};return{versions:[G]}}}),Lu$=g({name:"COLLECTION_REGISTRY_APP_FILTERS",description:"List Store filter facets for registry items. Respects private-only mode from plugin settings.",inputSchema:e71.object({}),outputSchema:sl,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry;if(!(await ge(Z,Q.id)).storePrivateOnly)return Y.items.getFilters(Q.id);let J=await Y.items.list(Q.id,{limit:1e4,where:{field:["is_public"],operator:"eq",value:!1}});return $36(J.items)}})});var Eu$;var ju$=D(()=>{lg$();dg$();ig$();ng$();VE();og$();sg$();eg$();Zh$();Yh$();Gh$();Kh$();Fh$();Nh$();Oh$();Lh$();Eh$();zh$();MT0();eh$();Zu$();Yu$();Ju$();Wu$();Hu$();Uu$();wu$();Eu$=[Bu$,Ou$,Du$,Lu$,ag$,$h$,rg$,Jh$,mg$,ug$,Qh$,pg$,tg$,qd1,cg$,Wh$,Hh$,Uh$,Bh$,Dh$,wh$,jh$,sh$,ah$,$u$,Qu$,Xu$,Gu$,Ku$,Fu$]});import{z as Zc}from"zod";var $Q1;var zu$=D(()=>{q0();TW();Qr();OX();$Q1=g({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Zc.object({virtualMcpId:Zc.string().describe("Virtual MCP ID that owns this VM"),branch:Zc.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),removeWorktree:Zc.boolean().optional().default(!1).describe("Also reclaim the sandbox's workspace (local worktree + disk). Ignored by hosted teardown, whose filesystem is already destroyed.")}),outputSchema:Zc.object({success:Zc.boolean()}),handler:async($,Z)=>{let Q;try{Q=await YN$($,Z)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Y,userId:X,sandboxUserId:J}=Q;if(!Y)return{success:!0};let G=await Pr0(Z);return await hD(Z.storage.virtualMcps,$.virtualMcpId,X,J,$.branch),await G.delete(Y.sandboxHandle).catch((W)=>console.error(`[SANDBOX_DELETE] ${C7} ${Y.sandboxHandle}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var Pu$=D(()=>{Gr();zu$()});import{z as VN}from"zod";function J36($){try{return JSON.parse($)}catch(Z){throw Error(`GitHub /user/installations returned invalid JSON: ${$.slice(0,300)}`,{cause:Z})}}var Y36="https://api.github.com",X36=15000,ZQ1;var Au$=D(()=>{q0();hG();ZX();FW();yt();Qh();ZQ1=g({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:VN.object({connectionId:VN.string().describe("ID of the mcp-github connection to use")}),outputSchema:VN.object({installations:VN.array(VN.object({installationId:VN.number(),login:VN.string(),avatarUrl:VN.string(),type:VN.string()}))}),handler:async($,Z)=>{await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization context required");let Y=await Z.storage.connections.findById($.connectionId,Q);if(!Y)throw Error("Connection not found");if($9(Y))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let X=new R5(Z.db,Z.vault),J=await X.get($.connectionId);if(!J)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let G=J.accessToken;if(RD(J)&&X.isExpired(J,pt)){let U=await kT0(J,X);if(!U)throw Error(zZ);G=U,J=await X.get($.connectionId)??J}let W=[],K=1,H=100,F=async(U)=>fetch(`${Y36}/user/installations?per_page=${H}&page=${K}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(X36)});while(!0){let U=await F(G);if(U.status===401){let B=await X.get($.connectionId);if(!B||!RD(B))throw Error(zZ);let O=await kT0(B,X);if(!O)throw Error(zZ);if(G=O,U=await F(G),U.status===401)throw Error(zZ)}if(zD(U.headers,{lane:"rest",operation:"list_user_installations",installation:En0}),ED(U)){await U.body?.cancel().catch(()=>{});let B=U.headers.get("retry-after")!==null?"secondary":"primary";PD({lane:"rest",operation:"list_user_installations",installation:En0,kind:B});let O=jD(U.headers);throw Error(`GitHub ${B} rate limit reached${O===null?"":`; retry in ${Math.ceil(O/1000)}s`}`)}if(!U.ok)throw await U.body?.cancel().catch(()=>{}),Error(`GitHub /user/installations failed: ${U.status}`);let N=J36(await U.text());for(let B of N.installations)W.push({installationId:B.id,login:B.account.login,avatarUrl:B.account.avatar_url,type:B.account.type});if(N.installations.length<H)break;K++}return{installations:W}}})});var Tu$=D(()=>{Au$()});import{z as QQ1}from"zod";function VT0($){return{repositoryId:$.repositoryId,ref:$.repoUrl?DW($.repoUrl):null,connectionId:$.connectionId}}var SN,Ru$="No credential for this repository \u2014 link it in Settings \u2192 Repositories";var YQ1=D(()=>{c6();SN={repositoryId:QQ1.string().optional().describe("Connected repository (REPOSITORY_LINK) to act on"),repoUrl:QQ1.string().optional().describe("Any URL of the repository \u2014 its provider and host are read from it"),connectionId:QQ1.string().optional().describe("Legacy: a repo-scoped mcp-github connection in this org")}});import{z as QK}from"zod";var XQ1;var qu$=D(()=>{q0();sZ();YQ1();XQ1=g({name:"REPOSITORY_SEARCH_BRANCHES",description:"Search a repository's branches by a case-insensitive substring of the branch name, filtered server-side by the provider.",annotations:{title:"Search Repository Branches",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:QK.object({...SN,query:QK.string().describe("Substring to match against branch names. Empty returns the first branches alphabetically."),limit:QK.number().int().min(1).max(100).default(30),cursor:QK.string().nullish().describe("Opaque cursor from a previous call's `nextCursor`, to read the next window")}),outputSchema:QK.object({branches:QK.array(QK.object({name:QK.string(),author:QK.string().nullable()})),totalCount:QK.number(),nextCursor:QK.string().nullable()}),handler:async($,Z)=>{await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization context required");return(await on0(Z,Q,VT0($))).searchBranches({query:$.query,limit:$.limit,cursor:$.cursor})}})});import{z as M$}from"zod";function Mu$($){let{credentialConnectionId:Z,installationAuthorizedBy:Q,installationRepositoryIds:Y,...X}=$;return{...X,servable:dt($)}}function JQ1($){let{legacyConnectionId:Z,...Q}=$;return Q}async function ku$($,Z,Q){let Y=await $.storage.gitProviderAccounts.get(Q,Z);if(!Y)throw Error("Git account not found");return Y}var W36,Iu$,Vu$,Su$,Cu$,_u$,vu$,fu$,bu$,xu$;var yu$=D(()=>{tt();c6();q0();sZ();qu$();W36=M$.object({ref:W6$,externalId:M$.string(),defaultBranch:M$.string().nullable(),webUrl:M$.string(),visibility:M$.enum(["public","private","internal"]),description:M$.string().nullable(),updatedAt:M$.string().nullable()}),Iu$=K6$.extend({servable:M$.boolean(),connectedBy:M$.object({name:M$.string()}).nullable()});Vu$=g({name:"GIT_PROVIDER_CAPABILITIES",description:"Which git providers this deployment can connect through Studio-owned credentials, and the URLs that start each connect flow.",annotations:{title:"Git provider capabilities",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({}),outputSchema:M$.object({github:M$.object({configured:M$.boolean(),connectPath:M$.string().nullable(),installPath:M$.string().nullable()}),gitlab:M$.object({oauthHosts:M$.array(M$.string()),connectPath:M$.string().nullable()}),bitbucket:M$.object({oauthHosts:M$.array(M$.string()),connectPath:M$.string().nullable()})}),handler:async($,Z)=>{n(Z);let Q=p(Z),Y=`/api/${Q.slug??Q.id}/git-providers`,X=w5$(),J=X.github.configured;return{github:{configured:J,connectPath:J?`${Y}/github/connect`:null,installPath:J?`${Y}/github/install`:null},gitlab:{oauthHosts:X.gitlab.hosts,connectPath:X.gitlab.configured?`${Y}/gitlab/connect`:null},bitbucket:{oauthHosts:X.bitbucket.hosts,connectPath:X.bitbucket.configured?`${Y}/bitbucket/connect`:null}}}}),Su$=g({name:"GIT_ACCOUNT_LIST",description:"List the git provider accounts connected to this organization.",annotations:{title:"List git accounts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({}),outputSchema:M$.object({accounts:M$.array(Iu$)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{accounts:(await Z.storage.gitProviderAccounts.listByOrg(Q.id)).map(Mu$)}}}),Cu$=g({name:"GIT_ACCOUNT_CONNECT_TOKEN",description:"Connect a git provider account with an access token: a GitLab personal, project or group token, or a Bitbucket Cloud workspace, project or repository access token. Validates the token against the provider before storing it encrypted. Use this for self-managed GitLab instances (no OAuth application) or when OAuth is not wanted.",annotations:{title:"Connect git account with a token",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({type:_t.describe("Provider; gitlab and bitbucket accept tokens (GitHub connects through the App)"),host:M$.string().min(1).describe("Provider host, e.g. gitlab.com, gitlab.acme.com or bitbucket.org"),token:M$.string().min(1).describe("Access token with api scope")}),outputSchema:M$.object({account:Iu$}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=$.host.trim().toLowerCase();if(!/^[a-z0-9.-]+(:[0-9]+)?$/.test(Y))throw Error("host must be a bare hostname, optionally with a port");let X=await B5$($.type,Y,$.token),J=await Z.storage.gitProviderAccounts.upsert({organizationId:Q.id,type:$.type,host:Y,authKind:"token",externalAccountId:X.externalAccountId,login:X.login,avatarUrl:X.avatarUrl,createdBy:n0(Z)??null});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:J.id,accessToken:$.token,refreshToken:null,scope:null,expiresAt:null,clientId:null,clientSecret:null,tokenEndpoint:null}),{account:Mu$(J)}}}),_u$=g({name:"GIT_ACCOUNT_DELETE",description:"Disconnect a git provider account. Its repositories stay linked but lose credentials (they become anonymous clones) until linked to another account.",annotations:{title:"Disconnect git account",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({id:M$.string()}),outputSchema:M$.object({deleted:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{deleted:await Z.storage.gitProviderAccounts.delete($.id,Q.id)}}}),vu$=g({name:"REPOSITORY_LIST",description:"List the repositories linked to this organization.",annotations:{title:"List repositories",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({accountId:M$.string().optional().describe("Only repositories of this account")}),outputSchema:M$.object({repositories:M$.array(Fn0.extend({usable:M$.boolean()}))}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=await Z.storage.repositories.listByOrg(Q.id,{accountId:$.accountId}),X=await MD(Z,Q.id),J=new Set(X.map((G)=>G.webUrl.toLowerCase()));return{repositories:Y.map((G)=>({...JQ1(G),usable:J.has(G.webUrl.toLowerCase())}))}}}),fu$=g({name:"REPOSITORY_SEARCH",description:"Search the repositories an account can reach on its provider (not yet linked). Feeds the repository picker.",annotations:{title:"Search provider repositories",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({accountId:M$.string(),query:M$.string().optional(),page:M$.number().int().min(1).optional(),perPage:M$.number().int().min(1).max(100).optional()}),outputSchema:M$.object({repositories:M$.array(W36),hasMore:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=await ku$(Z,Q.id,$.accountId);return aj({db:Z.db,vault:Z.vault},Y).listRepos({query:$.query,page:$.page,perPage:$.perPage})}}),bu$=g({name:"REPOSITORY_LINK",description:"Link a repository to the organization. With an account, the repository is verified against the provider and its facts (id, default branch, visibility) recorded; without one it is linked as an anonymous public clone.",annotations:{title:"Link repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({url:M$.string().min(1).describe("Repository URL (https or ssh), or a bare path like owner/name when accountId is given"),accountId:M$.string().optional().describe("Account whose credentials access the repository")}),outputSchema:M$.object({repository:Fn0}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=n0(Z)??null;if(!$.accountId){let H=DW($.url);if(!H)throw Error("Could not recognise the repository URL. Use a full https URL from GitHub, GitLab or Bitbucket.");let F=await Z.storage.repositories.upsert({organizationId:Q.id,ref:H,createdBy:Y});return{repository:JQ1(F)}}let X=await ku$(Z,Q.id,$.accountId),J=DW($.url,{provider:X.type,host:X.host});if(!J)throw Error("Could not recognise the repository URL or path");if(J.host!==X.host)throw Error(`Repository is on ${J.host} but the account is on ${X.host}`);let W=await aj({db:Z.db,vault:Z.vault},X).getRepo(J);if(!W)throw Error(`${J.path} was not found on ${J.host} or the account cannot access it`);let K=await Z.storage.repositories.upsert({organizationId:Q.id,ref:W.ref,accountId:X.id,externalId:W.externalId,defaultBranch:W.defaultBranch,visibility:W.visibility,createdBy:Y});return{repository:JQ1(K)}}}),xu$=g({name:"REPOSITORY_DELETE",description:"Unlink a repository from the organization. Agents, tasks and syncs that referenced it keep working off their legacy metadata until relinked.",annotations:{title:"Unlink repository",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({id:M$.string()}),outputSchema:M$.object({deleted:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{deleted:await Z.storage.repositories.delete($.id,Q.id)}}})});import{z as Q$}from"zod";async function Qc($,Z){let Q=$.organization?.id;if(!Q)throw Error("Organization context required");let Y=await nt($,Q,VT0(Z));if(!Y)throw Error(Ru$);return Y}var H36,F36,ST0,U36,gu$,hu$,uu$,lu$,cu$,du$;var mu$=D(()=>{q0();sZ();YQ1();H36=Q$.object({id:Q$.string().nullable(),name:Q$.string(),state:Q$.enum(["queued","running","completed"]),conclusion:Q$.enum(["success","failure","neutral","cancelled","skipped","timed_out","action_required"]).nullable(),url:Q$.string().nullable(),durationMs:Q$.number().nullable(),summary:Q$.string().nullable()}),F36=Q$.object({id:Q$.string(),author:Q$.string(),body:Q$.string(),createdAt:Q$.string(),updatedAt:Q$.string(),url:Q$.string()}),ST0=Q$.object({number:Q$.number(),url:Q$.string(),title:Q$.string(),body:Q$.string(),state:Q$.enum(["open","closed","merged"]),draft:Q$.boolean(),mergedAt:Q$.string().nullable(),base:Q$.string(),head:Q$.string(),headSha:Q$.string(),headRepoPath:Q$.string().nullable(),author:Q$.string(),conflicting:Q$.boolean().nullable(),checks:Q$.enum(["pending","passing","failing"]).nullable(),changedFiles:Q$.number().nullable()}),U36=ST0.extend({checkRuns:Q$.array(H36),comments:Q$.array(F36),unresolvedConversations:Q$.number(),reviewBlocked:Q$.boolean()}),gu$=g({name:"CHANGE_REQUEST_STATE",description:"Read a branch's change request with its CI runs, review state and comments.",annotations:{title:"Read Change Request State",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,branch:Q$.string().describe("Head branch of the change request to read")}),outputSchema:Q$.object({changeRequest:U36.nullable()}),handler:async($,Z)=>{return await Z.access.check(),{changeRequest:await(await Qc(Z,$)).readDetailed({branch:$.branch})}}}),hu$=g({name:"CHANGE_REQUEST_LAST_MERGED",description:"Read the most recently merged change request into a base branch \u2014 in Fast Preview, the last publish.",annotations:{title:"Read Last Merged Change Request",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,base:Q$.string().describe("Branch it was merged into")}),outputSchema:Q$.object({changeRequest:ST0.nullable()}),handler:async($,Z)=>{return await Z.access.check(),{changeRequest:await(await Qc(Z,$)).lastMergedInto($.base)}}}),uu$=g({name:"CHANGE_REQUEST_LIST_OPEN",description:"List a repository's open change requests, most recently updated first.",annotations:{title:"List Open Change Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,limit:Q$.number().int().min(1).max(100).default(50)}),outputSchema:Q$.object({changeRequests:Q$.array(ST0)}),handler:async($,Z)=>{return await Z.access.check(),{changeRequests:await(await Qc(Z,$)).listOpen($.limit)}}}),lu$=g({name:"CHANGE_REQUEST_CHECK_LOG",description:"Read one CI run's report \u2014 a GitHub check run's output markdown, or the tail of a GitLab job's trace. Bitbucket commit statuses carry no report, so this answers nothing there.",annotations:{title:"Read CI Run Report",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,checkId:Q$.string().describe("Provider id of the run, from its listing")}),outputSchema:Q$.object({report:Q$.string().nullable()}),handler:async($,Z)=>{return await Z.access.check(),{report:await(await Qc(Z,$)).readCheckLog($.checkId)}}}),cu$=g({name:"CHANGE_REQUEST_OPEN",description:"Propose a branch onto another. Returns the branch's existing change request instead of failing when it already has one.",annotations:{title:"Open Change Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,head:Q$.string().describe("Branch being proposed"),base:Q$.string().describe("Branch it should land on"),title:Q$.string(),body:Q$.string().optional()}),outputSchema:Q$.object({changeRequest:ST0,existed:Q$.boolean()}),handler:async($,Z)=>{await Z.access.check();let Q=await Qc(Z,$),Y=await Q.readForBranch($.head);if(Y&&Y.state==="open"){if($.body&&$.body!==Y.body)await Q.describe(Y.number,$.body);return{changeRequest:$.body?{...Y,body:$.body}:Y,existed:!0}}return{changeRequest:await Q.open({head:$.head,base:$.base,title:$.title,body:$.body}),existed:!1}}}),du$=g({name:"CHANGE_REQUEST_MERGE",description:"Land a change request. Reports why it could not merge rather than throwing.",annotations:{title:"Merge Change Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,number:Q$.number().int().positive(),strategy:Q$.enum(["any","squash"]).default("any").describe("`squash` when the result must be one commit; `any` uses whatever the repository allows"),commitTitle:Q$.string().optional(),commitMessage:Q$.string().optional()}),outputSchema:Q$.object({merged:Q$.boolean(),reason:Q$.enum(["conflict","blocked","rate_limited","not_found","error"]).optional(),detail:Q$.string().optional()}),handler:async($,Z)=>{await Z.access.check();let Y=await(await Qc(Z,$)).merge($.number,{strategy:$.strategy,commitTitle:$.commitTitle,commitMessage:$.commitMessage});return Y.merged?{merged:!0}:{merged:!1,reason:Y.reason,detail:Y.detail}}})});import{z as f4}from"zod";function CT0($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}function GQ1($){let Z=$.trim();return Z.length>0?Z:void 0}function WQ1($,Z){return $===void 0||$.includes(Z)}var B36,O36,D36,L36,w36,E36,j36,KQ1;var iu$=D(()=>{q0();gE0();B36=["thread","task","connection"],O36=f4.object({type:f4.literal("thread"),id:f4.string(),title:f4.string(),created_at:f4.string(),updated_at:f4.string(),virtual_mcp_id:f4.string().nullable(),run_config:f4.record(f4.string(),f4.unknown()).nullable(),status:f4.string().nullable()}),D36=f4.object({type:f4.literal("task"),id:f4.string(),title:f4.string(),created_at:f4.string(),updated_at:f4.string(),key:f4.string().nullable(),status:f4.string().nullable(),repo:f4.string().nullable()}),L36=f4.object({type:f4.literal("connection"),id:f4.string(),title:f4.string(),icon:f4.string().nullable(),slug:f4.string().nullable()}),w36=f4.discriminatedUnion("type",[O36,D36,L36]),E36=f4.object({query:f4.string().max(256).describe("Free-text search query. Empty string returns the most recently updated resources."),limit:f4.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:f4.array(f4.enum(B36)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),j36=f4.object({items:f4.array(w36),totalCount:f4.number()});KQ1=g({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads, task-board cards and MCP connections). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:E36,outputSchema:j36,handler:async($,Z)=>{await Z.access.check();let Q=p(Z),Y=$.limit??20,X=WQ1($.types,"thread"),J=WQ1($.types,"task"),G=WQ1($.types,"connection"),W=[],K=0;if(X){let{threads:H,total:F}=await Z.storage.threads.list(void 0,{limit:Y,offset:0,search:GQ1($.query),includeArchived:!1});K+=F;for(let U of H)W.push({type:"thread",id:U.id,title:U.title??"",created_at:CT0(U.created_at),updated_at:CT0(U.updated_at),virtual_mcp_id:U.virtual_mcp_id??null,run_config:U.run_config??null,status:sG(U).status})}if(J){let H=await Z.storage.taskBoard.searchByTitle(Q.id,GQ1($.query)??"",Y);K+=H.length;for(let F of H)W.push({type:"task",id:F.id,title:F.title??"",created_at:CT0(F.createdAt),updated_at:CT0(F.updatedAt),key:Q.slug?Yu(Q.slug,F.keySeq):null,status:F.status??null,repo:F.repo??null})}if(G){let H=await Z.storage.connections.searchByTitle(Q.id,GQ1($.query)??"",Y);K+=H.length;for(let F of H)W.push({type:"connection",id:F.id,title:F.title,icon:F.icon??null,slug:F.slug??null})}return{items:W,totalCount:K}}})});var pu$=D(()=>{iu$()});var IQ0={};T4(IQ0,{toolSubsetMCP:()=>HQ1,managementMCP:()=>Vu,managementContextStore:()=>FN,listManagementTools:()=>P36,TOOL_BY_NAME:()=>Yc,CORE_TOOLS:()=>tu$});import{z as nu$}from"zod";async function P36($){let Z=await Vu($),[Q,Y]=ln.createLinkedPair();await Z.connect(Y);let X=new r9({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:T5});try{return await X.connect(Q),(await X.listTools()).tools}finally{await X.close().catch(()=>{}),await Z.close().catch(()=>{})}}var tu$,Yc,HQ1=($,Z)=>{let Q=new fK({name:$,version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:T5});for(let Y of Z){let X=Yc.get(Y);if(!X){console.warn(`[${$}] unknown tool "${Y}" \u2014 not registered`);continue}let{config:J,handler:G}=Se(X);Q.registerTool(X.name,J,G)}return Q},Vu=async($)=>{let Z=new fK({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:T5});for(let X of Yc.values()){let{config:J,handler:G}=Se(X);Z.registerTool(X.name,J,G)}let Q=FT0();for(let X of Q){let J=X.arguments?.length?Object.fromEntries(X.arguments.map((G)=>{let W=G.required?nu$.string():nu$.string().optional();return[G.name,G.description?W.describe(G.description):W]})):void 0;Z.registerPrompt(X.name,{title:X.title,description:X.description,...J?{argsSchema:J}:{}},(G)=>{return{messages:[{role:"user",content:{type:"text",text:typeof X.text==="function"?X.text(G??{}):X.text}}]}})}if($.organization?.id){let X=await $.storage.brandContext.list($.organization.id),J=new Set;for(let G of X){let W=G.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),K=W?`brand-${W}`:`brand-${G.id}`;if(J.has(K))K=`${K}-${G.id.slice(0,8)}`;J.add(K);let H=[`# Brand: ${G.name}`,"",`**Domain:** ${G.domain}`,"","## Overview",G.overview];if(G.colors){let U=Object.entries(G.colors).filter(([,N])=>N);if(U.length>0){H.push("","## Colors");for(let[N,B]of U)H.push(`- **${N}:** ${B}`)}}if(G.fonts){let U=Object.entries(G.fonts).filter(([,N])=>N);if(U.length>0){H.push("","## Fonts");for(let[N,B]of U)H.push(`- ${B} (${N})`)}}if(G.logo)H.push("",`**Logo:** ${G.logo}`);if(G.favicon)H.push(`**Favicon:** ${G.favicon}`);if(G.ogImage)H.push(`**OG Image:** ${G.ogImage}`);if(G.images&&G.images.length>0){H.push("","## Images");for(let U of G.images){let N=Object.entries(U).map(([B,O])=>`${B}: ${O}`).join(", ");H.push(`- ${N}`)}}let F=H.join(`
+`);return{toolResults:K,agentSummary:B.length>0?B:null,unexecutedTools:F}}finally{await Z.close?.().catch(()=>{})}}async function a71($,Z){let Q=$.storage.registry,Y=$.organization.id,X=await Q.monitorConnections.findByItemId(Y,Z.id);if(X){if(await $.storage.connections.findById(X.connection_id,Y))return X.connection_id}let J=xG6(Z);if(!J)throw Error(`Registry item ${Z.id} has no remote URL`);if(QO(J))throw Error(`Registry item ${Z.id} targets a private network URL, refusing to create a monitor connection`);let G=fG6($),W=bG6(Z),K=await $.storage.connections.create({organization_id:Y,created_by:G,title:`[MCP Tester] ${Z.title}`,description:`Auto-created monitor connection for ${Z.id}`,app_name:"private-registry-monitor",app_id:`${bf}:monitor`,connection_type:W,connection_url:J,metadata:{monitorConnection:!0,registryItemId:Z.id,pluginId:bf}});return await Q.monitorConnections.upsert({organization_id:Y,item_id:Z.id,connection_id:K.id,auth_status:"none"}),K.id}async function pG6($){let Z=$.ctx.storage.registry;switch($.action){case"unlisted":return await Z.items.update($.organizationId,$.item.id,{is_unlisted:!0}),"unlisted";case"remove_public":return await Z.items.update($.organizationId,$.item.id,{is_public:!1}),"removed_public";case"remove_private":case"remove_all":return await Z.items.delete($.organizationId,$.item.id),$.action==="remove_all"?"removed_all":"removed_private";default:return"none"}}async function nG6($){let Z=Date.now();if($.signal.aborted)throw Error("Run cancelled");let Q="passed",Y=!1,X=!1,J=null,G="none",W=null,K=[],H=null,F=async()=>{await $.onProgress?.({status:Q,connectionOk:Y,toolsListed:X,toolResults:[...K],agentSummary:W,errorMessage:J,actionTaken:G,durationMs:Date.now()-Z})};try{let U=await a71($.ctx,$.item);H=await $.ctx.createMCPProxy(U),Y=!0;let B=(await ye(H.listTools?H.listTools():Promise.resolve({tools:[]}),$.monitorConfig.perMcpTimeoutMs,`listTools ${$.item.id}`)).tools??[];if(X=!0,$.monitorConfig.monitorMode!=="health_check")K.push(...B.map((O)=>s71(O.name))),await F();if($.monitorConfig.monitorMode==="full_agent"){let O=await iG6({ctx:$.ctx,monitorConfig:$.monitorConfig,item:$.item,proxy:H,tools:B,signal:$.signal,onProgress:async(L)=>{K.length=0,K.push(...dh$({discoveredTools:B,executedResults:L})),Q=L.some((w)=>!w.success)?"failed":"passed",await F()}});if(K.length=0,K.push(...dh$({discoveredTools:B,executedResults:O.toolResults})),W=O.agentSummary,O.toolResults.some((L)=>!L.success))Q="failed";if(O.unexecutedTools.length>0){if(Q="failed",!J)J=`Agent skipped ${O.unexecutedTools.length} tool(s): ${O.unexecutedTools.join(", ")}`}}else if($.monitorConfig.monitorMode!=="health_check"){for(let O=0;O<B.length;O++){let L=B[O];if(!L||$.signal.aborted)throw Error("Run cancelled");let w=Date.now();try{let E={},j=await ye(H.callTool({name:L.name,arguments:E}),$.monitorConfig.perToolTimeoutMs,`tool ${L.name}`),z=!j.isError,P=Date.now()-w;mh$(K,{toolName:L.name,success:z,input:E,durationMs:P,outputPreview:th$(j.structuredContent??j.content),error:z?null:IT0(j.content?.find((A)=>A.type==="text")?.text?.slice(0,300)??"Tool returned error")}),await F()}catch(E){let j=Date.now()-w,z=E instanceof Error?E.message:String(E);mh$(K,{toolName:L.name,success:!1,durationMs:j,error:IT0(z)}),await F()}}if(K.some((O)=>!O.success))Q="failed"}else for(let O of B)K.push(s71(O.name));if($.canApplyFailureAction&&Q==="failed"&&$.monitorConfig.onFailure!=="none")G=await pG6({ctx:$.ctx,organizationId:$.organizationId,item:$.item,action:$.monitorConfig.onFailure})}catch(U){if(J=U instanceof Error?U.message:String(U),yG6(U))Q="needs_auth",await $.ctx.storage.registry.monitorConnections.updateAuthStatus($.organizationId,$.item.id,"needs_auth");else Q="error"}finally{await H?.close?.().catch(()=>{})}return{status:Q,connectionOk:Y,toolsListed:X,toolResults:K,agentSummary:W,errorMessage:J,actionTaken:G,durationMs:Date.now()-Z}}async function tG6($){let Z=$.ctx.storage.registry,Y=(await Z.items.list($.organizationId,{includeUnlisted:!0})).items.filter((F)=>{if($.monitorConfig.testPublicOnly&&!F.is_public)return!1;if($.monitorConfig.testPrivateOnly&&F.is_public)return!1;return!0}),X=$.monitorConfig.includePendingRequests?(await Z.publishRequests.list($.organizationId,{status:"pending",limit:500})).items.map((F)=>oG6(F)):[],J=[...Y.map((F)=>({item:F,source:"registry_item"})),...X.map((F)=>({item:F,source:"publish_request"}))];if(J.length===0){await Z.monitorRuns.update($.organizationId,$.runId,{total_items:0,status:"completed",started_at:new Date().toISOString(),finished_at:new Date().toISOString()});return}await Z.monitorRuns.update($.organizationId,$.runId,{total_items:J.length,status:"running",started_at:new Date().toISOString()});let G=0,W=0,K=0,H=0;for(let F=0;F<J.length;F++){let U=J[F],N=U?.item;if(!N||$.signal.aborted){await Z.monitorRuns.update($.organizationId,$.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()});return}await Z.monitorRuns.update($.organizationId,$.runId,{current_item_id:N.id});let B=null,O=async(w)=>{if(!B){B=(await Z.monitorResults.create({run_id:$.runId,organization_id:$.organizationId,item_id:N.id,item_title:N.title,status:w.status,error_message:w.errorMessage,connection_ok:w.connectionOk,tools_listed:w.toolsListed,tool_results:w.toolResults,agent_summary:w.agentSummary,duration_ms:w.durationMs,action_taken:w.actionTaken})).id;return}await Z.monitorResults.update($.organizationId,B,{status:w.status,error_message:w.errorMessage,connection_ok:w.connectionOk,tools_listed:w.toolsListed,tool_results:w.toolResults,agent_summary:w.agentSummary,duration_ms:w.durationMs,action_taken:w.actionTaken})},L=await nG6({ctx:$.ctx,organizationId:$.organizationId,item:N,monitorConfig:$.monitorConfig,signal:$.signal,canApplyFailureAction:U.source==="registry_item",onProgress:O});if(await O({status:L.status,connectionOk:L.connectionOk,toolsListed:L.toolsListed,toolResults:L.toolResults,agentSummary:L.agentSummary,errorMessage:L.errorMessage,actionTaken:L.actionTaken,durationMs:L.durationMs}),G+=1,L.status==="passed")W+=1;else if(L.status==="failed"||L.status==="error")K+=1;else H+=1;await Z.monitorRuns.update($.organizationId,$.runId,{tested_items:G,passed_items:W,failed_items:K,skipped_items:H})}await Z.monitorRuns.update($.organizationId,$.runId,{status:"completed",current_item_id:null,finished_at:new Date().toISOString()})}function oG6($){return{id:`${sL}${$.id}`,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}async function rG6($,Z){let Q=vG6($);await Q.access.check();let Y=Q.storage.registry,X=await Y.monitorRuns.create({organization_id:Q.organization.id,status:"pending",config_snapshot:Z,started_at:null}),J=new AbortController;return qT0.set(X.id,J),tG6({ctx:Q,runId:X.id,organizationId:Q.organization.id,monitorConfig:Z,signal:J.signal}).catch(async(G)=>{await Y.monitorRuns.update(Q.organization.id,X.id,{status:"failed",current_item_id:null,finished_at:new Date().toISOString()}).catch(()=>{}),_G6(`Run ${X.id} failed with uncaught error:`,G)}).finally(()=>{qT0.delete(X.id)}),{run:{id:X.id}}}var qT0,VG6="[MONITOR-AGENT]",SG6,CG6="health_check: not called",sh$;var MT0=D(()=>{q0();S4();VE();$c();kN();qT0=new Map,SG6=Ph$;sh$=g({name:"REGISTRY_MONITOR_RUN_START",description:"Start an MCP registry monitor run with an isolated set of monitor connections.",inputSchema:Mh$,outputSchema:kh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Ih$($.config??{}),{run:X}=await rG6(Z,Y),G=await Z.storage.registry.monitorRuns.findById(Q.id,X.id);if(!G)throw Error(`Failed to load monitor run ${X.id}`);return{run:G}}})});var ah$;var eh$=D(()=>{q0();kN();ah$=g({name:"REGISTRY_MONITOR_RUN_LIST",description:"List MCP registry monitor runs",inputSchema:Ch$,outputSchema:_h$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),Z.storage.registry.monitorRuns.list(Q.id,$)}})});var $u$;var Zu$=D(()=>{q0();kN();$u$=g({name:"REGISTRY_MONITOR_RUN_GET",description:"Get details for one MCP registry monitor run",inputSchema:vh$,outputSchema:fh$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),{run:await Z.storage.registry.monitorRuns.findById(Q.id,$.runId)}}})});var Qu$;var Yu$=D(()=>{q0();kN();MT0();Qu$=g({name:"REGISTRY_MONITOR_RUN_CANCEL",description:"Cancel a running MCP registry monitor run",inputSchema:Vh$,outputSchema:Sh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry;if(!await Y.monitorRuns.findById(Q.id,$.runId))throw Error(`Monitor run not found: ${$.runId}`);return nh$($.runId),{run:await Y.monitorRuns.update(Q.id,$.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()})}}})});var Xu$;var Ju$=D(()=>{q0();kN();Xu$=g({name:"REGISTRY_MONITOR_RESULT_LIST",description:"List results for a given MCP registry monitor run",inputSchema:bh$,outputSchema:xh$,handler:async($,Z)=>{let Q=p(Z);return await Z.access.check(),Z.storage.registry.monitorResults.listByRun(Q.id,$.runId,{status:$.status,limit:$.limit,offset:$.offset})}})});var Gu$;var Wu$=D(()=>{q0();kN();$c();Gu$=g({name:"REGISTRY_MONITOR_CONNECTION_LIST",description:"List monitor connection mappings for private registry MCP monitor runs, including auth status",inputSchema:yh$,outputSchema:gh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await Y.monitorConnections.list(Q.id);return{items:await Promise.all(X.map(async(G)=>{let W=await Y.items.findById(Q.id,G.item_id);if(!W&&G.item_id.startsWith(sL)){let F=G.item_id.slice(sL.length),U=await Y.publishRequests.findById(Q.id,F);if(U)W={id:G.item_id,title:U.title,description:U.description,_meta:U._meta,server:U.server,is_public:!1,is_unlisted:!0,created_at:U.created_at,updated_at:U.updated_at}}let K=W?.server.remotes?.find((F)=>F.url)?.url??null,H=G.item_id.startsWith(sL)?"request":"store";return{mapping:G,item:W,remoteUrl:K,source:H}}))}}})});function sG6($){return{id:`${sL}${$.id}`,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}var Ku$;var Hu$=D(()=>{q0();kN();MT0();$c();Ku$=g({name:"REGISTRY_MONITOR_CONNECTION_SYNC",description:"Ensure every registry item has a dedicated monitor connection mapping for MCP monitors",inputSchema:hh$,outputSchema:uh$,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=(await Y.items.list(Q.id,{includeUnlisted:!0})).items,G=(await Y.publishRequests.list(Q.id,{status:"pending",limit:500})).items.map(sG6),W=[...X,...G],K=await Y.monitorConnections.list(Q.id),H=new Set(K.map((U)=>U.item_id)),F=0;for(let U of W){if(!U.server.remotes?.some((N)=>N.url))continue;try{await a71(Z,U)}catch(N){console.warn(`[REGISTRY_MONITOR_CONNECTION_SYNC] Skipping ${U.id}:`,N instanceof Error?N.message:N);continue}if(!H.has(U.id))F+=1}return{created:F,updated:Math.max(W.length-F,0)}}})});var Fu$;var Uu$=D(()=>{q0();kN();Fu$=g({name:"REGISTRY_MONITOR_CONNECTION_UPDATE_AUTH",description:"Update the auth_status of a monitor connection mapping (by core connection ID)",inputSchema:lh$,outputSchema:ch$,handler:async({connectionId:$,authStatus:Z},Q)=>{let Y=p(Q);await Q.access.check();let X=Q.storage.registry,J=Y.id,G=await X.monitorConnections.findByConnectionId(J,$);if(!G)throw Error(`No monitor connection mapping found for connection ${$}`);return await X.monitorConnections.updateAuthStatus(J,G.item_id,Z),{success:!0}}})});function aG6($){if(!$)return{};if(typeof $==="string")try{return JSON.parse($)}catch{return{}}if(typeof $==="object")return $;return{}}async function ge($,Z){let Y=(await $.db.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",bf).execute()).map((J)=>aG6(J.settings)),X={acceptPublishRequests:Y.some((J)=>J.acceptPublishRequests===!0),requireApiToken:Y.some((J)=>J.requireApiToken===!0),storePrivateOnly:Y.some((J)=>J.storePrivateOnly===!0)};if(X.acceptPublishRequests||X.requireApiToken||X.storePrivateOnly)return X;for(let J of Y)if(Object.keys(J).length>0)return J;return{}}var Nu$=D(()=>{$c()});import{z as e71}from"zod";function eG6($,Z){if(!Z)return $;let Q={field:["is_public"],operator:"eq",value:!1};if(!$)return Q;return{operator:"and",conditions:[$,Q]}}function $36($){let Z=new Map,Q=new Map;for(let X of $){let J=kK(X._meta);for(let G of J?.tags??[])Z.set(G,(Z.get(G)??0)+1);for(let G of J?.categories??[])Q.set(G,(Q.get(G)??0)+1)}let Y=(X)=>Array.from(X.entries()).map(([J,G])=>({value:J,count:G})).sort((J,G)=>J.value.localeCompare(G.value));return{tags:Y(Z),categories:Y(Q)}}var Bu$,Ou$,Du$,Lu$;var wu$=D(()=>{q0();I9();Nu$();Bu$=g({name:"COLLECTION_REGISTRY_APP_LIST",description:"List registry items for Store discovery. Supports private-only mode from plugin settings.",inputSchema:ol,outputSchema:rl,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id);return Y.items.list(Q.id,{...$,where:eG6($.where,X.storePrivateOnly===!0)})}}),Ou$=g({name:"COLLECTION_REGISTRY_APP_GET",description:"Get a registry item for Store details. Respects private-only mode from plugin settings.",inputSchema:KF,outputSchema:ff,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id),J=$.id??$.name;if(!J)return{item:null};let G=await Y.items.findByIdOrName(Q.id,J);if(!G)return{item:null};if(X.storePrivateOnly&&G.is_public)return{item:null};return{item:G}}}),Du$=g({name:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get registry item versions for Store details. Respects private-only mode from plugin settings.",inputSchema:KF,outputSchema:e71.object({versions:e71.array(ZK)}),handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry,X=await ge(Z,Q.id),J=$.id??$.name;if(!J)return{versions:[]};let G=await Y.items.findByIdOrName(Q.id,J);if(!G)return{versions:[]};if(X.storePrivateOnly&&G.is_public)return{versions:[]};return{versions:[G]}}}),Lu$=g({name:"COLLECTION_REGISTRY_APP_FILTERS",description:"List Store filter facets for registry items. Respects private-only mode from plugin settings.",inputSchema:e71.object({}),outputSchema:sl,handler:async($,Z)=>{let Q=p(Z);await Z.access.check();let Y=Z.storage.registry;if(!(await ge(Z,Q.id)).storePrivateOnly)return Y.items.getFilters(Q.id);let J=await Y.items.list(Q.id,{limit:1e4,where:{field:["is_public"],operator:"eq",value:!1}});return $36(J.items)}})});var Eu$;var ju$=D(()=>{lg$();dg$();ig$();ng$();VE();og$();sg$();eg$();Zh$();Yh$();Gh$();Kh$();Fh$();Nh$();Oh$();Lh$();Eh$();zh$();MT0();eh$();Zu$();Yu$();Ju$();Wu$();Hu$();Uu$();wu$();Eu$=[Bu$,Ou$,Du$,Lu$,ag$,$h$,rg$,Jh$,mg$,ug$,Qh$,pg$,tg$,qd1,cg$,Wh$,Hh$,Uh$,Bh$,Dh$,wh$,jh$,sh$,ah$,$u$,Qu$,Xu$,Gu$,Ku$,Fu$]});import{z as Zc}from"zod";var $Q1;var zu$=D(()=>{q0();TW();Qr();OX();$Q1=g({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Zc.object({virtualMcpId:Zc.string().describe("Virtual MCP ID that owns this VM"),branch:Zc.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),removeWorktree:Zc.boolean().optional().default(!1).describe("Also reclaim the sandbox's workspace (local worktree + disk). Ignored by hosted teardown, whose filesystem is already destroyed.")}),outputSchema:Zc.object({success:Zc.boolean()}),handler:async($,Z)=>{let Q;try{Q=await YN$($,Z)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Y,userId:X,sandboxUserId:J}=Q;if(!Y)return{success:!0};let G=await Pr0(Z);return await hD(Z.storage.virtualMcps,$.virtualMcpId,X,J,$.branch),await G.delete(Y.sandboxHandle).catch((W)=>console.error(`[SANDBOX_DELETE] ${C7} ${Y.sandboxHandle}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var Pu$=D(()=>{Gr();zu$()});import{z as VN}from"zod";function J36($){try{return JSON.parse($)}catch(Z){throw Error(`GitHub /user/installations returned invalid JSON: ${$.slice(0,300)}`,{cause:Z})}}var Y36="https://api.github.com",X36=15000,ZQ1;var Au$=D(()=>{q0();hG();ZX();FW();yt();Qh();ZQ1=g({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:VN.object({connectionId:VN.string().describe("ID of the mcp-github connection to use")}),outputSchema:VN.object({installations:VN.array(VN.object({installationId:VN.number(),login:VN.string(),avatarUrl:VN.string(),type:VN.string()}))}),handler:async($,Z)=>{await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization context required");let Y=await Z.storage.connections.findById($.connectionId,Q);if(!Y)throw Error("Connection not found");if($9(Y))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let X=new R5(Z.db,Z.vault),J=await X.get($.connectionId);if(!J)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let G=J.accessToken;if(RD(J)&&X.isExpired(J,pt)){let U=await kT0(J,X);if(!U)throw Error(zZ);G=U,J=await X.get($.connectionId)??J}let W=[],K=1,H=100,F=async(U)=>fetch(`${Y36}/user/installations?per_page=${H}&page=${K}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(X36)});while(!0){let U=await F(G);if(U.status===401){let B=await X.get($.connectionId);if(!B||!RD(B))throw Error(zZ);let O=await kT0(B,X);if(!O)throw Error(zZ);if(G=O,U=await F(G),U.status===401)throw Error(zZ)}if(zD(U.headers,{lane:"rest",operation:"list_user_installations",installation:En0}),ED(U)){await U.body?.cancel().catch(()=>{});let B=U.headers.get("retry-after")!==null?"secondary":"primary";PD({lane:"rest",operation:"list_user_installations",installation:En0,kind:B});let O=jD(U.headers);throw Error(`GitHub ${B} rate limit reached${O===null?"":`; retry in ${Math.ceil(O/1000)}s`}`)}if(!U.ok)throw await U.body?.cancel().catch(()=>{}),Error(`GitHub /user/installations failed: ${U.status}`);let N=J36(await U.text());for(let B of N.installations)W.push({installationId:B.id,login:B.account.login,avatarUrl:B.account.avatar_url,type:B.account.type});if(N.installations.length<H)break;K++}return{installations:W}}})});var Tu$=D(()=>{Au$()});import{z as QQ1}from"zod";function VT0($){return{repositoryId:$.repositoryId,ref:$.repoUrl?DW($.repoUrl):null,connectionId:$.connectionId}}var SN,Ru$="No credential for this repository \u2014 link it in Settings \u2192 Repositories";var YQ1=D(()=>{c6();SN={repositoryId:QQ1.string().optional().describe("Connected repository (REPOSITORY_LINK) to act on"),repoUrl:QQ1.string().optional().describe("Any URL of the repository \u2014 its provider and host are read from it"),connectionId:QQ1.string().optional().describe("Legacy: a repo-scoped mcp-github connection in this org")}});import{z as QK}from"zod";var XQ1;var qu$=D(()=>{q0();sZ();YQ1();XQ1=g({name:"REPOSITORY_SEARCH_BRANCHES",description:"Search a repository's branches by a case-insensitive substring of the branch name, filtered server-side by the provider.",annotations:{title:"Search Repository Branches",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:QK.object({...SN,query:QK.string().describe("Substring to match against branch names. Empty returns the first branches alphabetically."),limit:QK.number().int().min(1).max(100).default(30),cursor:QK.string().nullish().describe("Opaque cursor from a previous call's `nextCursor`, to read the next window")}),outputSchema:QK.object({branches:QK.array(QK.object({name:QK.string(),author:QK.string().nullable()})),totalCount:QK.number(),nextCursor:QK.string().nullable()}),handler:async($,Z)=>{await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization context required");return(await on0(Z,Q,VT0($))).searchBranches({query:$.query,limit:$.limit,cursor:$.cursor})}})});import{z as M$}from"zod";function Mu$($){let{credentialConnectionId:Z,installationAuthorizedBy:Q,installationRepositoryIds:Y,...X}=$;return{...X,servable:dt($)}}function JQ1($){let{legacyConnectionId:Z,...Q}=$;return Q}async function ku$($,Z,Q){let Y=await $.storage.gitProviderAccounts.get(Q,Z);if(!Y)throw Error("Git account not found");return Y}var W36,Iu$,Vu$,Su$,Cu$,_u$,vu$,fu$,bu$,xu$;var yu$=D(()=>{tt();c6();q0();sZ();qu$();W36=M$.object({ref:W6$,externalId:M$.string(),defaultBranch:M$.string().nullable(),webUrl:M$.string(),visibility:M$.enum(["public","private","internal"]),description:M$.string().nullable(),updatedAt:M$.string().nullable()}),Iu$=K6$.extend({servable:M$.boolean(),connectedBy:M$.object({name:M$.string()}).nullable()});Vu$=g({name:"GIT_PROVIDER_CAPABILITIES",description:"Which git providers this deployment can connect through Studio-owned credentials, and the URLs that start each connect flow.",annotations:{title:"Git provider capabilities",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({}),outputSchema:M$.object({github:M$.object({configured:M$.boolean(),connectPath:M$.string().nullable(),installPath:M$.string().nullable()}),gitlab:M$.object({oauthHosts:M$.array(M$.string()),connectPath:M$.string().nullable()}),bitbucket:M$.object({oauthHosts:M$.array(M$.string()),connectPath:M$.string().nullable()})}),handler:async($,Z)=>{n(Z);let Q=p(Z),Y=`/api/${Q.slug??Q.id}/git-providers`,X=w5$(),J=X.github.configured;return{github:{configured:J,connectPath:J?`${Y}/github/connect`:null,installPath:J?`${Y}/github/install`:null},gitlab:{oauthHosts:X.gitlab.hosts,connectPath:X.gitlab.configured?`${Y}/gitlab/connect`:null},bitbucket:{oauthHosts:X.bitbucket.hosts,connectPath:X.bitbucket.configured?`${Y}/bitbucket/connect`:null}}}}),Su$=g({name:"GIT_ACCOUNT_LIST",description:"List the git provider accounts connected to this organization.",annotations:{title:"List git accounts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({}),outputSchema:M$.object({accounts:M$.array(Iu$)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{accounts:(await Z.storage.gitProviderAccounts.listByOrg(Q.id)).map(Mu$)}}}),Cu$=g({name:"GIT_ACCOUNT_CONNECT_TOKEN",description:"Connect a git provider account with an access token: a GitLab personal, project or group token, or a Bitbucket Cloud workspace, project or repository access token. Validates the token against the provider before storing it encrypted. Use this for self-managed GitLab instances (no OAuth application) or when OAuth is not wanted.",annotations:{title:"Connect git account with a token",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({type:_t.describe("Provider; gitlab and bitbucket accept tokens (GitHub connects through the App)"),host:M$.string().min(1).describe("Provider host, e.g. gitlab.com, gitlab.acme.com or bitbucket.org"),token:M$.string().min(1).describe("Access token with api scope")}),outputSchema:M$.object({account:Iu$}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=$.host.trim().toLowerCase();if(!/^[a-z0-9.-]+(:[0-9]+)?$/.test(Y))throw Error("host must be a bare hostname, optionally with a port");let X=await B5$($.type,Y,$.token),J=await Z.storage.gitProviderAccounts.upsert({organizationId:Q.id,type:$.type,host:Y,authKind:"token",externalAccountId:X.externalAccountId,login:X.login,avatarUrl:X.avatarUrl,createdBy:n0(Z)??null});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:J.id,accessToken:$.token,refreshToken:null,scope:null,expiresAt:null,clientId:null,clientSecret:null,tokenEndpoint:null}),{account:Mu$(J)}}}),_u$=g({name:"GIT_ACCOUNT_DELETE",description:"Disconnect a git provider account. Its repositories stay linked but lose credentials (they become anonymous clones) until linked to another account.",annotations:{title:"Disconnect git account",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({id:M$.string()}),outputSchema:M$.object({deleted:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{deleted:await Z.storage.gitProviderAccounts.delete($.id,Q.id)}}}),vu$=g({name:"REPOSITORY_LIST",description:"List the repositories linked to this organization.",annotations:{title:"List repositories",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({accountId:M$.string().optional().describe("Only repositories of this account")}),outputSchema:M$.object({repositories:M$.array(Fn0.extend({usable:M$.boolean()}))}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=await Z.storage.repositories.listByOrg(Q.id,{accountId:$.accountId}),X=await MD(Z,Q.id),J=new Set(X.map((G)=>G.webUrl.toLowerCase()));return{repositories:Y.map((G)=>({...JQ1(G),usable:J.has(G.webUrl.toLowerCase())}))}}}),fu$=g({name:"REPOSITORY_SEARCH",description:"Search the repositories an account can reach on its provider (not yet linked). Feeds the repository picker.",annotations:{title:"Search provider repositories",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({accountId:M$.string(),query:M$.string().optional(),page:M$.number().int().min(1).optional(),perPage:M$.number().int().min(1).max(100).optional()}),outputSchema:M$.object({repositories:M$.array(W36),hasMore:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=await ku$(Z,Q.id,$.accountId);return aj({db:Z.db,vault:Z.vault},Y).listRepos({query:$.query,page:$.page,perPage:$.perPage})}}),bu$=g({name:"REPOSITORY_LINK",description:"Link a repository to the organization. With an account, the repository is verified against the provider and its facts (id, default branch, visibility) recorded; without one it is linked as an anonymous public clone.",annotations:{title:"Link repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({url:M$.string().min(1).describe("Repository URL (https or ssh), or a bare path like owner/name when accountId is given"),accountId:M$.string().optional().describe("Account whose credentials access the repository")}),outputSchema:M$.object({repository:Fn0}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z),Y=n0(Z)??null;if(!$.accountId){let H=DW($.url);if(!H)throw Error("Could not recognise the repository URL. Use a full https URL from GitHub, GitLab or Bitbucket.");let F=await Z.storage.repositories.upsert({organizationId:Q.id,ref:H,createdBy:Y});return{repository:JQ1(F)}}let X=await ku$(Z,Q.id,$.accountId),J=DW($.url,{provider:X.type,host:X.host});if(!J)throw Error("Could not recognise the repository URL or path");if(J.host!==X.host)throw Error(`Repository is on ${J.host} but the account is on ${X.host}`);let W=await aj({db:Z.db,vault:Z.vault},X).getRepo(J);if(!W)throw Error(`${J.path} was not found on ${J.host} or the account cannot access it`);let K=await Z.storage.repositories.upsert({organizationId:Q.id,ref:W.ref,accountId:X.id,externalId:W.externalId,defaultBranch:W.defaultBranch,visibility:W.visibility,createdBy:Y});return{repository:JQ1(K)}}}),xu$=g({name:"REPOSITORY_DELETE",description:"Unlink a repository from the organization. Agents, tasks and syncs that referenced it keep working off their legacy metadata until relinked.",annotations:{title:"Unlink repository",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:M$.object({id:M$.string()}),outputSchema:M$.object({deleted:M$.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p(Z);return{deleted:await Z.storage.repositories.delete($.id,Q.id)}}})});import{z as Q$}from"zod";async function Qc($,Z){let Q=$.organization?.id;if(!Q)throw Error("Organization context required");let Y=await nt($,Q,VT0(Z));if(!Y)throw Error(Ru$);return Y}var H36,F36,ST0,U36,gu$,hu$,uu$,lu$,cu$,du$;var mu$=D(()=>{q0();sZ();YQ1();H36=Q$.object({id:Q$.string().nullable(),name:Q$.string(),state:Q$.enum(["queued","running","completed"]),conclusion:Q$.enum(["success","failure","neutral","cancelled","skipped","timed_out","action_required"]).nullable(),url:Q$.string().nullable(),durationMs:Q$.number().nullable(),summary:Q$.string().nullable()}),F36=Q$.object({id:Q$.string(),author:Q$.string(),body:Q$.string(),createdAt:Q$.string(),updatedAt:Q$.string(),url:Q$.string()}),ST0=Q$.object({number:Q$.number(),url:Q$.string(),title:Q$.string(),body:Q$.string(),state:Q$.enum(["open","closed","merged"]),draft:Q$.boolean(),mergedAt:Q$.string().nullable(),base:Q$.string(),head:Q$.string(),headSha:Q$.string(),headRepoPath:Q$.string().nullable(),author:Q$.string(),conflicting:Q$.boolean().nullable(),checks:Q$.enum(["pending","passing","failing"]).nullable(),changedFiles:Q$.number().nullable()}),U36=ST0.extend({checkRuns:Q$.array(H36),comments:Q$.array(F36),unresolvedConversations:Q$.number(),reviewBlocked:Q$.boolean()}),gu$=g({name:"CHANGE_REQUEST_STATE",description:"Read a branch's change request with its CI runs, review state and comments.",annotations:{title:"Read Change Request State",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,branch:Q$.string().describe("Head branch of the change request to read")}),outputSchema:Q$.object({changeRequest:U36.nullable()}),handler:async($,Z)=>{return await Z.access.check(),{changeRequest:await(await Qc(Z,$)).readDetailed({branch:$.branch})}}}),hu$=g({name:"CHANGE_REQUEST_LAST_MERGED",description:"Read the most recently merged change request into a base branch \u2014 in Fast Preview, the last publish.",annotations:{title:"Read Last Merged Change Request",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,base:Q$.string().describe("Branch it was merged into")}),outputSchema:Q$.object({changeRequest:ST0.nullable()}),handler:async($,Z)=>{return await Z.access.check(),{changeRequest:await(await Qc(Z,$)).lastMergedInto($.base)}}}),uu$=g({name:"CHANGE_REQUEST_LIST_OPEN",description:"List a repository's open change requests, most recently updated first.",annotations:{title:"List Open Change Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,limit:Q$.number().int().min(1).max(100).default(50)}),outputSchema:Q$.object({changeRequests:Q$.array(ST0)}),handler:async($,Z)=>{return await Z.access.check(),{changeRequests:await(await Qc(Z,$)).listOpen($.limit)}}}),lu$=g({name:"CHANGE_REQUEST_CHECK_LOG",description:"Read one CI run's report \u2014 a GitHub check run's output markdown, or the tail of a GitLab job's trace. Bitbucket commit statuses carry no report, so this answers nothing there.",annotations:{title:"Read CI Run Report",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,checkId:Q$.string().describe("Provider id of the run, from its listing")}),outputSchema:Q$.object({report:Q$.string().nullable()}),handler:async($,Z)=>{return await Z.access.check(),{report:await(await Qc(Z,$)).readCheckLog($.checkId)}}}),cu$=g({name:"CHANGE_REQUEST_OPEN",description:"Propose a branch onto another. Returns the branch's existing change request instead of failing when it already has one.",annotations:{title:"Open Change Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,head:Q$.string().describe("Branch being proposed"),base:Q$.string().describe("Branch it should land on"),title:Q$.string(),body:Q$.string().optional()}),outputSchema:Q$.object({changeRequest:ST0,existed:Q$.boolean()}),handler:async($,Z)=>{await Z.access.check();let Q=await Qc(Z,$),Y=await Q.readForBranch($.head);if(Y&&Y.state==="open"){if($.body&&$.body!==Y.body)await Q.describe(Y.number,$.body);return{changeRequest:$.body?{...Y,body:$.body}:Y,existed:!0}}return{changeRequest:await Q.open({head:$.head,base:$.base,title:$.title,body:$.body}),existed:!1}}}),du$=g({name:"CHANGE_REQUEST_MERGE",description:"Land a change request. Reports why it could not merge rather than throwing.",annotations:{title:"Merge Change Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Q$.object({...SN,number:Q$.number().int().positive(),strategy:Q$.enum(["any","squash"]).default("any").describe("`squash` when the result must be one commit; `any` uses whatever the repository allows"),commitTitle:Q$.string().optional(),commitMessage:Q$.string().optional()}),outputSchema:Q$.object({merged:Q$.boolean(),reason:Q$.enum(["conflict","blocked","rate_limited","not_found","error"]).optional(),detail:Q$.string().optional()}),handler:async($,Z)=>{await Z.access.check();let Y=await(await Qc(Z,$)).merge($.number,{strategy:$.strategy,commitTitle:$.commitTitle,commitMessage:$.commitMessage});return Y.merged?{merged:!0}:{merged:!1,reason:Y.reason,detail:Y.detail}}})});import{z as f4}from"zod";function CT0($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}function GQ1($){let Z=$.trim();return Z.length>0?Z:void 0}function WQ1($,Z){return $===void 0||$.includes(Z)}var B36,O36,D36,L36,w36,E36,j36,KQ1;var iu$=D(()=>{q0();gE0();B36=["thread","task","connection"],O36=f4.object({type:f4.literal("thread"),id:f4.string(),title:f4.string(),created_at:f4.string(),updated_at:f4.string(),virtual_mcp_id:f4.string().nullable(),run_config:f4.record(f4.string(),f4.unknown()).nullable(),status:f4.string().nullable()}),D36=f4.object({type:f4.literal("task"),id:f4.string(),title:f4.string(),created_at:f4.string(),updated_at:f4.string(),key:f4.string().nullable(),status:f4.string().nullable(),repo:f4.string().nullable()}),L36=f4.object({type:f4.literal("connection"),id:f4.string(),title:f4.string(),icon:f4.string().nullable(),slug:f4.string().nullable()}),w36=f4.discriminatedUnion("type",[O36,D36,L36]),E36=f4.object({query:f4.string().max(256).describe("Free-text search query. Empty string returns the most recently updated resources."),limit:f4.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:f4.array(f4.enum(B36)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),j36=f4.object({items:f4.array(w36),totalCount:f4.number()});KQ1=g({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads, task-board cards and MCP connections). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:E36,outputSchema:j36,handler:async($,Z)=>{await Z.access.check();let Q=p(Z),Y=$.limit??20,X=WQ1($.types,"thread"),J=WQ1($.types,"task"),G=WQ1($.types,"connection"),W=[],K=0,[H,F,U]=await Promise.all([X?Z.storage.threads.list(void 0,{limit:Y,offset:0,search:GQ1($.query),includeArchived:!1}):null,J?Z.storage.taskBoard.searchByTitle(Q.id,GQ1($.query)??"",Y):null,G?Z.storage.connections.searchByTitle(Q.id,GQ1($.query)??"",Y):null]);if(H){K+=H.total;for(let N of H.threads)W.push({type:"thread",id:N.id,title:N.title??"",created_at:CT0(N.created_at),updated_at:CT0(N.updated_at),virtual_mcp_id:N.virtual_mcp_id??null,run_config:N.run_config??null,status:sG(N).status})}if(F){K+=F.length;for(let N of F)W.push({type:"task",id:N.id,title:N.title??"",created_at:CT0(N.createdAt),updated_at:CT0(N.updatedAt),key:Q.slug?Yu(Q.slug,N.keySeq):null,status:N.status??null,repo:N.repo??null})}if(U){K+=U.length;for(let N of U)W.push({type:"connection",id:N.id,title:N.title,icon:N.icon??null,slug:N.slug??null})}return{items:W,totalCount:K}}})});var pu$=D(()=>{iu$()});var IQ0={};T4(IQ0,{toolSubsetMCP:()=>HQ1,managementMCP:()=>Vu,managementContextStore:()=>FN,listManagementTools:()=>P36,TOOL_BY_NAME:()=>Yc,CORE_TOOLS:()=>tu$});import{z as nu$}from"zod";async function P36($){let Z=await Vu($),[Q,Y]=ln.createLinkedPair();await Z.connect(Y);let X=new r9({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:T5});try{return await X.connect(Q),(await X.listTools()).tools}finally{await X.close().catch(()=>{}),await Z.close().catch(()=>{})}}var tu$,Yc,HQ1=($,Z)=>{let Q=new fK({name:$,version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:T5});for(let Y of Z){let X=Yc.get(Y);if(!X){console.warn(`[${$}] unknown tool "${Y}" \u2014 not registered`);continue}let{config:J,handler:G}=Se(X);Q.registerTool(X.name,J,G)}return Q},Vu=async($)=>{let Z=new fK({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:T5});for(let X of Yc.values()){let{config:J,handler:G}=Se(X);Z.registerTool(X.name,J,G)}let Q=FT0();for(let X of Q){let J=X.arguments?.length?Object.fromEntries(X.arguments.map((G)=>{let W=G.required?nu$.string():nu$.string().optional();return[G.name,G.description?W.describe(G.description):W]})):void 0;Z.registerPrompt(X.name,{title:X.title,description:X.description,...J?{argsSchema:J}:{}},(G)=>{return{messages:[{role:"user",content:{type:"text",text:typeof X.text==="function"?X.text(G??{}):X.text}}]}})}if($.organization?.id){let X=await $.storage.brandContext.list($.organization.id),J=new Set;for(let G of X){let W=G.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),K=W?`brand-${W}`:`brand-${G.id}`;if(J.has(K))K=`${K}-${G.id.slice(0,8)}`;J.add(K);let H=[`# Brand: ${G.name}`,"",`**Domain:** ${G.domain}`,"","## Overview",G.overview];if(G.colors){let U=Object.entries(G.colors).filter(([,N])=>N);if(U.length>0){H.push("","## Colors");for(let[N,B]of U)H.push(`- **${N}:** ${B}`)}}if(G.fonts){let U=Object.entries(G.fonts).filter(([,N])=>N);if(U.length>0){H.push("","## Fonts");for(let[N,B]of U)H.push(`- ${B} (${N})`)}}if(G.logo)H.push("",`**Logo:** ${G.logo}`);if(G.favicon)H.push(`**Favicon:** ${G.favicon}`);if(G.ogImage)H.push(`**OG Image:** ${G.ogImage}`);if(G.images&&G.images.length>0){H.push("","## Images");for(let U of G.images){let N=Object.entries(U).map(([B,O])=>`${B}: ${O}`).join(", ");H.push(`- ${N}`)}}let F=H.join(`
 `);Z.prompt(K,`Brand context for ${G.name}`,()=>({messages:[{role:"user",content:{type:"text",text:F}}]}))}}let Y=Uy$();for(let X of Y)Z.resource(X.name,X.uri,{description:X.description,mimeType:X.mimeType??"text/markdown"},async(J)=>{return{contents:[{uri:typeof J==="string"?J:J.href,mimeType:X.mimeType??"text/markdown",text:X.text}]}});return Z};var $D=D(()=>{vK();yi();KQ();t1$();G$$();y8$();l8$();Y4$();H4$();J6$();vz$();lz$();nz$();az$();hP$();dP$();nT$();sT$();$R$();Qx$();Fx$();Nx$();Ex$();gx$();_71();UT0();UT0();yy$();ju$();Pu$();Tu$();yu$();mu$();pu$();tu$=[Ap0,Tp0,Rp0,qp0,Ip0,Mp0,Sp0,Vp0,fz$,xz$,gz$,hz$,zv,wv,Ev,jv,q11,I11,M11,V11,S11,C11,Lv,_11,x11,g11,h11,u11,Oe0,m11,i11,p11,n11,l11,c11,Sr0,Cp0,_p0,vp0,fp0,bp0,yp0,gp0,hp0,cp0,dp0,mp0,ip0,pp0,np0,tp0,op0,rp0,sp0,ap0,ep0,Qn0,Xn0,Hn0,L71,T71,R71,ki0,_j,vj,pi0,ni0,ti0,zi0,Ei0,Li0,wi0,bj,yj,gj,hj,uj,u8$,Lp0,wp0,Ep0,jp0,zp0,Ui0,Bi0,Oi0,Ni0,y$1,g$1,h$1,$$1,$v,Zv,Q$1,Y$1,Qv,o11,r11,s11,a11,e11,X$1,J$1,G$1,S$1,C$1,_$1,v$1,f$1,b$1,x$1,lj,cj,dj,Dp0,g41,h41,u41,l41,c41,d41,m41,i41,p41,n41,t41,s41,a41,tT$,oT$,rT$,Z61,Q61,H71,U71,N71,B71,O71,D71,Ux$,Bx$,Ox$,Dx$,Lx$,wx$,vx$,fx$,bx$,xx$,yx$,k71,V71,S71,C71,Gv,Wv,Kv,Hv,ea0,v71,f71,b71,x71,y71,g71,...Eu$,Fa0,$Q1,ZQ1,Vu$,Su$,Cu$,_u$,vu$,fu$,bu$,xu$,XQ1,gu$,hu$,uu$,lu$,cu$,du$,KQ1],Yc=new Map(tu$.map(($)=>[$.name,$]))});import{z as ou$}from"zod";function A36($){return[{permissions:{self:["*"]},getTools:async()=>{let{CORE_TOOLS:Z}=await Promise.resolve().then(() => ($D(),IQ0));return Z.map((Q)=>{return{name:Q.name,inputSchema:ou$.toJSONSchema(Q.inputSchema,{unrepresentable:"any"}),outputSchema:Q.outputSchema?ou$.toJSONSchema(Q.outputSchema,{unrepresentable:"any"}):void 0,description:Q.description}})},data:Cd1(y5(),$)},{data:Sd1()},{data:Vd1($)}]}async function ru$($,Z){try{let Q=Z8(),Y=M0();await Q.db.insertInto("organization_billing").values({organization_id:$}).onConflict((W)=>W.column("organization_id").doNothing()).execute();let X=new YY(Y.encryptionKey),J=new ni(Q.db,X),G=A36($);await Promise.all(G.map(async(W)=>{let K=null;if(W.permissions)K=(await Q8.api.createApiKey({body:{name:`${W.data.app_name??crypto.randomUUID()}-mcp`,userId:Z,permissions:W.permissions,rateLimitEnabled:!1,metadata:{organization:{id:$},purpose:"default-org-connections"}}}))?.key;let H=await xg({id:"pending",title:W.data.title,connection_type:W.data.connection_type,connection_url:W.data.connection_url,connection_token:W.data.connection_token??K,connection_headers:W.data.connection_headers}).catch(()=>null),F=await W.getTools?.()??H?.tools??null,U=H?.scopes?.length?H.scopes:null,N=W.data.id?W.data.id.startsWith(`${$}_`)?W.data.id:`${$}_${W.data.id}`:void 0;await J.create({...W.data,id:N,tools:F,configuration_scopes:U,organization_id:$,created_by:Z,connection_token:W.data.connection_token??K})}));try{await Fi0({orgId:$,createdBy:Z})}catch(W){console.error("Failed to enqueue studio pack install:",W)}if(Y.aiGatewayEnabled&&Y.studioProvisionSecretKey&&dO.provisionKey)try{let W=await AK(Z),K=await dO.provisionKey(W,$);await new hn(Q.db,X).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:K,organizationId:$,createdBy:Z})}catch(W){console.error("Failed to auto-provision Deco AI Gateway key:",W)}}catch(Q){console.error("Error creating default MCP connections:",Q)}}var su$=D(()=>{V8();n70();P5();fG();fB();tm0();zl0();o70();E$();jJ();e70();vB()});import{createHash as T36}from"crypto";function au$($){let Z=$;while(Z?.[_T0])Z=Z[_T0];return Z}function UQ1($){let{objectStorage:Z,baseUrl:Q,orgSlug:Y,prefix:X="connection-icons",maxBytes:J=q36,dryRun:G=!1}=$;return async(W)=>{if(typeof W!=="string")return W;let K=W.match(R36);if(!K)return W;if(!Z||!Y)return W;let[,H,F]=K,U=H.toLowerCase(),N=M36[U];if(!N)return W;if(Math.floor(F.length*3/4)>J)return console.warn(`[asset-hoister] asset exceeds ${J} bytes, keeping inline`),W;let B=Buffer.from(F,"base64"),O=T36("sha256").update(B).digest("hex"),L=`${X}/${O}.${N}`;if(G)return qx(Q,Y,L);try{return await Z.put(L,B,{contentType:U}),qx(Q,Y,L)}catch(w){return console.error("[asset-hoister] upload failed, keeping inline asset:",w),W}}}async function FQ1($,Z,Q=0){if(Q>I36)return $;if(typeof $==="string")return await Z($)??$;if(Array.isArray($)){let Y=await Promise.all($.map((X)=>FQ1(X,Z,Q+1)));return Y.some((X,J)=>X!==$[J])?Y:$}if($!==null&&typeof $==="object"){let Y=Object.entries($),X=await Promise.all(Y.map(([,W])=>FQ1(W,Z,Q+1))),J=!1,G={};return Y.forEach(([W,K],H)=>{if(G[W]=X[H],X[H]!==K)J=!0}),J?G:$}return $}async function he($,Z){let Q={...$};if(typeof Q.icon==="string")Q.icon=await Z(Q.icon);if(Q.metadata!==null&&typeof Q.metadata==="object")Q.metadata=await FQ1(Q.metadata,Z);return Q}function k36($,Z){return new Proxy($,{get(Q,Y,X){if(Y===_T0)return Q;if(Y==="create")return async(G)=>Q.create(await he(G,Z));if(Y==="createNew")return async(G)=>Q.createNew(await he(G,Z));if(Y==="update")return async(G,W)=>Q.update(G,await he(W,Z));let J=Reflect.get(Q,Y,X);return typeof J==="function"?J.bind(Q):J}})}function V36($,Z){return new Proxy($,{get(Q,Y,X){if(Y===_T0)return Q;if(Y==="create")return async(G,W,K,H)=>Q.create(G,W,await he(K,Z),H);if(Y==="update")return async(G,W,K)=>Q.update(G,W,await he(K,Z));let J=Reflect.get(Q,Y,X);return typeof J==="function"?J.bind(Q):J}})}function NQ1($,Z){let Q=UQ1(Z);if(eu$($.connections))$.connections=k36(au$($.connections),Q);if(eu$($.virtualMcps))$.virtualMcps=V36(au$($.virtualMcps),Q)}function eu$($){return $!==null&&typeof $==="object"}var R36,q36=5242880,I36=64,_T0,M36;var BQ1=D(()=>{u3();R36=/^data:((?:image|audio|video)\/[^;,]+)(?:;[^,]+)?;base64,(.+)$/is,_T0=Symbol("assetHoistingTarget"),M36={"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/x-icon":"ico","image/vnd.microsoft.icon":"ico","audio/mpeg":"mp3","audio/mp4":"m4a","audio/wav":"wav","audio/x-wav":"wav","audio/ogg":"ogg","audio/webm":"weba","audio/aac":"aac","video/mp4":"mp4","video/webm":"webm","video/ogg":"ogv","video/quicktime":"mov"}});async function $l$($,Z){let Q=ZY();if(!Q)return Z;let Y=await Z8().db.selectFrom("organization").select("slug").where("id","=",$).executeTakeFirst();if(!Y?.slug)return Z;return await UQ1({objectStorage:YJ(Q,$),baseUrl:y5(),orgSlug:Y.slug,prefix:"org-logos"})(Z)??Z}var Zl$=D(()=>{fG();SB();BQ1();P5()});function S36($,Z){let Q=$.email.split("@")[1]?.toLowerCase()??null;return{distinctId:$.id,properties:{$set:{email:$.email,name:$.name,email_verified:$.emailVerified},$set_once:{first_seen_at:Z.toISOString(),signup_email_domain:Q}}}}function OQ1($){V1.identify(S36($,new Date))}var Ql$=D(()=>{h4()});import{adminAc as Yl$,memberAc as C36}from"@decocms/better-auth/plugins/organization/access";function LQ1($){let Z=["*",...$];return{user:{self:[...J50],...C36.statements},admin:{self:Z,...Yl$.statements},owner:{self:Z,...Yl$.statements}}}function _36($,Z){for(let[Q,Y]of Object.entries(Z)){let X=$[Q];if(!X)return!1;for(let J of Y)if(!X.includes(J)&&!X.includes("*"))return!1}return!0}function Xl$($,Z,Q){if(!$)return"fallback";if($.includes(","))return"fallback";if(!hx.includes($))return"fallback";let Y=Q[$];if(!Y)return"fallback";return _36(Y,Z)?"grant":"deny"}function Jl$(){if(!DQ1){let $=Object.values(OE()).flatMap((Z)=>Z.map((Q)=>Q.name));DQ1=LQ1($)}return DQ1}var DQ1;var wQ1=D(()=>{gx();GQ()});import{decodeJwt as v36}from"jose";import{sql as ue}from"kysely";async function x36($){let{user:Z,token:Q}=$;if(!Q?.idToken)return;let Y;try{Y=v36(Q.idToken)}catch{return}let{preferred_username:X,upn:J}=Y,G=[X,J].filter((H)=>typeof H==="string"&&H.length>0&&H.toLowerCase()!==Z.email.toLowerCase()).map((H)=>H.toLowerCase());if(G.length===0)return;let{db:W}=Z8(),K=await W.selectFrom("user").selectAll().where("email","in",G).where("id","!=",Z.id).executeTakeFirst();if(!K)return;try{await W.transaction().execute(async(H)=>{await ue`UPDATE "account" SET "userId" = ${K.id} WHERE "userId" = ${Z.id}`.execute(H),await ue`UPDATE "session" SET "userId" = ${K.id} WHERE "userId" = ${Z.id}`.execute(H),await ue`
         UPDATE "member" SET "userId" = ${K.id}
         WHERE "userId" = ${Z.id}
@@ -2833,7 +2833,7 @@ ${Z}`}:Y)}}var Fc$=D(()=>{B9()});async function vW6($,Z,Q){if(!$)return!1;let Y=
         AND date >= {since:Date} AND date <= {until:Date}
       GROUP BY ${Y}
       ORDER BY pageviews DESC
-      LIMIT 50`,{slug:$,since:Z,until:Q})).map((J)=>({key:J.key,pageviews:Number(J.pageviews),visitors:Number(J.visitors)}))}async function um$($){let{since:Z,until:Q}=lm$(90),Y=await cm$($,Z,Q);return[...new Set(Y.map(JT0))]}async function ER0($){let Z=$.get("studioContext");if(!LE(Z))return $.json({error:"Unauthorized"},401);let Q=p(Z),Y=$.req.param("site");if(!Y)return $.json({error:"site is required"},400);let X=Y.toLowerCase();if(!await Z.storage.orgSites.isOwnedBy(X,Q.id))return $.json({error:"Site not found in organization"},404);return{slug:X}}var QF6,YF6,gm$,z3="site_id IN (SELECT id FROM default.dim_sites WHERE name = {slug:String})",UF6,OF6="https://deco.lilstts.com/plausible",DF6=12000,LF6,dm$=()=>{let $=new Z1;return $.get("/:site/cdn/data",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;if(!_f())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!QF6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=oY1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J,H=hm$(Z.req.query("filters"));try{let F;switch(Y){case"summary":F=await JF6(G,W,K,H);break;case"timeline":F=await GF6(G,W,K,J.granularity,H);break;case"cache-status":F=await WF6(G,W,K,H);break;case"status-codes":F=await KF6(G,W,K,H);break;case"top-paths":F=await HF6(G,W,K,Z.req.query("groupByPath")==="1",H);break;case"top-countries":F=await FF6(G,W,K,H);break}return Z.json({available:!0,view:Y,range:X,data:F})}catch(F){return console.error(`[monitor] cdn ${Y} query failed for site="${G}":`,F),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/audience/data",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;if(!_f())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!UF6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=oY1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J;try{let H;switch(Y){case"summary":H=await NF6(G,W,K);break;case"timeline":H=await BF6(G,W,K);break;case"top-sources":H=await rY1(G,W,K,"utm_source");break;case"top-countries":H=await rY1(G,W,K,"country");break;case"devices":H=await rY1(G,W,K,"device_type");break}return Z.json({available:!0,view:Y,range:X,data:H})}catch(H){return console.error(`[monitor] audience ${Y} query failed for site="${G}":`,H),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/hosts",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q;if(!_f())return Z.json({available:!1,hosts:[]});try{let X=await um$(Y);return Z.json({available:!0,hosts:X})}catch(X){return console.error(`[monitor] hosts failed for site="${Y}":`,X),Z.json({available:!0,hosts:[]})}}),$.get("/:site/onedollar",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q,X=M0().oneDollarStatsApiKey;if(!X)return Z.json({available:!1,error:"OneDollarStats not configured"});let J=Z.req.query("report")??"kpis",G=LF6[J];if(!G)return Z.json({error:`unknown report: ${J}`},400);let W=Z.req.query("range")??"7d",K=oY1(W,Z.req.query("since"),Z.req.query("until"));if(!K)return Z.json({error:`unknown range: ${W}`},400);let H=await um$(Y),F=Z.req.query("host"),U=F&&H.includes(F)?F:H[0];if(!U)return Z.json({available:!0,report:J,range:W,results:[]});let{since:N,until:B}=K,O=J==="timeseries"?K.granularity==="hourly"?"time:hour":"time:day":G.dimension,L={page:"event:page",source:"visit:referrer",referrer:"visit:referrer",country:"visit:country",browser:"visit:browser",os:"visit:os",device:"visit:device",utm_campaign:"visit:utm_campaign",utm_source:"visit:utm_source",utm_medium:"visit:utm_medium",utm_content:"visit:utm_content",utm_term:"visit:utm_term"},w={equals:"is",not_equals:"is_not",contains:"contains",not_contains:"contains_not"},E=hm$(Z.req.query("filters")).map((z)=>{let P=L[z.field],A=w[z.op];return P&&A?[A,P,[z.value]]:null}).filter(Boolean),j=async(z)=>{let P=await fetch(OF6,{method:"POST",headers:{"Content-Type":"application/json","x-api-key":X,Accept:"application/json"},body:JSON.stringify({site_id:U,metrics:G.metrics,date_range:z,...O?{dimensions:[O]}:{},...G.order?{order_by:[[G.order,"desc"]]}:{},...E.length?{filters:E}:{},pagination:{limit:100,offset:0}}),signal:AbortSignal.timeout(DF6)});if(!P.ok)throw Error(`OneDollarStats ${P.status}`);return(await P.json().catch(()=>null))?.results??[]};try{let z=await j([N,B]),P;if(J==="kpis"||J==="timeseries"&&Z.req.query("compare")==="1"){let q=Date.parse(`${N}T00:00:00Z`),k=86400000,M=jR0(new Date(q-86400000)),C=jR0(new Date(q-K.days*86400000));P=await j([C,M]).catch(()=>{return})}return Z.json({available:!0,report:J,range:W,host:U,metrics:G.metrics,results:z,...P?{previous:P}:{}})}catch(z){return console.error(`[monitor] onedollar ${J} failed for host="${U}":`,z),Z.json({error:"Failed to reach OneDollarStats"},502)}}),$};var mm$=D(()=>{h$();E$();w71();E71();QF6=new Set(["summary","timeline","cache-status","status-codes","top-paths","top-countries"]),YF6={today:{days:1,granularity:"hourly"},yesterday:{days:1,granularity:"hourly",endOffsetDays:1},"7d":{days:7,granularity:"daily"},"14d":{days:14,granularity:"daily"},"30d":{days:30,granularity:"daily"},"90d":{days:90,granularity:"daily"},"180d":{days:180,granularity:"daily"},"1y":{days:365,granularity:"daily"}};gm$=/^\d{4}-\d{2}-\d{2}$/;UF6=new Set(["summary","timeline","top-sources","top-countries","devices"]);LF6={kpis:{metrics:["visitors","visits","pageviews","bounce_rate","visit_duration"]},timeseries:{metrics:["pageviews","visits","visitors","bounce_rate","visit_duration"]},pages:{metrics:["pageviews","visitors"],dimension:"event:page",order:"pageviews"},sources:{metrics:["visitors"],dimension:"visit:referrer",order:"visitors"},countries:{metrics:["visitors"],dimension:"visit:country",order:"visitors"},browsers:{metrics:["visitors"],dimension:"visit:browser",order:"visitors"},os:{metrics:["visitors"],dimension:"visit:os",order:"visitors"},devices:{metrics:["visitors"],dimension:"visit:device",order:"visitors"},events:{metrics:["visitors","events"],dimension:"event:name",order:"events"},utm_campaign:{metrics:["visitors","events"],dimension:"visit:utm_campaign",order:"events"},utm_source:{metrics:["visitors","events"],dimension:"visit:utm_source",order:"events"},utm_medium:{metrics:["visitors","events"],dimension:"visit:utm_medium",order:"events"},utm_content:{metrics:["visitors","events"],dimension:"visit:utm_content",order:"events"},utm_term:{metrics:["visitors","events"],dimension:"visit:utm_term",order:"events"}}});import{timingSafeEqual as wF6}from"crypto";function Dc($){let Q=$?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();return Q?Q:null}function sY1($,Z){let Q=Buffer.from($),Y=Buffer.from(Z);return Q.length===Y.length&&wF6(Q,Y)}function Lc($){let Z=process.env.VAULT_SERVICE_TOKEN;return!!Z&&sY1($,Z)}function im$($){if(!$)return null;return $ instanceof Date?$.toISOString():$}function EF6($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>typeof Z==="string");if(typeof $!=="string")return[];try{let Z=JSON.parse($);return Array.isArray(Z)?Z.filter((Q)=>typeof Q==="string"):[]}catch{return[]}}async function pm$($,Z,Q){let Y=Dc($.req.header("authorization"));if(!Y)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let X=$.get("studioContext"),J=X.organization?.id;if(!J)return{ok:!1,response:$.json({error:"Organization context required"},403)};if(Lc(Y))return{ok:!0,ctx:X,organizationId:J};let G=await X.storage.connectionCredentialVault.authenticateWorkloadToken(Y);if(!G||G.organizationId!==J)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let W=await X.storage.connections.findById(G.subjectConnectionId,J);if(!W||W.status!=="active")return{ok:!1,response:$.json({error:"Unauthorized"},401)};if(!await X.storage.connectionCredentialVault.hasGrant({organizationId:J,subjectConnectionId:G.subjectConnectionId,targetConnectionId:Z,scope:Q}))return{ok:!1,response:$.json({error:"Forbidden"},403)};return{ok:!0,ctx:X,organizationId:J}}var nm$=()=>{let $=new Z1;return $.post("/vault/connections/batch",async(Z)=>{let Q=Dc(Z.req.header("authorization"));if(!Q||!Lc(Q))return Z.json({error:"Unauthorized"},401);let Y=Z.get("studioContext"),X=Y.organization?.id;if(!X)return Z.json({error:"Organization context required"},403);let J=await Z.req.json().catch(()=>null),G=Array.isArray(J?.connectionIds)?[...new Set(J.connectionIds)].filter((B)=>typeof B==="string"&&B.length>0):[];if(G.length===0||G.length>20)return Z.json({error:"connectionIds must be a non-empty string array (max 20)"},400);let{items:W}=await Y.storage.connections.list(X,{includeVirtual:!0,where:{field:["id"],operator:"in",value:G},limit:G.length}),K=new Map(W.map((B)=>[B.id,B])),H=new Set((await Y.db.selectFrom("downstream_tokens").select("connectionId").where("connectionId","in",G).execute()).map((B)=>B.connectionId)),F=new Map((await Y.db.selectFrom("connections").select(["id","configuration_state","connection_token"]).where("id","in",G).where("organization_id","=",X).execute()).map((B)=>[B.id,B])),U=new R5(Y.db,Y.vault),N={};return await Promise.all(G.map(async(B)=>{try{let O=K.get(B);if(!O||O.status!=="active"){N[B]={error:"Connection not found"};return}if(F.get(B)?.configuration_state&&!O.configuration_state){N[B]={error:"MCP configuration could not be decrypted"};return}let L={type:"mcp_configuration",state:O.configuration_state??{},scopes:O.configuration_scopes??[]},w=null;if(H.has(B)){let E=await RJ({connectionId:B,connectionUrl:O.connection_url,tokenStorage:U});if(E.state==="valid"||E.state==="refreshed"){let j=await U.get(B);w={type:"oauth_access_token",tokenType:"Bearer",accessToken:E.accessToken,expiresAt:im$(j?.expiresAt??null),scope:j?.scope??null}}}else if(O.connection_token)w={type:"static_token",tokenType:"Bearer",accessToken:O.connection_token,expiresAt:null,scope:null};else if(F.get(B)?.connection_token){N[B]={error:"Connection token could not be decrypted"};return}N[B]={configuration:L,accessToken:w}}catch(O){N[B]={error:O instanceof Error?O.message:String(O)}}})),Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json(N)}),$.post("/vault/connections/:connectionId/access-token",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await pm$(Z,Q,x90);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.storage.connections.findById(Q,J);if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W=new R5(X.db,X.vault),K=await RJ({connectionId:Q,connectionUrl:G.connection_url,tokenStorage:W});if(K.state==="missing"){if(G.connection_token)return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"static_token",tokenType:"Bearer",accessToken:G.connection_token,expiresAt:null,scope:null});if((await X.db.selectFrom("connections").select("connection_token").where("id","=",Q).where("organization_id","=",J).executeTakeFirst())?.connection_token)return Z.json({error:"Connection token could not be decrypted"},424);return Z.json({error:"Downstream token not found"},409)}if(K.state==="expired_without_refresh"||K.state==="refresh_failed")return Z.json({error:"Downstream token refresh failed"},424);let H=await W.get(Q);return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"oauth_access_token",tokenType:"Bearer",accessToken:K.accessToken,expiresAt:im$(H?.expiresAt??null),scope:H?.scope??null})}),$.post("/vault/connections/:connectionId/configuration",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await pm$(Z,Q,y90);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.db.selectFrom("connections").select(["status","configuration_state","configuration_scopes"]).where("id","=",Q).where("organization_id","=",J).executeTakeFirst();if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W={};if(G.configuration_state)try{let K=await X.vault.decrypt(G.configuration_state),H=JSON.parse(K);if(typeof H!=="object"||H===null||Array.isArray(H))throw Error("MCP configuration state is not an object");W=H}catch{return Z.json({error:"MCP configuration could not be decrypted"},424)}return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"mcp_configuration",state:W,scopes:EF6(G.configuration_scopes)})}),$};var X00=D(()=>{h$();hG();g90();FW()});import{createHmac as jF6}from"crypto";import{mkdir as zF6,writeFile as PF6}from"fs/promises";import{dirname as AF6,join as rm$}from"path";function RF6($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return rm$(TF6,Z)}function tm$($,Z){let Q=RF6($),Y=DG(Z);return rm$(Q,Y)}function om$($,Z,Q,Y,X){let J=M0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`,W=jF6("sha256",J).update(G).digest("hex");return sY1(X,W)}function aY1($){let Z=$.split(".").pop()?.toLowerCase()||"";return{jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",bmp:"image/bmp",pdf:"application/pdf",json:"application/json",xml:"application/xml",txt:"text/plain",html:"text/html",htm:"text/html",css:"text/css",csv:"text/csv",md:"text/markdown",js:"application/javascript",mjs:"application/javascript",ts:"application/typescript",mp4:"video/mp4",webm:"video/webm",avi:"video/x-msvideo",mov:"video/quicktime",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf"}[Z]||"application/octet-stream"}var TF6="./data/assets",zR0=($)=>{let Z=new Z1,Q=$.orgFromPath?"/*":"/:orgId/*";return Z.get(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="GET")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!om$(X,G,F,"GET",K))return Y.json({error:"Invalid signature"},403);let N=tm$(X,G);try{let B=Bun.file(N);if(!await B.exists())return Y.json({error:"File not found"},404);let L=aY1(G);return new Response(B.stream(),{headers:{"Content-Type":L,"Content-Length":B.size.toString(),"Cache-Control":"private, max-age=3600"}})}catch(B){return console.error("Error serving file:",B),Y.json({error:"Failed to read file"},500)}}),Z.put(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="PUT")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!om$(X,G,F,"PUT",K))return Y.json({error:"Invalid signature"},403);let N=tm$(X,G),B=AF6(N);try{await zF6(B,{recursive:!0});let O=await Y.req.arrayBuffer();return await PF6(N,Buffer.from(O)),Y.json({success:!0,key:G})}catch(O){return console.error("Error saving file:",O),Y.json({error:"Failed to save file"},500)}}),Z};var PR0=D(()=>{h$();E$();u3();X00()});function eY1($){let Z=new URL(qF6);if(Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("state",$.state),$.selectAccount)Z.searchParams.set("prompt","select_account");return Z.toString()}function IF6($,Z=200){let Q=$!==null&&typeof $==="object"?$:{};if(typeof Q.error==="string"){let Y=typeof Q.error_description==="string"?` (${Q.error_description})`:"";throw new p0({provider:"github",status:400,message:`GitHub OAuth code exchange failed: ${Q.error}${Y}`})}if(typeof Q.access_token!=="string"||Q.access_token.length===0)throw new p0({provider:"github",status:Z,message:"GitHub OAuth code exchange returned no access token"});return{accessToken:Q.access_token,refreshToken:typeof Q.refresh_token==="string"&&Q.refresh_token.length>0?Q.refresh_token:null,expiresIn:typeof Q.expires_in==="number"&&Number.isFinite(Q.expires_in)?Q.expires_in:null,scope:typeof Q.scope==="string"&&Q.scope.length>0?Q.scope:null,tokenEndpoint:sm$}}async function am$($){let Z;try{let X=process.env.GITHUB_OAUTH_TOKEN_URL??sm$;Z=await fetch(X,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json"},body:JSON.stringify({client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),signal:AbortSignal.timeout(zn0)})}catch(X){throw new p0({provider:"github",status:0,message:`GitHub OAuth code exchange failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}let Q=await Z.text();if(!Z.ok)throw new p0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange failed: ${Z.status} ${Q.slice(0,300)}`});let Y;try{Y=JSON.parse(Q)}catch(X){throw new p0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange returned invalid JSON: ${Q.slice(0,300)}`,cause:X})}return IF6(Y,Z.status)}var qF6="https://github.com/login/oauth/authorize",sm$="https://github.com/login/oauth/access_token";var em$=D(()=>{t5();Yh()});function $i$($){let Z=new URL(`https://${CU}/site/oauth2/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.toString()}function MF6(){return`https://${CU}/site/oauth2/access_token`}async function Zi$($){let Z=MF6(),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(kF6)})}catch(J){throw new p0({provider:"bitbucket",status:0,message:`Bitbucket token exchange failed: ${VF6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new p0({provider:"bitbucket",status:Y.status,message:`Bitbucket token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new p0({provider:"bitbucket",status:Y.status,message:"Bitbucket token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scopes==="string"?X.scopes:null,tokenEndpoint:Z}}function VF6($){return $ instanceof Error?$.message:String($)}var kF6=15000;var Qi$=D(()=>{t5();Jh()});function Yi$($){let Z=new URL(`https://${$.host}/oauth/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.searchParams.set("scope",($.scopes??SF6).join(" ")),Z.toString()}function CF6($){return`https://${$}/oauth/token`}async function Xi$($){let Z=CF6($.host),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(_F6)})}catch(J){throw new p0({provider:"gitlab",status:0,message:`GitLab token exchange failed: ${vF6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new p0({provider:"gitlab",status:Y.status,message:`GitLab token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new p0({provider:"gitlab",status:Y.status,message:"GitLab token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scope==="string"?X.scope:null,tokenEndpoint:Z}}function vF6($){return $ instanceof Error?$.message:String($)}var SF6,_F6=15000;var Ji$=D(()=>{t5();SF6=["api","read_user"]});import{z as vN}from"zod";function J00($){if(!$)return"/";if(!$.startsWith("/")||$.startsWith("//")||$.includes("\\")||/[\r\n\t]/.test($))return"/";return $}function df($){return`${F5()}/api/_git/${$}/callback`}function lQ($,Z){let Q=new URL($,F5());if(Q.searchParams.delete("git_error"),Z)Q.searchParams.set("git_error",Z);return Q.toString()}async function AR0($,Z){let Q=$.organization?.id,Y=$.auth.user?.id;if(!Q||!Y)throw Error("Session with an organization is required");return $.storage.gitProviderOAuthStates.create({organizationId:Q,userId:Y,...Z})}async function TR0($,Z,Q){if(!Q)return{ok:!1,error:"missing_state",returnTo:"/"};let Y=await $.storage.gitProviderOAuthStates.consume(Q);if(!Y||Y.provider!==Z)return{ok:!1,error:"invalid_state",returnTo:"/"};let X=J00(Y.returnTo);if($.auth.user?.id!==Y.userId)return{ok:!1,error:"session_mismatch",returnTo:X};return{ok:!0,state:Y,returnTo:X}}var Gi$=()=>{let $=new Z1;return $.get("/git-providers/github/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=wD();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await AR0(Q,{provider:"github",host:"github.com",returnTo:J00(Z.req.query("returnTo"))});return Z.redirect(eY1({clientId:Y.clientId,redirectUri:df("github"),state:X,selectAccount:!0}))}),$.get("/git-providers/github/install",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=wD();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await AR0(Q,{provider:"github",host:"github.com",returnTo:J00(Z.req.query("returnTo"))}),J=new URL(`https://github.com/apps/${encodeURIComponent(Y.slug)}/installations/new`);return J.searchParams.set("state",X),Z.redirect(J.toString())}),$.get("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y={organizationId:Q.organization.id,userId:Q.auth.user.id},X=await Q.storage.githubConnectFlows.get(Z.req.param("id"),Y);if(!X)return Z.json({error:"flow_expired"},410);let J=GH();if(!J)return Z.json({error:"not_configured"},503);try{let{installations:G}=await J.listAuthorizedInstallations(await Q.vault.decrypt(X.encrypted_access_token));return Z.json({installations:G.map(({repositoryIds:W,...K})=>({...K,repositoryCount:W?.length??null})),expiresAt:X.expires_at})}catch{return Z.json({error:"github_unavailable"},502)}}),$.get("/git-providers/github/flows/:id/repositories",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y=vN.object({installationId:vN.coerce.number().int().positive().safe(),page:vN.coerce.number().int().positive().safe().default(1),query:vN.string().trim().max(256).optional()}).safeParse(Z.req.query());if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=GH();if(!G)return Z.json({error:"not_configured"},503);try{let W=await Q.vault.decrypt(J.encrypted_access_token),H=(await G.listAuthorizedInstallations(W,Y.data.installationId)).installations.find((N)=>N.installationId===Y.data.installationId);if(!H)return Z.json({error:"installation_forbidden"},403);let F=await G.listRepositoryChoices(W,H,Y.data.page,Y.data.query),U=await Q.storage.gitProviderAccounts.findByExternalId({organizationId:X.organizationId,host:"github.com",externalAccountId:String(H.installationId)});return Z.json({...F,accountVersion:nQ1(U)})}catch{return Z.json({error:"github_unavailable"},502)}}),$.post("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);if(await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let Y=vN.object({installationId:vN.number().int().positive().safe(),repositoryIds:vN.array(vN.number().int().positive().safe()).min(1).max(gt).refine((H)=>new Set(H).size===H.length),accountVersion:vN.string().max(200).nullable()}).safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=GH();if(!G)return Z.json({error:"not_configured"},503);let W;try{W=await G.listAuthorizedInstallations(await Q.vault.decrypt(J.encrypted_access_token),Y.data.installationId)}catch{return Z.json({error:"github_unavailable"},502)}let K=W.installations.find((H)=>H.installationId===Y.data.installationId);if(!K)return Z.json({error:"installation_forbidden"},403);try{if(!await G.canAuthorizeRepositories(await Q.vault.decrypt(J.encrypted_access_token),K,Y.data.repositoryIds))return Z.json({error:"repositories_forbidden"},403)}catch{return Z.json({error:"github_unavailable"},502)}try{let H=await Q.storage.githubConnectFlows.connect(Z.req.param("id"),X,{organizationId:X.organizationId,type:"github",host:"github.com",authKind:"github_app",externalAccountId:String(K.installationId),login:K.login,avatarUrl:K.avatarUrl,installationId:K.installationId,installationAuthorizedBy:W.userId,installationRepositoryIds:Y.data.repositoryIds},Y.data.accountVersion);if(!H)return Z.json({error:"flow_expired"},410);return Z.json({account:{id:H.id,login:H.login}})}catch(H){if(H instanceof iT0)return Z.json({error:"account_changed"},409);throw H}}),$.delete("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);return await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),await Q.storage.githubConnectFlows.cancel(Z.req.param("id"),{organizationId:Q.organization.id,userId:Q.auth.user.id}),Z.body(null,204)}),$.get("/git-providers/github/accounts/:id/manage",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=await Q.storage.gitProviderAccounts.get(Z.req.param("id"),Q.organization.id);if(!Y||Y.type!=="github"||!Y.installationId)return Z.json({error:"Account not found"},404);let X=GH();if(!X)return Z.json({error:"not_configured"},503);let J=await X.getInstallation(Y.installationId);if(!J)return Z.json({error:"Installation not found"},404);let G=J.accountType==="Organization"?`/organizations/${encodeURIComponent(J.login)}/settings/installations/${J.installationId}`:`/settings/installations/${J.installationId}`;return Z.redirect(`https://github.com${G}`)}),$.get("/git-providers/gitlab/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);let Y=jY0(),X=(Z.req.query("host")??Y?.host??"gitlab.com").trim().toLowerCase();if(!Y||Y.host!==X)return Z.json({error:`No GitLab OAuth application is configured for ${X}. Connect with an access token instead.`},503);let J=await AR0(Q,{provider:"gitlab",host:X,returnTo:J00(Z.req.query("returnTo"))});return Z.redirect(Yi$({host:X,clientId:Y.clientId,redirectUri:df("gitlab"),state:J}))}),$.get("/git-providers/bitbucket/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);let Y=JY0();if(!Y)return Z.json({error:"No Bitbucket OAuth consumer is configured. Connect with an access token instead."},503);let X=await AR0(Q,{provider:"bitbucket",host:Y.host,returnTo:J00(Z.req.query("returnTo"))});return Z.redirect($i$({clientId:Y.clientId,redirectUri:df("bitbucket"),state:X}))}),$},wc;var $X1=D(()=>{h$();$H();P5();ZY0();oQ1();em$();oj();Jh();Kh();Qi$();Ji$();wc=new Z1;wc.get("/github/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=wD(),G=GH(),W=$.req.query("code");if(!J||!G)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await am$({clientId:J.clientId,clientSecret:J.clientSecret,code:W,redirectUri:df("github")}),H={organizationId:X.organizationId,userId:X.userId},F=new URL(Y,F5()),U=F.searchParams.get("git_flow"),N=await Z.vault.encrypt(K.accessToken),B=U&&await Z.storage.githubConnectFlows.refresh(U,H,N)?U:await Z.storage.githubConnectFlows.create(H,N);return F.searchParams.delete("git_error"),F.searchParams.set("git_flow",B),$.redirect(F.toString())}catch(K){return console.error("[git-providers] github callback failed",{message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}});wc.get("/github/setup",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=wD();if(!J)return $.redirect(lQ(Y,"not_configured"));let G=await Z.storage.gitProviderOAuthStates.create(X);return $.redirect(eY1({clientId:J.clientId,redirectUri:df("github"),state:G}))});wc.get("/gitlab/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"gitlab",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=jY0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await Xi$({host:J,clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:df("gitlab")}),H=await XY0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"gitlab",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(lQ(Y))}catch(K){return console.error("[git-providers] gitlab callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}});wc.get("/bitbucket/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"bitbucket",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=JY0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await Zi$({clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:df("bitbucket")}),H=await WY0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"bitbucket",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(lQ(Y))}catch(K){return console.error("[git-providers] bitbucket callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}})});var W00=_((hF6)=>{hF6.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(hF6.HttpAuthLocation||(hF6.HttpAuthLocation={}));hF6.HttpApiKeyAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(hF6.HttpApiKeyAuthLocation||(hF6.HttpApiKeyAuthLocation={}));hF6.EndpointURLScheme=void 0;(function($){$.HTTP="http",$.HTTPS="https"})(hF6.EndpointURLScheme||(hF6.EndpointURLScheme={}));hF6.AlgorithmId=void 0;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(hF6.AlgorithmId||(hF6.AlgorithmId={}));var fF6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>hF6.AlgorithmId.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>hF6.AlgorithmId.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},bF6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},xF6=($)=>{return fF6($)},yF6=($)=>{return bF6($)};hF6.FieldPosition=void 0;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(hF6.FieldPosition||(hF6.FieldPosition={}));var gF6="__smithy_context";hF6.IniSectionType=void 0;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(hF6.IniSectionType||(hF6.IniSectionType={}));hF6.RequestHandlerProtocol=void 0;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(hF6.RequestHandlerProtocol||(hF6.RequestHandlerProtocol={}));hF6.SMITHY_CONTEXT_KEY=gF6;hF6.getDefaultClientConfiguration=xF6;hF6.resolveDefaultRuntimeConfig=yF6});var TX1=_((EN6)=>{var FX1=z0("crypto"),WX1=z0("fs"),dF6=B00(),mF6=O00(),FF=z0("stream"),Bi$=($)=>typeof ArrayBuffer==="function"&&$ instanceof ArrayBuffer||Object.prototype.toString.call($)==="[object ArrayBuffer]",zc=($,Z=0,Q=$.byteLength-Z)=>{if(!Bi$($))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof $} (${$})`);return Buffer.from($,Z,Q)},MR0=($,Z)=>{if(typeof $!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof $} (${$})`);return Z?Buffer.from($,Z):Buffer.from($)},iF6=/^[A-Za-z0-9+/]*={0,2}$/,Oi$=($)=>{if($.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!iF6.exec($))throw TypeError("Invalid base64 string.");let Z=MR0($,"base64");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength)},kR0=($)=>{let Z=MR0($,"utf8");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength/Uint8Array.BYTES_PER_ELEMENT)},DX1=($)=>{let Z;if(typeof $==="string")Z=kR0($);else Z=$;if(typeof Z!=="object"||typeof Z.byteOffset!=="number"||typeof Z.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return zc(Z.buffer,Z.byteOffset,Z.byteLength).toString("base64")};function pF6($,Z,Q,Y){return class X extends Uint8Array{static fromString(J,G="utf-8"){if(typeof J==="string"){if(G==="base64")return X.mutate(Y(J));return X.mutate(Z(J))}throw Error(`Unsupported conversion from ${typeof J} to Uint8ArrayBlobAdapter.`)}static mutate(J){return Object.setPrototypeOf(J,X.prototype),J}transformToString(J="utf-8"){if(J==="base64")return Q(this);return $(this)}}}var Di$=($)=>{if(typeof $==="string")return $;if(typeof $!=="object"||typeof $.byteOffset!=="number"||typeof $.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return zc($.buffer,$.byteOffset,$.byteLength).toString("utf8")},cQ=Array.from({length:256},($,Z)=>Z.toString(16).padStart(2,"0"));function nF6($){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let Z=new Uint8Array(16);return $(Z),Z[6]=Z[6]&15|64,Z[8]=Z[8]&63|128,cQ[Z[0]]+cQ[Z[1]]+cQ[Z[2]]+cQ[Z[3]]+"-"+cQ[Z[4]]+cQ[Z[5]]+"-"+cQ[Z[6]]+cQ[Z[7]]+"-"+cQ[Z[8]]+cQ[Z[9]]+"-"+cQ[Z[10]]+cQ[Z[11]]+cQ[Z[12]]+cQ[Z[13]]+cQ[Z[14]]+cQ[Z[15]]}}var tF6=($,Z,Q=(Y)=>Y)=>$,oF6=($)=>{switch($){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${$}"`)}},rF6=($)=>{if($===null||$===void 0)return;if(typeof $==="number"){if($===0||$===1)N00.warn(qR0(`Expected boolean, got ${typeof $}: ${$}`));if($===0)return!1;if($===1)return!0}if(typeof $==="string"){let Z=$.toLowerCase();if(Z==="false"||Z==="true")N00.warn(qR0(`Expected boolean, got ${typeof $}: ${$}`));if(Z==="false")return!1;if(Z==="true")return!0}if(typeof $==="boolean")return $;throw TypeError(`Expected boolean, got ${typeof $}: ${$}`)},F00=($)=>{if($===null||$===void 0)return;if(typeof $==="string"){let Z=parseFloat($);if(!Number.isNaN(Z)){if(String(Z)!==String($))N00.warn(qR0(`Expected number but observed string: ${$}`));return Z}}if(typeof $==="number")return $;throw TypeError(`Expected number, got ${typeof $}: ${$}`)},sF6=Math.ceil(340282346638528860000000000000000000000),RR0=($)=>{let Z=F00($);if(Z!==void 0&&!Number.isNaN(Z)&&Z!==1/0&&Z!==-1/0){if(Math.abs(Z)>sF6)throw TypeError(`Expected 32-bit float, got ${$}`)}return Z},U00=($)=>{if($===null||$===void 0)return;if(Number.isInteger($)&&!Number.isNaN($))return $;throw TypeError(`Expected integer, got ${typeof $}: ${$}`)},aF6=U00,UX1=($)=>LX1($,32),NX1=($)=>LX1($,16),BX1=($)=>LX1($,8),LX1=($,Z)=>{let Q=U00($);if(Q!==void 0&&eF6(Q,Z)!==Q)throw TypeError(`Expected ${Z}-bit integer, got ${$}`);return Q},eF6=($,Z)=>{switch(Z){case 32:return Int32Array.of($)[0];case 16:return Int16Array.of($)[0];case 8:return Int8Array.of($)[0]}},$U6=($,Z)=>{if($===null||$===void 0){if(Z)throw TypeError(`Expected a non-null value for ${Z}`);throw TypeError("Expected a non-null value")}return $},Li$=($)=>{if($===null||$===void 0)return;if(typeof $==="object"&&!Array.isArray($))return $;let Z=Array.isArray($)?"array":typeof $;throw TypeError(`Expected object, got ${Z}: ${$}`)},ZU6=($)=>{if($===null||$===void 0)return;if(typeof $==="string")return $;if(["boolean","number","bigint"].includes(typeof $))return N00.warn(qR0(`Expected string, got ${typeof $}: ${$}`)),String($);throw TypeError(`Expected string, got ${typeof $}: ${$}`)},QU6=($)=>{if($===null||$===void 0)return;let Z=Li$($),Q=[];for(let Y in Z)if(Z[Y]!=null)Q.push(Y);if(Q.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(Q.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${Q} were not null.`);return Z},wX1=($)=>{if(typeof $=="string")return F00(Tc($));return F00($)},YU6=wX1,wi$=($)=>{if(typeof $=="string")return RR0(Tc($));return RR0($)},XU6=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,Tc=($)=>{let Z=$.match(XU6);if(Z===null||Z[0].length!==$.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat($)},EX1=($)=>{if(typeof $=="string")return Ei$($);return F00($)},JU6=EX1,GU6=EX1,WU6=($)=>{if(typeof $=="string")return Ei$($);return RR0($)},Ei$=($)=>{switch($){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${$}`)}},ji$=($)=>{if(typeof $==="string")return U00(Tc($));return U00($)},KU6=ji$,HU6=($)=>{if(typeof $==="string")return UX1(Tc($));return UX1($)},Pc=($)=>{if(typeof $==="string")return NX1(Tc($));return NX1($)},zi$=($)=>{if(typeof $==="string")return BX1(Tc($));return BX1($)},qR0=($)=>{return String(TypeError($).stack||$).split(`
+      LIMIT 50`,{slug:$,since:Z,until:Q})).map((J)=>({key:J.key,pageviews:Number(J.pageviews),visitors:Number(J.visitors)}))}async function um$($){let{since:Z,until:Q}=lm$(90),Y=await cm$($,Z,Q);return[...new Set(Y.map(JT0))]}async function ER0($){let Z=$.get("studioContext");if(!LE(Z))return $.json({error:"Unauthorized"},401);let Q=p(Z),Y=$.req.param("site");if(!Y)return $.json({error:"site is required"},400);let X=Y.toLowerCase();if(!await Z.storage.orgSites.isOwnedBy(X,Q.id))return $.json({error:"Site not found in organization"},404);return{slug:X}}var QF6,YF6,gm$,z3="site_id IN (SELECT id FROM default.dim_sites WHERE name = {slug:String})",UF6,OF6="https://deco.lilstts.com/plausible",DF6=12000,LF6,dm$=()=>{let $=new Z1;return $.get("/:site/cdn/data",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;if(!_f())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!QF6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=oY1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J,H=hm$(Z.req.query("filters"));try{let F;switch(Y){case"summary":F=await JF6(G,W,K,H);break;case"timeline":F=await GF6(G,W,K,J.granularity,H);break;case"cache-status":F=await WF6(G,W,K,H);break;case"status-codes":F=await KF6(G,W,K,H);break;case"top-paths":F=await HF6(G,W,K,Z.req.query("groupByPath")==="1",H);break;case"top-countries":F=await FF6(G,W,K,H);break}return Z.json({available:!0,view:Y,range:X,data:F})}catch(F){return console.error(`[monitor] cdn ${Y} query failed for site="${G}":`,F),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/audience/data",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;if(!_f())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!UF6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=oY1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J;try{let H;switch(Y){case"summary":H=await NF6(G,W,K);break;case"timeline":H=await BF6(G,W,K);break;case"top-sources":H=await rY1(G,W,K,"utm_source");break;case"top-countries":H=await rY1(G,W,K,"country");break;case"devices":H=await rY1(G,W,K,"device_type");break}return Z.json({available:!0,view:Y,range:X,data:H})}catch(H){return console.error(`[monitor] audience ${Y} query failed for site="${G}":`,H),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/hosts",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q;if(!_f())return Z.json({available:!1,hosts:[]});try{let X=await um$(Y);return Z.json({available:!0,hosts:X})}catch(X){return console.error(`[monitor] hosts failed for site="${Y}":`,X),Z.json({available:!0,hosts:[]})}}),$.get("/:site/onedollar",async(Z)=>{let Q=await ER0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q,X=M0().oneDollarStatsApiKey;if(!X)return Z.json({available:!1,error:"OneDollarStats not configured"});let J=Z.req.query("report")??"kpis",G=LF6[J];if(!G)return Z.json({error:`unknown report: ${J}`},400);let W=Z.req.query("range")??"7d",K=oY1(W,Z.req.query("since"),Z.req.query("until"));if(!K)return Z.json({error:`unknown range: ${W}`},400);let H=await um$(Y),F=Z.req.query("host"),U=F&&H.includes(F)?F:H[0];if(!U)return Z.json({available:!0,report:J,range:W,results:[]});let{since:N,until:B}=K,O=J==="timeseries"?K.granularity==="hourly"?"time:hour":"time:day":G.dimension,L={page:"event:page",source:"visit:referrer",referrer:"visit:referrer",country:"visit:country",browser:"visit:browser",os:"visit:os",device:"visit:device",utm_campaign:"visit:utm_campaign",utm_source:"visit:utm_source",utm_medium:"visit:utm_medium",utm_content:"visit:utm_content",utm_term:"visit:utm_term"},w={equals:"is",not_equals:"is_not",contains:"contains",not_contains:"contains_not"},E=hm$(Z.req.query("filters")).map((z)=>{let P=L[z.field],A=w[z.op];return P&&A?[A,P,[z.value]]:null}).filter(Boolean),j=async(z)=>{let P=await fetch(OF6,{method:"POST",headers:{"Content-Type":"application/json","x-api-key":X,Accept:"application/json"},body:JSON.stringify({site_id:U,metrics:G.metrics,date_range:z,...O?{dimensions:[O]}:{},...G.order?{order_by:[[G.order,"desc"]]}:{},...E.length?{filters:E}:{},pagination:{limit:100,offset:0}}),signal:AbortSignal.timeout(DF6)});if(!P.ok)throw Error(`OneDollarStats ${P.status}`);return(await P.json().catch(()=>null))?.results??[]};try{let z=await j([N,B]),P;if(J==="kpis"||J==="timeseries"&&Z.req.query("compare")==="1"){let q=Date.parse(`${N}T00:00:00Z`),k=86400000,M=jR0(new Date(q-86400000)),C=jR0(new Date(q-K.days*86400000));P=await j([C,M]).catch(()=>{return})}return Z.json({available:!0,report:J,range:W,host:U,metrics:G.metrics,results:z,...P?{previous:P}:{}})}catch(z){return console.error(`[monitor] onedollar ${J} failed for host="${U}":`,z),Z.json({error:"Failed to reach OneDollarStats"},502)}}),$};var mm$=D(()=>{h$();E$();w71();E71();QF6=new Set(["summary","timeline","cache-status","status-codes","top-paths","top-countries"]),YF6={today:{days:1,granularity:"hourly"},yesterday:{days:1,granularity:"hourly",endOffsetDays:1},"7d":{days:7,granularity:"daily"},"14d":{days:14,granularity:"daily"},"30d":{days:30,granularity:"daily"},"90d":{days:90,granularity:"daily"},"180d":{days:180,granularity:"daily"},"1y":{days:365,granularity:"daily"}};gm$=/^\d{4}-\d{2}-\d{2}$/;UF6=new Set(["summary","timeline","top-sources","top-countries","devices"]);LF6={kpis:{metrics:["visitors","visits","pageviews","bounce_rate","visit_duration"]},timeseries:{metrics:["pageviews","visits","visitors","bounce_rate","visit_duration"]},pages:{metrics:["pageviews","visitors"],dimension:"event:page",order:"pageviews"},sources:{metrics:["visitors"],dimension:"visit:referrer",order:"visitors"},countries:{metrics:["visitors"],dimension:"visit:country",order:"visitors"},browsers:{metrics:["visitors"],dimension:"visit:browser",order:"visitors"},os:{metrics:["visitors"],dimension:"visit:os",order:"visitors"},devices:{metrics:["visitors"],dimension:"visit:device",order:"visitors"},events:{metrics:["visitors","events"],dimension:"event:name",order:"events"},utm_campaign:{metrics:["visitors","events"],dimension:"visit:utm_campaign",order:"events"},utm_source:{metrics:["visitors","events"],dimension:"visit:utm_source",order:"events"},utm_medium:{metrics:["visitors","events"],dimension:"visit:utm_medium",order:"events"},utm_content:{metrics:["visitors","events"],dimension:"visit:utm_content",order:"events"},utm_term:{metrics:["visitors","events"],dimension:"visit:utm_term",order:"events"}}});import{timingSafeEqual as wF6}from"crypto";function Dc($){let Q=$?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();return Q?Q:null}function sY1($,Z){let Q=Buffer.from($),Y=Buffer.from(Z);return Q.length===Y.length&&wF6(Q,Y)}function Lc($){let Z=process.env.VAULT_SERVICE_TOKEN;return!!Z&&sY1($,Z)}function im$($){if(!$)return null;return $ instanceof Date?$.toISOString():$}function EF6($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>typeof Z==="string");if(typeof $!=="string")return[];try{let Z=JSON.parse($);return Array.isArray(Z)?Z.filter((Q)=>typeof Q==="string"):[]}catch{return[]}}async function pm$($,Z,Q){let Y=Dc($.req.header("authorization"));if(!Y)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let X=$.get("studioContext"),J=X.organization?.id;if(!J)return{ok:!1,response:$.json({error:"Organization context required"},403)};if(Lc(Y))return{ok:!0,ctx:X,organizationId:J};let G=await X.storage.connectionCredentialVault.authenticateWorkloadToken(Y);if(!G||G.organizationId!==J)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let W=await X.storage.connections.findById(G.subjectConnectionId,J);if(!W||W.status!=="active")return{ok:!1,response:$.json({error:"Unauthorized"},401)};if(!await X.storage.connectionCredentialVault.hasGrant({organizationId:J,subjectConnectionId:G.subjectConnectionId,targetConnectionId:Z,scope:Q}))return{ok:!1,response:$.json({error:"Forbidden"},403)};return{ok:!0,ctx:X,organizationId:J}}var nm$=()=>{let $=new Z1;return $.post("/vault/connections/batch",async(Z)=>{let Q=Dc(Z.req.header("authorization"));if(!Q||!Lc(Q))return Z.json({error:"Unauthorized"},401);let Y=Z.get("studioContext"),X=Y.organization?.id;if(!X)return Z.json({error:"Organization context required"},403);let J=await Z.req.json().catch(()=>null),G=Array.isArray(J?.connectionIds)?[...new Set(J.connectionIds)].filter((B)=>typeof B==="string"&&B.length>0):[];if(G.length===0||G.length>20)return Z.json({error:"connectionIds must be a non-empty string array (max 20)"},400);let{items:W}=await Y.storage.connections.list(X,{includeVirtual:!0,where:{field:["id"],operator:"in",value:G},limit:G.length}),K=new Map(W.map((B)=>[B.id,B])),H=new Set((await Y.db.selectFrom("downstream_tokens").select("connectionId").where("connectionId","in",G).execute()).map((B)=>B.connectionId)),F=new Map((await Y.db.selectFrom("connections").select(["id","configuration_state","connection_token"]).where("id","in",G).where("organization_id","=",X).execute()).map((B)=>[B.id,B])),U=new R5(Y.db,Y.vault),N={};return await Promise.all(G.map(async(B)=>{try{let O=K.get(B);if(!O||O.status!=="active"){N[B]={error:"Connection not found"};return}if(F.get(B)?.configuration_state&&!O.configuration_state){N[B]={error:"MCP configuration could not be decrypted"};return}let L={type:"mcp_configuration",state:O.configuration_state??{},scopes:O.configuration_scopes??[]},w=null;if(H.has(B)){let E=await RJ({connectionId:B,connectionUrl:O.connection_url,tokenStorage:U});if(E.state==="valid"||E.state==="refreshed"){let j=await U.get(B);w={type:"oauth_access_token",tokenType:"Bearer",accessToken:E.accessToken,expiresAt:im$(j?.expiresAt??null),scope:j?.scope??null}}}else if(O.connection_token)w={type:"static_token",tokenType:"Bearer",accessToken:O.connection_token,expiresAt:null,scope:null};else if(F.get(B)?.connection_token){N[B]={error:"Connection token could not be decrypted"};return}N[B]={configuration:L,accessToken:w}}catch(O){N[B]={error:O instanceof Error?O.message:String(O)}}})),Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json(N)}),$.post("/vault/connections/:connectionId/access-token",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await pm$(Z,Q,x90);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.storage.connections.findById(Q,J);if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W=new R5(X.db,X.vault),K=await RJ({connectionId:Q,connectionUrl:G.connection_url,tokenStorage:W});if(K.state==="missing"){if(G.connection_token)return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"static_token",tokenType:"Bearer",accessToken:G.connection_token,expiresAt:null,scope:null});if((await X.db.selectFrom("connections").select("connection_token").where("id","=",Q).where("organization_id","=",J).executeTakeFirst())?.connection_token)return Z.json({error:"Connection token could not be decrypted"},424);return Z.json({error:"Downstream token not found"},409)}if(K.state==="expired_without_refresh"||K.state==="refresh_failed")return Z.json({error:"Downstream token refresh failed"},424);let H=await W.get(Q);return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"oauth_access_token",tokenType:"Bearer",accessToken:K.accessToken,expiresAt:im$(H?.expiresAt??null),scope:H?.scope??null})}),$.post("/vault/connections/:connectionId/configuration",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await pm$(Z,Q,y90);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.db.selectFrom("connections").select(["status","configuration_state","configuration_scopes"]).where("id","=",Q).where("organization_id","=",J).executeTakeFirst();if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W={};if(G.configuration_state)try{let K=await X.vault.decrypt(G.configuration_state),H=JSON.parse(K);if(typeof H!=="object"||H===null||Array.isArray(H))throw Error("MCP configuration state is not an object");W=H}catch{return Z.json({error:"MCP configuration could not be decrypted"},424)}return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"mcp_configuration",state:W,scopes:EF6(G.configuration_scopes)})}),$};var X00=D(()=>{h$();hG();g90();FW()});import{createHmac as jF6}from"crypto";import{mkdir as zF6,writeFile as PF6}from"fs/promises";import{dirname as AF6,join as rm$}from"path";function RF6($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return rm$(TF6,Z)}function tm$($,Z){let Q=RF6($),Y=DG(Z);return rm$(Q,Y)}function om$($,Z,Q,Y,X){let J=M0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`,W=jF6("sha256",J).update(G).digest("hex");return sY1(X,W)}function aY1($){let Z=$.split(".").pop()?.toLowerCase()||"";return{jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",bmp:"image/bmp",pdf:"application/pdf",json:"application/json",xml:"application/xml",txt:"text/plain",html:"text/html",htm:"text/html",css:"text/css",csv:"text/csv",md:"text/markdown",js:"application/javascript",mjs:"application/javascript",ts:"application/typescript",mp4:"video/mp4",webm:"video/webm",avi:"video/x-msvideo",mov:"video/quicktime",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf"}[Z]||"application/octet-stream"}var TF6="./data/assets",zR0=($)=>{let Z=new Z1,Q=$.orgFromPath?"/*":"/:orgId/*";return Z.get(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="GET")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!om$(X,G,F,"GET",K))return Y.json({error:"Invalid signature"},403);let N=tm$(X,G);try{let B=Bun.file(N);if(!await B.exists())return Y.json({error:"File not found"},404);let L=aY1(G);return new Response(B.stream(),{headers:{"Content-Type":L,"Content-Length":B.size.toString(),"Cache-Control":"private, max-age=3600"}})}catch(B){return console.error("Error serving file:",B),Y.json({error:"Failed to read file"},500)}}),Z.put(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="PUT")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!om$(X,G,F,"PUT",K))return Y.json({error:"Invalid signature"},403);let N=tm$(X,G),B=AF6(N);try{await zF6(B,{recursive:!0});let O=await Y.req.arrayBuffer();return await PF6(N,Buffer.from(O)),Y.json({success:!0,key:G})}catch(O){return console.error("Error saving file:",O),Y.json({error:"Failed to save file"},500)}}),Z};var PR0=D(()=>{h$();E$();u3();X00()});function eY1($){let Z=new URL(qF6);if(Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("state",$.state),$.selectAccount)Z.searchParams.set("prompt","select_account");return Z.toString()}function IF6($,Z=200){let Q=$!==null&&typeof $==="object"?$:{};if(typeof Q.error==="string"){let Y=typeof Q.error_description==="string"?` (${Q.error_description})`:"";throw new p0({provider:"github",status:400,message:`GitHub OAuth code exchange failed: ${Q.error}${Y}`})}if(typeof Q.access_token!=="string"||Q.access_token.length===0)throw new p0({provider:"github",status:Z,message:"GitHub OAuth code exchange returned no access token"});return{accessToken:Q.access_token,refreshToken:typeof Q.refresh_token==="string"&&Q.refresh_token.length>0?Q.refresh_token:null,expiresIn:typeof Q.expires_in==="number"&&Number.isFinite(Q.expires_in)?Q.expires_in:null,scope:typeof Q.scope==="string"&&Q.scope.length>0?Q.scope:null,tokenEndpoint:sm$}}async function am$($){let Z;try{let X=process.env.GITHUB_OAUTH_TOKEN_URL??sm$;Z=await fetch(X,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json"},body:JSON.stringify({client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),signal:AbortSignal.timeout(zn0)})}catch(X){throw new p0({provider:"github",status:0,message:`GitHub OAuth code exchange failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}let Q=await Z.text();if(!Z.ok)throw new p0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange failed: ${Z.status} ${Q.slice(0,300)}`});let Y;try{Y=JSON.parse(Q)}catch(X){throw new p0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange returned invalid JSON: ${Q.slice(0,300)}`,cause:X})}return IF6(Y,Z.status)}var qF6="https://github.com/login/oauth/authorize",sm$="https://github.com/login/oauth/access_token";var em$=D(()=>{t5();Yh()});function $i$($){let Z=new URL(`https://${CU}/site/oauth2/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.toString()}function MF6(){return`https://${CU}/site/oauth2/access_token`}async function Zi$($){let Z=MF6(),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(kF6)})}catch(J){throw new p0({provider:"bitbucket",status:0,message:`Bitbucket token exchange failed: ${VF6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new p0({provider:"bitbucket",status:Y.status,message:`Bitbucket token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new p0({provider:"bitbucket",status:Y.status,message:"Bitbucket token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scopes==="string"?X.scopes:null,tokenEndpoint:Z}}function VF6($){return $ instanceof Error?$.message:String($)}var kF6=15000;var Qi$=D(()=>{t5();Jh()});function Yi$($){let Z=new URL(`https://${$.host}/oauth/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.searchParams.set("scope",($.scopes??SF6).join(" ")),Z.toString()}function CF6($){return`https://${$}/oauth/token`}async function Xi$($){let Z=CF6($.host),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(_F6)})}catch(J){throw new p0({provider:"gitlab",status:0,message:`GitLab token exchange failed: ${vF6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new p0({provider:"gitlab",status:Y.status,message:`GitLab token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new p0({provider:"gitlab",status:Y.status,message:"GitLab token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scope==="string"?X.scope:null,tokenEndpoint:Z}}function vF6($){return $ instanceof Error?$.message:String($)}var SF6,_F6=15000;var Ji$=D(()=>{t5();SF6=["api","read_user"]});import{z as vN}from"zod";function J00($){if(!$)return"/";if(!$.startsWith("/")||$.startsWith("//")||$.includes("\\")||/[\r\n\t]/.test($))return"/";return $}function df($){return`${F5()}/api/_git/${$}/callback`}function lQ($,Z){let Q=new URL($,F5());if(Q.searchParams.delete("git_error"),Z)Q.searchParams.set("git_error",Z);return Q.toString()}async function AR0($,Z){let Q=$.organization?.id,Y=$.auth.user?.id;if(!Q||!Y)throw Error("Session with an organization is required");return $.storage.gitProviderOAuthStates.create({organizationId:Q,userId:Y,...Z})}async function TR0($,Z,Q){if(!Q)return{ok:!1,error:"missing_state",returnTo:"/"};let Y=await $.storage.gitProviderOAuthStates.consume(Q);if(!Y||Y.provider!==Z)return{ok:!1,error:"invalid_state",returnTo:"/"};let X=J00(Y.returnTo);if($.auth.user?.id!==Y.userId)return{ok:!1,error:"session_mismatch",returnTo:X};return{ok:!0,state:Y,returnTo:X}}var Gi$=()=>{let $=new Z1;return $.get("/git-providers/github/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=wD();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await AR0(Q,{provider:"github",host:"github.com",returnTo:J00(Z.req.query("returnTo"))});return Z.redirect(eY1({clientId:Y.clientId,redirectUri:df("github"),state:X,selectAccount:!0}))}),$.get("/git-providers/github/install",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=wD();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await AR0(Q,{provider:"github",host:"github.com",returnTo:J00(Z.req.query("returnTo"))}),J=new URL(`https://github.com/apps/${encodeURIComponent(Y.slug)}/installations/new`);return J.searchParams.set("state",X),Z.redirect(J.toString())}),$.get("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y={organizationId:Q.organization.id,userId:Q.auth.user.id},X=await Q.storage.githubConnectFlows.get(Z.req.param("id"),Y);if(!X)return Z.json({error:"flow_expired"},410);let J=GH();if(!J)return Z.json({error:"not_configured"},503);try{let{installations:G}=await J.listAuthorizedInstallations(await Q.vault.decrypt(X.encrypted_access_token));return Z.json({installations:G.map(({repositoryIds:W,...K})=>({...K,repositoryCount:W?.length??null})),expiresAt:X.expires_at})}catch{return Z.json({error:"github_unavailable"},502)}}),$.get("/git-providers/github/flows/:id/repositories",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y=vN.object({installationId:vN.coerce.number().int().positive().safe(),page:vN.coerce.number().int().positive().safe().default(1),query:vN.string().trim().max(256).optional()}).safeParse(Z.req.query());if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=GH();if(!G)return Z.json({error:"not_configured"},503);try{let W=await Q.vault.decrypt(J.encrypted_access_token),H=(await G.listAuthorizedInstallations(W,Y.data.installationId)).installations.find((N)=>N.installationId===Y.data.installationId);if(!H)return Z.json({error:"installation_forbidden"},403);let F=await G.listRepositoryChoices(W,H,Y.data.page,Y.data.query),U=await Q.storage.gitProviderAccounts.findByExternalId({organizationId:X.organizationId,host:"github.com",externalAccountId:String(H.installationId)});return Z.json({...F,accountVersion:nQ1(U)})}catch{return Z.json({error:"github_unavailable"},502)}}),$.post("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);if(await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let Y=vN.object({installationId:vN.number().int().positive().safe(),repositoryIds:vN.array(vN.number().int().positive().safe()).min(1).max(gt).refine((H)=>new Set(H).size===H.length),accountVersion:vN.string().max(200).nullable()}).safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=GH();if(!G)return Z.json({error:"not_configured"},503);let W;try{W=await G.listAuthorizedInstallations(await Q.vault.decrypt(J.encrypted_access_token),Y.data.installationId)}catch{return Z.json({error:"github_unavailable"},502)}let K=W.installations.find((H)=>H.installationId===Y.data.installationId);if(!K)return Z.json({error:"installation_forbidden"},403);try{if(!await G.canAuthorizeRepositories(await Q.vault.decrypt(J.encrypted_access_token),K,Y.data.repositoryIds))return Z.json({error:"repositories_forbidden"},403)}catch{return Z.json({error:"github_unavailable"},502)}try{let H=await Q.storage.githubConnectFlows.connect(Z.req.param("id"),X,{organizationId:X.organizationId,type:"github",host:"github.com",authKind:"github_app",externalAccountId:String(K.installationId),login:K.login,avatarUrl:K.avatarUrl,installationId:K.installationId,installationAuthorizedBy:W.userId,installationRepositoryIds:Y.data.repositoryIds},Y.data.accountVersion);if(!H)return Z.json({error:"flow_expired"},410);return Z.json({account:{id:H.id,login:H.login}})}catch(H){if(H instanceof iT0)return Z.json({error:"account_changed"},409);throw H}}),$.delete("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);return await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),await Q.storage.githubConnectFlows.cancel(Z.req.param("id"),{organizationId:Q.organization.id,userId:Q.auth.user.id}),Z.body(null,204)}),$.get("/git-providers/github/accounts/:id/manage",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=await Q.storage.gitProviderAccounts.get(Z.req.param("id"),Q.organization.id);if(!Y||Y.type!=="github"||!Y.installationId)return Z.json({error:"Account not found"},404);let X=GH();if(!X)return Z.json({error:"not_configured"},503);let J=await X.getInstallation(Y.installationId);if(!J)return Z.json({error:"Installation not found"},404);let G=J.accountType==="Organization"?`/organizations/${encodeURIComponent(J.login)}/settings/installations/${J.installationId}`:`/settings/installations/${J.installationId}`;return Z.redirect(`https://github.com${G}`)}),$.get("/git-providers/gitlab/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=jY0(),X=(Z.req.query("host")??Y?.host??"gitlab.com").trim().toLowerCase();if(!Y||Y.host!==X)return Z.json({error:`No GitLab OAuth application is configured for ${X}. Connect with an access token instead.`},503);let J=await AR0(Q,{provider:"gitlab",host:X,returnTo:J00(Z.req.query("returnTo"))});return Z.redirect(Yi$({host:X,clientId:Y.clientId,redirectUri:df("gitlab"),state:J}))}),$.get("/git-providers/bitbucket/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=JY0();if(!Y)return Z.json({error:"No Bitbucket OAuth consumer is configured. Connect with an access token instead."},503);let X=await AR0(Q,{provider:"bitbucket",host:Y.host,returnTo:J00(Z.req.query("returnTo"))});return Z.redirect($i$({clientId:Y.clientId,redirectUri:df("bitbucket"),state:X}))}),$},wc;var $X1=D(()=>{h$();$H();P5();ZY0();oQ1();em$();oj();Jh();Kh();Qi$();Ji$();wc=new Z1;wc.get("/github/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=wD(),G=GH(),W=$.req.query("code");if(!J||!G)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await am$({clientId:J.clientId,clientSecret:J.clientSecret,code:W,redirectUri:df("github")}),H={organizationId:X.organizationId,userId:X.userId},F=new URL(Y,F5()),U=F.searchParams.get("git_flow"),N=await Z.vault.encrypt(K.accessToken),B=U&&await Z.storage.githubConnectFlows.refresh(U,H,N)?U:await Z.storage.githubConnectFlows.create(H,N);return F.searchParams.delete("git_error"),F.searchParams.set("git_flow",B),$.redirect(F.toString())}catch(K){return console.error("[git-providers] github callback failed",{message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}});wc.get("/github/setup",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=wD();if(!J)return $.redirect(lQ(Y,"not_configured"));let G=await Z.storage.gitProviderOAuthStates.create(X);return $.redirect(eY1({clientId:J.clientId,redirectUri:df("github"),state:G}))});wc.get("/gitlab/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"gitlab",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=jY0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await Xi$({host:J,clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:df("gitlab")}),H=await XY0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"gitlab",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(lQ(Y))}catch(K){return console.error("[git-providers] gitlab callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}});wc.get("/bitbucket/callback",async($)=>{let Z=await _7.create($.req.raw),Q=await TR0(Z,"bitbucket",$.req.query("state"));if(!Q.ok)return $.redirect(lQ(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=JY0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(lQ(Y,"not_configured"));if(!W)return $.redirect(lQ(Y,$.req.query("error")??"denied"));try{let K=await Zi$({clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:df("bitbucket")}),H=await WY0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"bitbucket",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(lQ(Y))}catch(K){return console.error("[git-providers] bitbucket callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(lQ(Y,"exchange_failed"))}})});var W00=_((hF6)=>{hF6.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(hF6.HttpAuthLocation||(hF6.HttpAuthLocation={}));hF6.HttpApiKeyAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(hF6.HttpApiKeyAuthLocation||(hF6.HttpApiKeyAuthLocation={}));hF6.EndpointURLScheme=void 0;(function($){$.HTTP="http",$.HTTPS="https"})(hF6.EndpointURLScheme||(hF6.EndpointURLScheme={}));hF6.AlgorithmId=void 0;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(hF6.AlgorithmId||(hF6.AlgorithmId={}));var fF6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>hF6.AlgorithmId.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>hF6.AlgorithmId.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},bF6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},xF6=($)=>{return fF6($)},yF6=($)=>{return bF6($)};hF6.FieldPosition=void 0;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(hF6.FieldPosition||(hF6.FieldPosition={}));var gF6="__smithy_context";hF6.IniSectionType=void 0;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(hF6.IniSectionType||(hF6.IniSectionType={}));hF6.RequestHandlerProtocol=void 0;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(hF6.RequestHandlerProtocol||(hF6.RequestHandlerProtocol={}));hF6.SMITHY_CONTEXT_KEY=gF6;hF6.getDefaultClientConfiguration=xF6;hF6.resolveDefaultRuntimeConfig=yF6});var TX1=_((EN6)=>{var FX1=z0("crypto"),WX1=z0("fs"),dF6=B00(),mF6=O00(),FF=z0("stream"),Bi$=($)=>typeof ArrayBuffer==="function"&&$ instanceof ArrayBuffer||Object.prototype.toString.call($)==="[object ArrayBuffer]",zc=($,Z=0,Q=$.byteLength-Z)=>{if(!Bi$($))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof $} (${$})`);return Buffer.from($,Z,Q)},MR0=($,Z)=>{if(typeof $!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof $} (${$})`);return Z?Buffer.from($,Z):Buffer.from($)},iF6=/^[A-Za-z0-9+/]*={0,2}$/,Oi$=($)=>{if($.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!iF6.exec($))throw TypeError("Invalid base64 string.");let Z=MR0($,"base64");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength)},kR0=($)=>{let Z=MR0($,"utf8");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength/Uint8Array.BYTES_PER_ELEMENT)},DX1=($)=>{let Z;if(typeof $==="string")Z=kR0($);else Z=$;if(typeof Z!=="object"||typeof Z.byteOffset!=="number"||typeof Z.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return zc(Z.buffer,Z.byteOffset,Z.byteLength).toString("base64")};function pF6($,Z,Q,Y){return class X extends Uint8Array{static fromString(J,G="utf-8"){if(typeof J==="string"){if(G==="base64")return X.mutate(Y(J));return X.mutate(Z(J))}throw Error(`Unsupported conversion from ${typeof J} to Uint8ArrayBlobAdapter.`)}static mutate(J){return Object.setPrototypeOf(J,X.prototype),J}transformToString(J="utf-8"){if(J==="base64")return Q(this);return $(this)}}}var Di$=($)=>{if(typeof $==="string")return $;if(typeof $!=="object"||typeof $.byteOffset!=="number"||typeof $.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return zc($.buffer,$.byteOffset,$.byteLength).toString("utf8")},cQ=Array.from({length:256},($,Z)=>Z.toString(16).padStart(2,"0"));function nF6($){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let Z=new Uint8Array(16);return $(Z),Z[6]=Z[6]&15|64,Z[8]=Z[8]&63|128,cQ[Z[0]]+cQ[Z[1]]+cQ[Z[2]]+cQ[Z[3]]+"-"+cQ[Z[4]]+cQ[Z[5]]+"-"+cQ[Z[6]]+cQ[Z[7]]+"-"+cQ[Z[8]]+cQ[Z[9]]+"-"+cQ[Z[10]]+cQ[Z[11]]+cQ[Z[12]]+cQ[Z[13]]+cQ[Z[14]]+cQ[Z[15]]}}var tF6=($,Z,Q=(Y)=>Y)=>$,oF6=($)=>{switch($){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${$}"`)}},rF6=($)=>{if($===null||$===void 0)return;if(typeof $==="number"){if($===0||$===1)N00.warn(qR0(`Expected boolean, got ${typeof $}: ${$}`));if($===0)return!1;if($===1)return!0}if(typeof $==="string"){let Z=$.toLowerCase();if(Z==="false"||Z==="true")N00.warn(qR0(`Expected boolean, got ${typeof $}: ${$}`));if(Z==="false")return!1;if(Z==="true")return!0}if(typeof $==="boolean")return $;throw TypeError(`Expected boolean, got ${typeof $}: ${$}`)},F00=($)=>{if($===null||$===void 0)return;if(typeof $==="string"){let Z=parseFloat($);if(!Number.isNaN(Z)){if(String(Z)!==String($))N00.warn(qR0(`Expected number but observed string: ${$}`));return Z}}if(typeof $==="number")return $;throw TypeError(`Expected number, got ${typeof $}: ${$}`)},sF6=Math.ceil(340282346638528860000000000000000000000),RR0=($)=>{let Z=F00($);if(Z!==void 0&&!Number.isNaN(Z)&&Z!==1/0&&Z!==-1/0){if(Math.abs(Z)>sF6)throw TypeError(`Expected 32-bit float, got ${$}`)}return Z},U00=($)=>{if($===null||$===void 0)return;if(Number.isInteger($)&&!Number.isNaN($))return $;throw TypeError(`Expected integer, got ${typeof $}: ${$}`)},aF6=U00,UX1=($)=>LX1($,32),NX1=($)=>LX1($,16),BX1=($)=>LX1($,8),LX1=($,Z)=>{let Q=U00($);if(Q!==void 0&&eF6(Q,Z)!==Q)throw TypeError(`Expected ${Z}-bit integer, got ${$}`);return Q},eF6=($,Z)=>{switch(Z){case 32:return Int32Array.of($)[0];case 16:return Int16Array.of($)[0];case 8:return Int8Array.of($)[0]}},$U6=($,Z)=>{if($===null||$===void 0){if(Z)throw TypeError(`Expected a non-null value for ${Z}`);throw TypeError("Expected a non-null value")}return $},Li$=($)=>{if($===null||$===void 0)return;if(typeof $==="object"&&!Array.isArray($))return $;let Z=Array.isArray($)?"array":typeof $;throw TypeError(`Expected object, got ${Z}: ${$}`)},ZU6=($)=>{if($===null||$===void 0)return;if(typeof $==="string")return $;if(["boolean","number","bigint"].includes(typeof $))return N00.warn(qR0(`Expected string, got ${typeof $}: ${$}`)),String($);throw TypeError(`Expected string, got ${typeof $}: ${$}`)},QU6=($)=>{if($===null||$===void 0)return;let Z=Li$($),Q=[];for(let Y in Z)if(Z[Y]!=null)Q.push(Y);if(Q.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(Q.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${Q} were not null.`);return Z},wX1=($)=>{if(typeof $=="string")return F00(Tc($));return F00($)},YU6=wX1,wi$=($)=>{if(typeof $=="string")return RR0(Tc($));return RR0($)},XU6=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,Tc=($)=>{let Z=$.match(XU6);if(Z===null||Z[0].length!==$.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat($)},EX1=($)=>{if(typeof $=="string")return Ei$($);return F00($)},JU6=EX1,GU6=EX1,WU6=($)=>{if(typeof $=="string")return Ei$($);return RR0($)},Ei$=($)=>{switch($){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${$}`)}},ji$=($)=>{if(typeof $==="string")return U00(Tc($));return U00($)},KU6=ji$,HU6=($)=>{if(typeof $==="string")return UX1(Tc($));return UX1($)},Pc=($)=>{if(typeof $==="string")return NX1(Tc($));return NX1($)},zi$=($)=>{if(typeof $==="string")return BX1(Tc($));return BX1($)},qR0=($)=>{return String(TypeError($).stack||$).split(`
 `).slice(0,5).filter((Z)=>!Z.includes("stackTraceWarning")).join(`
 `)},N00={warn:console.warn},FU6=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],jX1=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function UU6($){let Z=$.getUTCFullYear(),Q=$.getUTCMonth(),Y=$.getUTCDay(),X=$.getUTCDate(),J=$.getUTCHours(),G=$.getUTCMinutes(),W=$.getUTCSeconds(),K=X<10?`0${X}`:`${X}`,H=J<10?`0${J}`:`${J}`,F=G<10?`0${G}`:`${G}`,U=W<10?`0${W}`:`${W}`;return`${FU6[Y]}, ${K} ${jX1[Q]} ${Z} ${H}:${F}:${U} GMT`}var NU6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?[zZ]$/),BU6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=NU6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H]=Z,F=Pc(Ac(Y)),U=UF(X,"month",1,12),N=UF(J,"day",1,31);return K00(F,U,N,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})},OU6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(([-+]\d{2}\:\d{2})|[zZ])$/),DU6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=OU6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H,F]=Z,U=Pc(Ac(Y)),N=UF(X,"month",1,12),B=UF(J,"day",1,31),O=K00(U,N,B,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H});if(F.toUpperCase()!="Z")O.setTime(O.getTime()-kU6(F));return O},LU6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),wU6=new RegExp(/^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),EU6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? (\d{4})$/),jU6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-7231 date-times must be expressed as strings");let Z=LU6.exec($);if(Z){let[Q,Y,X,J,G,W,K,H]=Z;return K00(Pc(Ac(J)),KX1(X),UF(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})}if(Z=wU6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return TU6(K00(PU6(J),KX1(X),UF(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H}))}if(Z=EU6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return K00(Pc(Ac(H)),KX1(Y),UF(X.trimLeft(),"day",1,31),{hours:J,minutes:G,seconds:W,fractionalMilliseconds:K})}throw TypeError("Invalid RFC-7231 date-time value")},zU6=($)=>{if($===null||$===void 0)return;let Z;if(typeof $==="number")Z=$;else if(typeof $==="string")Z=wX1($);else if(typeof $==="object"&&$.tag===1)Z=$.value;else throw TypeError("Epoch timestamps must be expressed as floating point numbers or their string representation");if(Number.isNaN(Z)||Z===1/0||Z===-1/0)throw TypeError("Epoch timestamps must be valid, non-Infinite, non-NaN numerics");return new Date(Math.round(Z*1000))},K00=($,Z,Q,Y)=>{let X=Z-1;return qU6($,X,Q),new Date(Date.UTC($,X,Q,UF(Y.hours,"hour",0,23),UF(Y.minutes,"minute",0,59),UF(Y.seconds,"seconds",0,60),MU6(Y.fractionalMilliseconds)))},PU6=($)=>{let Z=new Date().getUTCFullYear(),Q=Math.floor(Z/100)*100+Pc(Ac($));if(Q<Z)return Q+100;return Q},AU6=1576800000000,TU6=($)=>{if($.getTime()-new Date().getTime()>AU6)return new Date(Date.UTC($.getUTCFullYear()-100,$.getUTCMonth(),$.getUTCDate(),$.getUTCHours(),$.getUTCMinutes(),$.getUTCSeconds(),$.getUTCMilliseconds()));return $},KX1=($)=>{let Z=jX1.indexOf($);if(Z<0)throw TypeError(`Invalid month: ${$}`);return Z+1},RU6=[31,28,31,30,31,30,31,31,30,31,30,31],qU6=($,Z,Q)=>{let Y=RU6[Z];if(Z===1&&IU6($))Y=29;if(Q>Y)throw TypeError(`Invalid day for ${jX1[Z]} in ${$}: ${Q}`)},IU6=($)=>{return $%4===0&&($%100!==0||$%400===0)},UF=($,Z,Q,Y)=>{let X=zi$(Ac($));if(X<Q||X>Y)throw TypeError(`${Z} must be between ${Q} and ${Y}, inclusive`);return X},MU6=($)=>{if($===null||$===void 0)return 0;return wi$("0."+$)*1000},kU6=($)=>{let Z=$[0],Q=1;if(Z=="+")Q=1;else if(Z=="-")Q=-1;else throw TypeError(`Offset direction, ${Z}, must be "+" or "-"`);let Y=Number($.substring(1,3)),X=Number($.substring(4,6));return Q*(Y*60+X)*60*1000},Ac=($)=>{let Z=0;while(Z<$.length-1&&$.charAt(Z)==="0")Z++;if(Z===0)return $;return $.slice(Z)},mf=function(Z){return Object.assign(new String(Z),{deserializeJSON(){return JSON.parse(String(Z))},toString(){return String(Z)},toJSON(){return String(Z)}})};mf.from=($)=>{if($&&typeof $==="object"&&($ instanceof mf||("deserializeJSON"in $)))return $;else if(typeof $==="string"||Object.getPrototypeOf($)===String.prototype)return mf(String($));return mf(JSON.stringify($))};mf.fromObject=mf.from;function VU6($){if($.includes(",")||$.includes('"'))$=`"${$.replace(/"/g,"\\\"")}"`;return $}var zX1="(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)(?:[ne|u?r]?s?day)?",PX1="(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)",AX1="(\\d?\\d):(\\d{2}):(\\d{2})(?:\\.(\\d+))?",Pi$="(\\d?\\d)",Ai$="(\\d{4})",SU6=new RegExp(/^(\d{4})-(\d\d)-(\d\d)[tT](\d\d):(\d\d):(\d\d)(\.(\d+))?(([-+]\d\d:\d\d)|[zZ])$/),CU6=new RegExp(`^${zX1}, ${Pi$} ${PX1} ${Ai$} ${AX1} GMT$`),_U6=new RegExp(`^${zX1}, ${Pi$}-${PX1}-(\\d\\d) ${AX1} GMT$`),vU6=new RegExp(`^${zX1} ${PX1} ( [1-9]|\\d\\d) ${AX1} ${Ai$}$`),fU6=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],bU6=($)=>{if($==null)return;let Z=NaN;if(typeof $==="number")Z=$;else if(typeof $==="string"){if(!/^-?\d*\.?\d+$/.test($))throw TypeError("parseEpochTimestamp - numeric string invalid.");Z=Number.parseFloat($)}else if(typeof $==="object"&&$.tag===1)Z=$.value;if(isNaN(Z)||Math.abs(Z)===1/0)throw TypeError("Epoch timestamps must be valid finite numbers.");return new Date(Math.round(Z*1000))},xU6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC3339 timestamps must be strings");let Z=SU6.exec($);if(!Z)throw TypeError(`Invalid RFC3339 timestamp format ${$}`);let[,Q,Y,X,J,G,W,,K,H]=Z;fN(Y,1,12),fN(X,1,31),fN(J,0,23),fN(G,0,59),fN(W,0,60);let F=new Date(Date.UTC(Number(Q),Number(Y)-1,Number(X),Number(J),Number(G),Number(W),Number(K)?Math.round(parseFloat(`0.${K}`)*1000):0));if(F.setUTCFullYear(Number(Q)),H.toUpperCase()!="Z"){let[,U,N,B]=/([+-])(\d\d):(\d\d)/.exec(H)||[void 0,"+",0,0],O=U==="-"?1:-1;F.setTime(F.getTime()+O*(Number(N)*60*60*1000+Number(B)*60*1000))}return F},yU6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC7231 timestamps must be strings.");let Z,Q,Y,X,J,G,W,K;if(K=CU6.exec($))[,Z,Q,Y,X,J,G,W]=K;else if(K=_U6.exec($))[,Z,Q,Y,X,J,G,W]=K,Y=(Number(Y)+1900).toString();else if(K=vU6.exec($))[,Q,Z,X,J,G,W,Y]=K;if(Y&&G){let H=Date.UTC(Number(Y),fU6.indexOf(Q),Number(Z),Number(X),Number(J),Number(G),W?Math.round(parseFloat(`0.${W}`)*1000):0);fN(Z,1,31),fN(X,0,23),fN(J,0,59),fN(G,0,60);let F=new Date(H);return F.setUTCFullYear(Number(Y)),F}throw TypeError(`Invalid RFC7231 date-time value ${$}.`)};function fN($,Z,Q){let Y=Number($);if(Y<Z||Y>Q)throw Error(`Value ${Y} out of range [${Z}, ${Q}]`)}function gU6($,Z,Q){if(Q<=0||!Number.isInteger(Q))throw Error("Invalid number of delimiters ("+Q+") for splitEvery.");let Y=$.split(Z);if(Q===1)return Y;let X=[],J="";for(let G=0;G<Y.length;G++){if(J==="")J=Y[G];else J+=Z+Y[G];if((G+1)%Q===0)X.push(J),J=""}if(J!=="")X.push(J);return X}var hU6=($)=>{let Z=$.length,Q=[],Y=!1,X=void 0,J=0;for(let G=0;G<Z;++G){let W=$[G];switch(W){case'"':if(X!=="\\")Y=!Y;break;case",":if(!Y)Q.push($.slice(J,G)),J=G+1;break}X=W}return Q.push($.slice(J)),Q.map((G)=>{G=G.trim();let W=G.length;if(W<2)return G;if(G[0]==='"'&&G[W-1]==='"')G=G.slice(1,W-1);return G.replace(/\\"/g,'"')})},Wi$=/^-?\d*(\.\d+)?$/;class VR0{string;type;constructor($,Z){if(this.string=$,this.type=Z,!Wi$.test($))throw Error('@smithy/core/serde - NumericValue must only contain [0-9], at most one decimal point ".", and an optional negation prefix "-".')}toString(){return this.string}static[Symbol.hasInstance]($){if(!$||typeof $!=="object")return!1;let Z=$;return VR0.prototype.isPrototypeOf($)||Z.type==="bigDecimal"&&Wi$.test(Z.string)}}function uU6($){return new VR0(String($),"bigDecimal")}var Ti$={},OX1={};for(let $=0;$<256;$++){let Z=$.toString(16).toLowerCase();if(Z.length===1)Z=`0${Z}`;Ti$[$]=Z,OX1[Z]=$}function lU6($){if($.length%2!==0)throw Error("Hex encoded strings must have an even number length");let Z=new Uint8Array($.length/2);for(let Q=0;Q<$.length;Q+=2){let Y=$.slice(Q,Q+2).toLowerCase();if(Y in OX1)Z[Q/2]=OX1[Y];else throw Error(`Cannot decode unrecognized sequence ${Y} as hexadecimal`)}return Z}function Ri$($){let Z="";for(let Q=0;Q<$.byteLength;Q++)Z+=Ti$[$[Q]];return Z}var cU6=($)=>{if(!$)return 0;if(typeof $==="string")return Buffer.byteLength($);else if(typeof $.byteLength==="number")return $.byteLength;else if(typeof $.size==="number")return $.size;else if(typeof $.start==="number"&&typeof $.end==="number")return $.end+1-$.start;else if($ instanceof WX1.ReadStream){if($.path!=null)return WX1.lstatSync($.path).size;else if(typeof $.fd==="number")return WX1.fstatSync($.fd).size}throw Error(`Body Length computation failed for ${$}`)},qi$=($)=>{if(typeof $==="string")return kR0($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength/Uint8Array.BYTES_PER_ELEMENT);return new Uint8Array($)},Ii$=($,Z)=>(Q,Y)=>async(X)=>{let{response:J}=await Q(X);try{let G=await Z(J,$);return{response:J,output:G}}catch(G){if(Object.defineProperty(G,"$response",{value:J,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in G)){try{G.message+=`
   Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.`}catch(K){if(!Y.logger||Y.logger?.constructor?.name==="NoOpLogger")console.warn("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.");else Y.logger?.warn?.("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.")}if(typeof G.$responseBodyText<"u"){if(G.$response)G.$response.body=G.$responseBodyText}try{if(dF6.HttpResponse.isInstance(J)){let{headers:K={}}=J,H=Object.entries(K);G.$metadata={httpStatusCode:J.statusCode,requestId:HX1(/^x-[\w-]+-request-?id$/,H),extendedRequestId:HX1(/^x-[\w-]+-id-2$/,H),cfId:HX1(/^x-[\w-]+-cf-id$/,H)}}}catch(K){}}throw G}},HX1=($,Z)=>{return(Z.find(([Q])=>{return Q.match($)})||[void 0,void 0])[1]},Mi$=($,Z)=>(Q,Y)=>async(X)=>{let J=$,G=Y.endpointV2?async()=>mF6.toEndpointV1(Y.endpointV2):J.endpoint;if(!G)throw Error("No valid endpoint provider available.");let W=await Z(X.input,{...$,endpoint:G});return Q({...X,request:W})},ki$={name:"deserializerMiddleware",step:"deserialize",tags:["DESERIALIZER"],override:!0},Vi$={name:"serializerMiddleware",step:"serialize",tags:["SERIALIZER"],override:!0};function dU6($,Z,Q){return{applyToStack:(Y)=>{Y.add(Ii$($,Q),ki$),Y.add(Mi$($,Z),Vi$)}}}class Si${algorithmIdentifier;secret;hash;constructor($,Z){this.algorithmIdentifier=$,this.secret=Z,this.reset()}update($,Z){this.hash.update(qi$(Ki$($,Z)))}digest(){return Promise.resolve(this.hash.digest())}reset(){this.hash=this.secret?FX1.createHmac(this.algorithmIdentifier,Ki$(this.secret)):FX1.createHash(this.algorithmIdentifier)}}function Ki$($,Z){if(Buffer.isBuffer($))return $;if(typeof $==="string")return MR0($,Z);if(ArrayBuffer.isView($))return zc($.buffer,$.byteOffset,$.byteLength);return zc($)}var Ci$=class extends FF.Duplex{expectedChecksum;checksumSourceLocation;checksum;source;base64Encoder;pendingCallback=null;constructor({expectedChecksum:Z,checksum:Q,source:Y,checksumSourceLocation:X,base64Encoder:J}){super();if(typeof Y.pipe==="function")this.source=Y;else throw Error(`@smithy/util-stream: unsupported source type ${Y?.constructor?.name??Y} in ChecksumStream.`);this.base64Encoder=J??DX1,this.expectedChecksum=Z,this.checksum=Q,this.checksumSourceLocation=X,this.source.pipe(this)}_read(Z){if(this.pendingCallback){let Q=this.pendingCallback;this.pendingCallback=null,Q()}}_write(Z,Q,Y){try{if(this.checksum.update(Z),!this.push(Z)){this.pendingCallback=Y;return}}catch(X){return Y(X)}return Y()}async _final(Z){try{let Q=await this.checksum.digest(),Y=this.base64Encoder(Q);if(this.expectedChecksum!==Y)return Z(Error(`Checksum mismatch: expected "${this.expectedChecksum}" but received "${Y}" in response header "${this.checksumSourceLocation}".`))}catch(Q){return Z(Q)}return this.push(null),Z()}},bN=($)=>typeof ReadableStream==="function"&&($?.constructor?.name===ReadableStream.name||$ instanceof ReadableStream),_i$=($)=>{return typeof Blob==="function"&&($?.constructor?.name===Blob.name||$ instanceof Blob)},mU6=($)=>new TextEncoder().encode($),vi$="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",Hi$=Object.entries(vi$).reduce(($,[Z,Q])=>{return $[Q]=Number(Z),$},{}),iU6=vi$.split(""),Ec=6,H00=8,pU6=63;function fi$($){let Z;if(typeof $==="string")Z=mU6($);else Z=$;let Q=typeof Z==="object"&&typeof Z.length==="number",Y=typeof Z==="object"&&typeof Z.byteOffset==="number"&&typeof Z.byteLength==="number";if(!Q&&!Y)throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");let X="";for(let J=0;J<Z.length;J+=3){let G=0,W=0;for(let H=J,F=Math.min(J+3,Z.length);H<F;H++)G|=Z[H]<<(F-H-1)*H00,W+=H00;let K=Math.ceil(W/Ec);G<<=K*Ec-W;for(let H=1;H<=K;H++){let F=(K-H)*Ec;X+=iU6[(G&pU6<<F)>>F]}X+="==".slice(0,4-K)}return X}var nU6=typeof ReadableStream==="function"?ReadableStream:function(){};class bi$ extends nU6{}var tU6=({expectedChecksum:$,checksum:Z,source:Q,checksumSourceLocation:Y,base64Encoder:X})=>{if(!bN(Q))throw Error(`@smithy/util-stream: unsupported source type ${Q?.constructor?.name??Q} in ChecksumStream.`);let J=X??fi$;if(typeof TransformStream!=="function")throw Error("@smithy/util-stream: unable to instantiate ChecksumStream because API unavailable: ReadableStream/TransformStream.");let G=new TransformStream({start(){},async transform(K,H){Z.update(K),H.enqueue(K)},async flush(K){let H=await Z.digest(),F=J(H);if($!==F){let U=Error(`Checksum mismatch: expected "${$}" but received "${F}" in response header "${Y}".`);K.error(U)}else K.terminate()}});Q.pipeThrough(G);let W=G.readable;return Object.setPrototypeOf(W,bi$.prototype),W};function oU6($){if(typeof ReadableStream==="function"&&bN($.source))return tU6($);return new Ci$($)}class IR0{allocByteArray;byteLength=0;byteArrays=[];constructor($){this.allocByteArray=$}push($){this.byteArrays.push($),this.byteLength+=$.byteLength}flush(){if(this.byteArrays.length===1){let Q=this.byteArrays[0];return this.reset(),Q}let $=this.allocByteArray(this.byteLength),Z=0;for(let Q=0;Q<this.byteArrays.length;++Q){let Y=this.byteArrays[Q];$.set(Y,Z),Z+=Y.byteLength}return this.reset(),$}reset(){this.byteArrays=[],this.byteLength=0}}function rU6($,Z,Q){let Y=$.getReader(),X=!1,J=0,G=["",new IR0((H)=>new Uint8Array(H))],W=-1,K=async(H)=>{let{value:F,done:U}=await Y.read(),N=F;if(U){if(W!==-1){let B=jc(G,W);if(aL(B)>0)H.enqueue(B)}H.close()}else{let B=yi$(N,!1);if(W!==B){if(W>=0)H.enqueue(jc(G,W));W=B}if(W===-1){H.enqueue(N);return}let O=aL(N);J+=O;let L=aL(G[W]);if(O>=Z&&L===0)H.enqueue(N);else{let w=xi$(G,W,N);if(!X&&J>Z*2)X=!0,Q?.warn(`@smithy/util-stream - stream chunk size ${O} is below threshold of ${Z}, automatically buffering.`);if(w>=Z)H.enqueue(jc(G,W));else await K(H)}}};return new ReadableStream({pull:K})}function xi$($,Z,Q){switch(Z){case 0:return $[0]+=Q,aL($[0]);case 1:case 2:return $[Z].push(Q),aL($[Z])}}function jc($,Z){switch(Z){case 0:let Q=$[0];return $[0]="",Q;case 1:case 2:return $[Z].flush()}throw Error(`@smithy/util-stream - invalid index ${Z} given to flush()`)}function aL($){return $?.byteLength??$?.length??0}function yi$($,Z=!0){if(Z&&typeof Buffer<"u"&&$ instanceof Buffer)return 2;if($ instanceof Uint8Array)return 1;if(typeof $==="string")return 0;return-1}function sU6($,Z,Q){if(bN($))return rU6($,Z,Q);let Y=new FF.Readable({read(){}}),X=!1,J=0,G=["",new IR0((K)=>new Uint8Array(K)),new IR0((K)=>Buffer.from(new Uint8Array(K)))],W=-1;return $.on("data",(K)=>{let H=yi$(K,!0);if(W!==H){if(W>=0)Y.push(jc(G,W));W=H}if(W===-1){Y.push(K);return}let F=aL(K);J+=F;let U=aL(G[W]);if(F>=Z&&U===0)Y.push(K);else{let N=xi$(G,W,K);if(!X&&J>Z*2)X=!0,Q?.warn(`@smithy/util-stream - stream chunk size ${F} is below threshold of ${Z}, automatically buffering.`);if(N>=Z)Y.push(jc(G,W))}}),$.on("end",()=>{if(W!==-1){let K=jc(G,W);if(aL(K)>0)Y.push(K)}Y.push(null)}),Y}var aU6=($,Z)=>{let{base64Encoder:Q,bodyLengthChecker:Y,checksumAlgorithmFn:X,checksumLocationName:J,streamHasher:G}=Z,W=Q!==void 0&&Y!==void 0&&X!==void 0&&J!==void 0&&G!==void 0,K=W?G(X,$):void 0,H=$.getReader();return new ReadableStream({async pull(F){let{value:U,done:N}=await H.read();if(N){if(F.enqueue(`0\r
@@ -2938,7 +2938,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${J.join(`
 `)}`:X}function sP6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var Lo$=200,lP6=12,dP6,iP6=300,Bq0=3;var nJ1=D(()=>{sZ();G8();Nq0();dP6={aheadBy:0,behindBy:0,files:[]}});function eP6($){if(!$||$.includes(".."))return!1;return aP6.test($)}function Eo$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!eP6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function jo$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var aP6;var zo$=D(()=>{aP6=/^[\w./@-]+$/});function g00($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function Ao$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Yw(zZ);let J=await ID($.storage,X,Y);if(J&&await _U($.storage,J)){let F=await WH($,J,{forceRefresh:!0}).catch((U)=>{throw new Yw(U instanceof Error?U.message:zZ)});await Po$($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Yw("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Nh({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:zZ;throw new Yw(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await KH(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=I5$(F instanceof Error?F.message:String(F));throw U?new Yw(N):F});await Po$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function Po$($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=fc($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await $L(K,$A6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var $A6=10485760,Yw;var tJ1=D(()=>{hG();Yq0();Xr();TY0();st();sZ();Yw=class Yw extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function QA6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!ZA6.test(Z))throw Error(`Invalid branch name: ${$}`)}function $b($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(XA6)])}async function GA6($,Z){let Q=$.var.studioContext,Y=LH(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=r_(G?.metadata?.runtime);if(W)return W;let K=UE0(Z.virtualMcpMetadata),H=K==="cms"?await MJ1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)Jr(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function WA6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await RY($.var.studioContext)}catch{return null}}function Zb($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function hc($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=g00(Z,Q);if(!X)throw new p0({provider:"github",status:404,message:"Project has no GitHub repository"});let J=p(Y);return Fh(Y,J.id,X)}function oJ1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=G6$(Z);if(Y!==void 0)return $.json({error:Q},429,{...L5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof D6)return $.json({error:Q},409,L5);let X=cG(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,L5)}return $.json({error:Q},502,L5)}async function qo$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function Io$($){try{let Z=await hc($),Q=await Oq0(Z,$.get("vmClaim").branch);return $.json(Q,200,L5)}catch(Z){return oJ1($,Z)}}function h00($,Z){let Y=(wq0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return wq0.set($,X),X.finally(()=>{if(wq0.get($)===X)wq0.delete($)}),Y}async function K7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,L5);let Y=Q?.runner??Zb($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...L5}})}}let O=await B.text(),L=Q?.redactRepoDir?KA6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...L5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function KA6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Eq0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function HA6($){return Mo$.includes($)}var ZA6,To$=524288,YA6=65536,XA6=1e4,Ro$=2000,JA6,wq0,L5,Mo$,ko$=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",JA6),$.post("/:virtualMcpId/:branch/write",(Q)=>K7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>K7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>K7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>K7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>K7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>K7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>K7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:$b(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!HA6(Y))return Q.json({error:`step must be one of: ${Mo$.join(", ")}`},400);let X=Q.get("vmClaim"),J=await MJ1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await WA6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,L5);if(Y==="start"){let G=p(Q.var.studioContext),W=oh(X.virtualMcpMetadata);try{await WE0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return K7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return lN(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Mt$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Io$(Q);return Z(Q)});let Z=(Q)=>K7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Ro$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Io$(Q);return K7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Ro$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await hc(Q),G=await Dq0(J,Y.branch,X.base);return Q.json(G,200,L5)}catch(X){return oJ1(Q,X)}return K7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,L5);let Y=Zb(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return h00(X,async()=>{try{await kJ1(W,Y,X);let K=g00(J,G);if(K)await Ao$(W,Y,X,K)}catch(K){if(K instanceof Yw)return Q.json({error:K.message},403,L5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,L5)}return K7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return h00(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,L5);try{let G=await hc(Q);return await wo$(G,Y.branch,J),Q.json({ok:!0},200,L5)}catch(G){let W=cG(G)===409||G instanceof D6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,L5)}});return h00(Y.claimName,()=>K7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return h00(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await hc(Q),H=W.base??await K.getDefaultBranch();return await Lq0(K,Y.branch,H),Q.json({ok:!0},200,L5)}catch(W){return oJ1(Q,W)}});let X=Zb(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return h00(J,async()=>{try{await kJ1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,L5)}return K7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",v5({maxSize:To$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Zb(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=CJ1(F)&&N?[F,U]:X?await Promise.all([Eq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Eq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await hc(Q);return Promise.all([Oq0(w,Y.branch),Dq0(w,Y.branch)])})(),L=await _t$(K,B,O);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",v5({maxSize:To$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Zb(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=CJ1(F)&&N?[F,U]:X?await Promise.all([Eq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Eq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await hc(Q);return Promise.all([Oq0(w,Y.branch),Dq0(w,Y.branch)])})(),L=await ft$(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=Zb(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return qo$(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",v5({maxSize:YA6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=Zb(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=Eo$(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=jo$(J,W.resolveType);return qo$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var Vo$=D(()=>{h$();YK();vc();IJ1();$r();Rt$();pG();rh();qt$();TW();It$();kt$();Wa0();Qr();fJ1();bt$();sZ();t5();nJ1();zo$();tJ1();ZA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;JA6=Qq0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=n0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=p(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{QA6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=Ao({orgId:X.id,virtualMcpId:J,branch:G}),H=await qr0(Q,G),F=Ir0(H,Y),U=Tt$({userId:F,projectRef:K}),N=W.metadata??null,B=await GA6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await RY(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});wq0=new Map;L5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Mo$=["clone","install","start"]});function So$($,Z,Q){let Y=rJ1.get($);if(!Y)Y={pending:null,running:!1},rJ1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)UA6($,Y);return J}async function UA6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await NA6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)rJ1.delete($)}}async function NA6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await gc(Z,Q),W=await Z.listDecofileEntries(G,Y),K=mJ1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=iJ1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await No$(Z.repo,L);let w=O[0]??`${Uq0(Y)}/${yJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of iJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Bo$(Z,F.values(),X),{decofile:B,skipped:O}=v00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:LW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:BA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=FA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function BA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return ao0(Y,$.deps.coAuthor)}var FA6=3,rJ1;var Co$=D(()=>{rL0();Jq0();c6();G8();sZ();Nq0();rJ1=new Map});import{createHmac as _o$,randomBytes as OA6,timingSafeEqual as DA6}from"crypto";function vo$(){if(jq0)return jq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return jq0=$?Buffer.from($):OA6(32),jq0}function sJ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+LA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=_o$("sha256",vo$()).update(Y).digest("base64url");return`${Y}.${X}`}function fo$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(_o$("sha256",vo$()).update(Y).digest("base64url"));if(X.length!==J.length||!DA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var LA6=21600000,jq0=null;var bo$=D(()=>{E$()});import{z as uc}from"zod";function EA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&wA6.test($)}function uo$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function u00($){let Z=$.get("decofileScope");return Fh($.var.studioContext,Z.organizationId,Z.githubRepo)}function l00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=cG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function lo$(){let $=new Z1;return $.use("/:virtualMcpId/:branch",ho$),$.use("/:virtualMcpId/:branch/*",ho$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Oo$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=sJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(uo$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return l00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await u00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return l00(Z,X)}}),$.patch("/:virtualMcpId/:branch",zA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=PA6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Xq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(xJ1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await u00(Z),W=await So$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:fc(Y)},J),K=sJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:uo$(Z)})}catch(G){return l00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(cG(W)!==409)throw W;await Lq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(cG(G)===409)return Z.json({error:"merge-conflict"},409);if(cG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return l00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(cG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return l00(Z,Y)}}),$}var wA6,xo$=500,yo$=1048576,go$=1024,jA6=8388608,zA6,PA6,ho$;var co$=D(()=>{Ka0();Jq0();h$();YK();IJ1();Yq0();tJ1();sZ();Co$();bo$();nJ1();Nq0();wA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;zA6=v5({maxSize:jA6,onError:($)=>$.json({error:"Payload too large"},413)}),PA6=uc.object({set:uc.record(uc.string(),uc.unknown()).optional(),delete:uc.array(uc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=xo$,{message:`Patch cannot touch more than ${xo$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=yo$),{message:`Each block must be at most ${yo$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=go$),{message:`Each block key must be at most ${go$} characters`}),ho$=Qq0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!EA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!fo$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!FE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=g00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var do$=($)=>{let Z=new Z1;if(Z.use("*",yf),Z.use("*",qm$),Z.route("/",OR0()),Z.route("/",Gi$()),Z.route("/",nm$()),Z.route("/",Ft$()),Z.route("/",Wt$()),Z.route("/",eR0()),Z.route("/tools",wt$()),Z.route("/",Ot$()),Z.route("/",hn$({kvStorage:$.kvStorage})),Z.route("/",yn$()),Z.route("/fs",an$({getConnection:$.getNatsConnection})),Z.route("/sandbox",ko$()),Z.route("/decofile",lo$()),Z.route("/",Xt$()),Z.route("/",$t$()),Z.route("/deco-sites",LR0()),Z.route("/hosting",xm$()),Z.route("/monitor",dm$()),Z.route("/sso",KR0()),Z.route("/",$q0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Cm$()),$.mountDevAssets)Z.route("/dev-assets",zR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ll$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Qt$()),Z.route("/mcp",Nz0()),Z.route("/mcp/self",aR0()),Z.route("/mcp",Dz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var mo$=D(()=>{h$();Im$();eT0();_m$();tY1();ym$();mm$();PR0();X00();dY1();$X1();gn$();un$();en$();Zt$();Gs();yY1();Lz0();jJ1();Yt$();Jt$();Kt$();Ut$();Dt$();PJ1();Et$();AJ1();Bz0();Vo$();co$()});function AA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var TA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},io$=()=>{let $=new Z1;return $.use("*",TA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:AA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var po$=D(()=>{h$();E$();GT0()});import{z as M1}from"zod";function OF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function vA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function fA6($,Z,Q){try{return JSON.parse($)}catch{throw new oo$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function bA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:fA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function xA6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?fJ(Q.function.parameters):fJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function yA6($){if(!$)return;return{openai:{response_format:$}}}function gA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function no$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function to$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var RA6=256,qA6,IA6,MA6,kA6,VA6,SA6,CA6,_A6,oo$,ro$,so$;var ao$=D(()=>{S4();h$();vc();wN();qA6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),IA6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),MA6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(IA6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),kA6=M1.object({type:M1.literal("text")}),VA6=M1.object({type:M1.literal("json_object")}),SA6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),CA6=M1.union([kA6,VA6,SA6]),_A6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(MA6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(qA6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:CA6.optional(),user:M1.string().optional()});oo$=class oo$ extends Error{constructor($){super($);this.name="MessageConversionError"}};ro$=new Z1;ro$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(OF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(OF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(OF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=_A6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(OF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=vA6(J.model);if(!G)return $.json(OF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>BE(j.providerId));if(!E)return $.json(OF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(OF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=bA6(J.messages),N=J.tools?xA6(J.tools):void 0,B=yA6(J.response_format),O=gA6(),L=Math.floor(Date.now()/1000);if(J.stream)return lN($,async(w)=>{let E=no$(F,U,N,J,B,$.req.raw.signal);try{let j=sD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=RA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:to$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=no$(F,U,N,J,B,$.req.raw.signal),E=await oD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:to$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(OF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(OF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(OF(X.message,"server_error"),500)}});so$=ro$});function hA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function eo$(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!OY(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||D9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(n8$(U)!==J)continue;if(!hA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var $r$=D(()=>{h$();AU()});var Qr$;var Zr$=D(()=>{Qr$={name:"decocms",version:"4.357.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function cA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??lA6}}var Yr$,lA6="https://ph.studio.decocms.com",Xr$;var Jr$=D(()=>{h$();zn();Pv();P5();E$();TY1();Zr$();Yr$=new Z1;Yr$.get("/",($)=>{let Z={version:Qr$.version,theme:wr1(),...JW().logo&&{logo:JW().logo},...XN()&&{internalUrl:Cx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:Rd$(),posthog:cA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:o00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Xr$=Yr$});function lc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function aJ1($){return(lc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Wr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(lc($))}&sz=${Z}`}function Gr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Kr$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Gr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Gr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var Qb,dA6,mA6,iA6,pA6,Hr$;var Fr$=D(()=>{Qb=c0.enum(["good","bad","neutral"]),dA6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:Qb.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),mA6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(dA6)),iA6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},pA6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:Qb.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:Qb.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:Qb.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:Qb.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(mA6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:Qb.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:Qb.optional()})).min(1)})]),Hr$=c0.object({...iA6,template:pA6})});function zq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=Hr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var eJ1=D(()=>{Fr$()});import{join as Ur$}from"path";async function tA6($){try{let Z=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(nA6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=zq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||aJ1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function eJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function oA6($,Z){let Q=lc($),Y=Z?.brand?.trim()||aJ1(Q),X=Wr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Kr$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${eJ(W)}</title>`,`<meta name="description" content="${eJ(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${eJ(W)}" />`,`<meta property="og:description" content="${eJ(K)}" />`,`<meta property="og:url" content="${eJ(G)}" />`,`<meta property="og:image" content="${eJ(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${eJ(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${eJ(W)}" />`,`<meta name="twitter:description" content="${eJ(K)}" />`,`<meta name="twitter:image" content="${eJ(H)}" />`,`<meta name="twitter:image:alt" content="${eJ(F)}" />`,`<link rel="canonical" href="${eJ(G)}" />`,`<link rel="icon" href="${eJ(X)}" sizes="any" />`].join(`
+`;await No$(Z.repo,L);let w=O[0]??`${Uq0(Y)}/${yJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of iJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await Bo$(Z,F.values(),X),{decofile:B,skipped:O}=v00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:LW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:BA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=FA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function BA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return ao0(Y,$.deps.coAuthor)}var FA6=3,rJ1;var Co$=D(()=>{rL0();Jq0();c6();G8();sZ();Nq0();rJ1=new Map});import{createHmac as _o$,randomBytes as OA6,timingSafeEqual as DA6}from"crypto";function vo$(){if(jq0)return jq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return jq0=$?Buffer.from($):OA6(32),jq0}function sJ1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+LA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=_o$("sha256",vo$()).update(Y).digest("base64url");return`${Y}.${X}`}function fo$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(_o$("sha256",vo$()).update(Y).digest("base64url"));if(X.length!==J.length||!DA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var LA6=21600000,jq0=null;var bo$=D(()=>{E$()});import{z as uc}from"zod";function EA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&wA6.test($)}function uo$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function u00($){let Z=$.get("decofileScope");return Fh($.var.studioContext,Z.organizationId,Z.githubRepo)}function l00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=cG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function lo$(){let $=new Z1;return $.use("/:virtualMcpId/:branch",ho$),$.use("/:virtualMcpId/:branch/*",ho$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Oo$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=sJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(uo$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return l00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await u00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return l00(Z,X)}}),$.patch("/:virtualMcpId/:branch",zA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=PA6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Xq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(xJ1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await u00(Z),W=await So$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:fc(Y)},J),K=sJ1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:uo$(Z)})}catch(G){return l00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(cG(W)!==409)throw W;await Lq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(cG(G)===409)return Z.json({error:"merge-conflict"},409);if(cG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return l00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await u00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(cG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return l00(Z,Y)}}),$}var wA6,xo$=500,yo$=1048576,go$=1024,jA6=8388608,zA6,PA6,ho$;var co$=D(()=>{Ka0();Jq0();h$();YK();IJ1();Yq0();tJ1();sZ();Co$();bo$();nJ1();Nq0();wA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;zA6=v5({maxSize:jA6,onError:($)=>$.json({error:"Payload too large"},413)}),PA6=uc.object({set:uc.record(uc.string(),uc.unknown()).optional(),delete:uc.array(uc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=xo$,{message:`Patch cannot touch more than ${xo$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=yo$),{message:`Each block must be at most ${yo$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=go$),{message:`Each block key must be at most ${go$} characters`}),ho$=Qq0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!EA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!fo$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!FE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=g00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var do$=($)=>{let Z=new Z1;if(Z.use("*",yf),Z.use("*",qm$),Z.route("/",OR0()),Z.route("/",Gi$()),Z.route("/",nm$()),Z.route("/",Ft$()),Z.route("/",Wt$()),Z.route("/",eR0()),Z.route("/tools",wt$()),Z.route("/",Ot$()),Z.route("/",hn$({kvStorage:$.kvStorage})),Z.route("/",yn$()),Z.route("/fs",an$({getConnection:$.getNatsConnection})),Z.route("/sandbox",ko$()),Z.route("/decofile",lo$()),Z.route("/",Xt$()),Z.route("/",$t$()),Z.route("/deco-sites",LR0()),Z.route("/hosting",xm$()),Z.route("/monitor",dm$()),Z.route("/sso",KR0()),Z.route("/",$q0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Cm$()),$.mountDevAssets)Z.route("/dev-assets",zR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ll$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Qt$()),Z.route("/mcp",Nz0()),Z.route("/mcp/self",aR0()),Z.route("/mcp",Dz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var mo$=D(()=>{h$();Im$();eT0();_m$();tY1();ym$();mm$();PR0();X00();dY1();$X1();gn$();un$();en$();Zt$();Gs();yY1();Lz0();jJ1();Yt$();Jt$();Kt$();Ut$();Dt$();PJ1();Et$();AJ1();Bz0();Vo$();co$()});function AA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var TA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},io$=()=>{let $=new Z1;return $.use("*",TA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:AA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var po$=D(()=>{h$();E$();GT0()});import{z as M1}from"zod";function OF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function vA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function fA6($,Z,Q){try{return JSON.parse($)}catch{throw new oo$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function bA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:fA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function xA6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?fJ(Q.function.parameters):fJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function yA6($){if(!$)return;return{openai:{response_format:$}}}function gA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function no$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function to$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var RA6=256,qA6,IA6,MA6,kA6,VA6,SA6,CA6,_A6,oo$,ro$,so$;var ao$=D(()=>{S4();h$();vc();wN();qA6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),IA6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),MA6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(IA6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),kA6=M1.object({type:M1.literal("text")}),VA6=M1.object({type:M1.literal("json_object")}),SA6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),CA6=M1.union([kA6,VA6,SA6]),_A6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(MA6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(qA6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:CA6.optional(),user:M1.string().optional()});oo$=class oo$ extends Error{constructor($){super($);this.name="MessageConversionError"}};ro$=new Z1;ro$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(OF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(OF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(OF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=_A6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(OF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=vA6(J.model);if(!G)return $.json(OF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>BE(j.providerId));if(!E)return $.json(OF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(OF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=bA6(J.messages),N=J.tools?xA6(J.tools):void 0,B=yA6(J.response_format),O=gA6(),L=Math.floor(Date.now()/1000);if(J.stream)return lN($,async(w)=>{let E=no$(F,U,N,J,B,$.req.raw.signal);try{let j=sD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=RA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:to$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=no$(F,U,N,J,B,$.req.raw.signal),E=await oD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:to$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(OF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(OF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(OF(X.message,"server_error"),500)}});so$=ro$});function hA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function eo$(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!OY(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||D9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(n8$(U)!==J)continue;if(!hA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var $r$=D(()=>{h$();AU()});var Qr$;var Zr$=D(()=>{Qr$={name:"decocms",version:"4.357.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function cA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??lA6}}var Yr$,lA6="https://ph.studio.decocms.com",Xr$;var Jr$=D(()=>{h$();zn();Pv();P5();E$();TY1();Zr$();Yr$=new Z1;Yr$.get("/",($)=>{let Z={version:Qr$.version,theme:wr1(),...JW().logo&&{logo:JW().logo},...XN()&&{internalUrl:Cx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:Rd$(),posthog:cA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:o00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Xr$=Yr$});function lc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function aJ1($){return(lc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function Wr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(lc($))}&sz=${Z}`}function Gr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Kr$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Gr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Gr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var Qb,dA6,mA6,iA6,pA6,Hr$;var Fr$=D(()=>{Qb=c0.enum(["good","bad","neutral"]),dA6=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:Qb.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),mA6=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(dA6)),iA6={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},pA6=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:Qb.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:Qb.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:Qb.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:Qb.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(mA6).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:Qb.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:Qb.optional()})).min(1)})]),Hr$=c0.object({...iA6,template:pA6})});function zq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=Hr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var eJ1=D(()=>{Fr$()});import{join as Ur$}from"path";async function tA6($){try{let Z=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(nA6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=zq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||aJ1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function eJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function oA6($,Z){let Q=lc($),Y=Z?.brand?.trim()||aJ1(Q),X=Wr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Kr$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${eJ(W)}</title>`,`<meta name="description" content="${eJ(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${eJ(W)}" />`,`<meta property="og:description" content="${eJ(K)}" />`,`<meta property="og:url" content="${eJ(G)}" />`,`<meta property="og:image" content="${eJ(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${eJ(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${eJ(W)}" />`,`<meta name="twitter:description" content="${eJ(K)}" />`,`<meta name="twitter:image" content="${eJ(H)}" />`,`<meta name="twitter:image:alt" content="${eJ(F)}" />`,`<link rel="canonical" href="${eJ(G)}" />`,`<link rel="icon" href="${eJ(X)}" sizes="any" />`].join(`
     `)}function rA6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Nr$($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=lc(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(Ur$($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${nK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(sA6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?Ur$($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await tA6(lc(Y)),K=oA6(Y,W);return Q.html(rA6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var nA6=2500,sA6=1e4;var Br$=D(()=>{h$();eJ1();Tj();E$()});function c00($,Z){return fetch(`${nK({})}${$}`,Z)}async function aA6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",J=await c00(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(J.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!J.ok)throw Error(`report read HTTP ${J.status}`);let G=await J.json(),{deck:W,drops:K}=zq0(G);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:G.scanned_at,drops:K}}var eA6,dN,Or$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Dr$;var Lr$=D(()=>{h$();jJ();Tj();eJ1();eA6=new Set(["complete","errored","terminated","unknown"]),dN=new Z1;dN.use("*",async($,Z)=>{let Q=await Q8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});dN.use("/link-token/*",Or$);dN.use("/suggest",Or$);dN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let J=await aA6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!J.deck)return $.json(J);return $.json({...J,deck:{...J.deck,slides:J.deck.slides.slice(0,1)},truncated:J.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});dN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,J=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let G=await c00("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Aj({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:J})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});dN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await c00(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${Aj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:eA6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});dN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await c00(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});dN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await c00(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});Dr$=dN});import{createHmac as $26,timingSafeEqual as Z26}from"crypto";function Er$($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>Q26)return!1;let W=$26("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&Z26(K,F)})}function jr$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=A3(Z),Y=A3(A3(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:DF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function zr$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function DF($){return typeof $==="string"?$:void 0}function A3($){return typeof $==="object"&&$!==null?$:void 0}function Pq0($){return typeof $==="number"?new Date($*1000):null}function QG1($){return DF($)??DF(A3($)?.id)}function Y26($){return QG1($.subscription)??DF(A3(A3($.parent)?.subscription_details)?.subscription)}function X26($){let Z=Pq0($.current_period_end);if(Z)return Z;let Q=A3($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=A3(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function $G1($,Z){let Q=Pq0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function ZG1($,Z){let Q=Pq0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function J26($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=DF(A3(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(DF(A3(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(DF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let G=DF(Q.id);if(!G)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let W=Number(A3(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:A3(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:W,referenceId:`stripe-topup:${G}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(DF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.getBilling(Y);if(!X)return{handled:!1,reason:"unknown org"};let J=QG1(Q.subscription);if(X.stripeSubscriptionId&&J&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};if($G1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y,{stripeCustomerId:QG1(Q.customer),stripeSubscriptionId:J,status:"active",lastStripeEventAt:ZG1(Z,X)}),{handled:!0,organizationId:Y}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=DF(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&$G1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":zr$(Q.status);return await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:X26(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:ZG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}case"invoice.paid":{let Y=Y26(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if($G1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:Pq0(Q.period_end),lastStripeEventAt:ZG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function G26($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:zr$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function wr$($,Z){let Q=G26($,Z);if(!Q)return;UJ({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:qa1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function Pr$($){let Z=new dK(Z8().db),Q=await J26(Z,$);if(!(Q.handled&&Q.topUp))wr$($,Q);if(Q.handled&&Q.topUp)await mT$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),wr$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await c4$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(Y){if(!(Y instanceof zJ&&(Y.status===400||Y.status===404)))throw Y}return Q}var Q26=300;var Ar$=D(()=>{fG();h4();tZ0();pj();r41()});var W26=1048576,YG1;var Tr$=D(()=>{h$();YK();E$();Ar$();YG1=new Z1;YG1.post("/webhook",v5({maxSize:W26,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=M0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!Er$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=jr$(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await Pr$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as K26}from"crypto";function U26($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return K26(Buffer.from(X),Buffer.from(Y))}function N26($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function Rr$($){let Z=new Z1;return Z.post("/webhook",v5({maxSize:H26,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!U26(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!F26.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await Ar0())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=N26(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await B26($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function B26($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await PD$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var H26=5242880,F26;var qr$=D(()=>{h$();YK();TW();IZ();F26=new Set(["check_suite","issue_comment"])});function Ir$($){let Z=new CN($.db,new YY($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=lB$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new yJ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var Mr$=D(()=>{h$();fB();ba0();Jv()});function kr$($){let Z=new CN($.db,new YY($.encryptionKey));async function Q(X,J){let G=Tx$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await SH($.db,W.organizationId);if(!K)return;if(await KT0(K,W,G)==="started")console.log(`[jira-webhook] started a run for ${G.issueKey} entering "${G.toStatus}"`)}let Y=new Z1;return Y.post("/webhook/:secret",v5({maxSize:O26}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var O26=1048576;var Vr$=D(()=>{h$();YK();fB();HT0();Ku()});import{DBOS as Aq0,SchedulerMode as D26}from"@dbos-inc/dbos-sdk";function Cr$($){JG1=$}function _r$(){if(!JG1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return JG1}function vr$(){let $=_r$();return new CN($.db,new YY($.encryptionKey))}async function E26($,Z){try{let Q=await vr$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await SH(_r$().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let J=new yJ(Q.siteUrl,Q.email,Q.apiToken),W=`(${await J.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${Sr$}m"`,K=0,H;for(let F=0;F<w26;F++){let U=await J.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=Rx$(N,N.changelog?.histories??[],Z);for(let O of B)if(await KT0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function j26($,Z){let Q=new Date($.getTime()-Sr$*60000),Y=await Aq0.runStep(()=>vr$().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((J)=>Aq0.runStep(()=>E26(J,Q),{name:`sweepJira:${J}`})));for(let J of X)if(J.error)console.warn(`[jira-trigger] integration ${J.integrationId} failed: ${J.error}`);else if(J.started>0)console.log(`[jira-trigger] integration ${J.integrationId} started ${J.started} run(s) the webhook missed`)}function fr$(){if(XG1)return;XG1=Aq0.registerWorkflow(j26,{name:"jiraTriggerSweepWorkflow"}),Aq0.registerScheduled(XG1,{name:"jiraTriggerSweepWorkflow",crontab:L26,mode:D26.ExactlyOncePerIntervalWhenActive})}var L26="7-59/10 * * * *",Sr$=15,w26=5,JG1=null,XG1=null;var br$=D(()=>{fB();Ku();Jv();HT0()});function xr$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var yr$,z26,P26,gr$;var hr$=D(()=>{h$();XW();Nu();Cj();yr$=new Z1,z26=["range","if-none-match","if-modified-since"],P26=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];yr$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Hc($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Y$(401,{message:"Authentication required"})}if(!Q)throw new Y$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new Y$(400,{message:"Missing file key"});let X=await _r(Y,Z);if(!X)throw new Y$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&$X()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Y$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return xr$(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of z26){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new Y$(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new Y$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of P26){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),xr$(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});gr$=yr$});var d00=_((Yb)=>{var A26=Yb&&Yb.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),T26=Yb&&Yb.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))A26(Z,$,Q)};Object.defineProperty(Yb,"__esModule",{value:!0});T26(oX(),Yb)});var cr$=_((ur$)=>{Object.defineProperty(ur$,"__esModule",{value:!0});ur$.version=void 0;ur$.version="3.4.0"});var ir$=_((LF)=>{var R26=LF&&LF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(LF,"__esModule",{value:!0});LF.NodeTransport=LF.VERSION=void 0;LF.nodeResolveHost=S26;var W5=d00(),q26=z0("net"),GG1=z0("tls"),I26=z0("path"),dr$=z0("fs"),M26=R26(z0("dns")),k26=cr$();LF.VERSION=k26.version;var V26="nats.js";class mr${socket;version;lang;yields=[];signal=(0,W5.deferred)();closedNotification=(0,W5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=V26,this.version=LF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,W5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw W5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new W5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new W5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,W5.deferred)(),Q,Y=(0,q26.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,W5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=W5.DataBuffer.concat(...this.yields),X=(0,W5.extractProtocolMessage)(Y);if(X!=="")try{let J=W5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,W5.deferred)();try{if($=(0,I26.resolve)($),!(0,dr$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,dr$.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,W5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,W5.deferred)();try{let X=(0,GG1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,W5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,W5.deferred)();try{let Y=(0,GG1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,W5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,W5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof GG1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,W5.render)($)}`);let Z=(0,W5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}LF.NodeTransport=mr$;function S26($){let Z=(0,W5.deferred)();return M26.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var rr$=_((or$)=>{Object.defineProperty(or$,"__esModule",{value:!0});or$.connect=C26;var pr$=ir$(),nr$=d00(),tr$=d00();function C26($={}){if((0,tr$.hasWsProtocol)($))return Promise.reject(tr$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,nr$.setTransportFactory)({factory:()=>{return new pr$.NodeTransport},dnsResolveFn:pr$.nodeResolveHost}),nr$.NatsConnectionImpl.connect($)}});var sr$=_((mN)=>{var v26=mN&&mN.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),f26=mN&&mN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))v26(Z,$,Q)};Object.defineProperty(mN,"__esModule",{value:!0});mN.connect=void 0;var b26=rr$();Object.defineProperty(mN,"connect",{enumerable:!0,get:function(){return b26.connect}});f26(d00(),mN)});function Zs$($){let Z=$?.connectFn??h26,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:g26,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(y26,x26,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?ar$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=$s$.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function h26($){return er$.connect($)}var ar$,er$,$s$,x26=100,y26=3000,g26=3000;var Qs$=D(()=>{G8();ar$=V(Nd(),1),er$=V(sr$(),1),$s$=V(IF(),1)});function WG1($,Z){return`${$}.${Z}`}class KG1{cache;constructor($){this.cache=al({ttlMs:$?.ttlMs??u26,maxSize:$?.maxSize??l26})}async get($,Z){return this.cache.get(WG1($,Z))??null}async set($,Z,Q){this.cache.set(WG1($,Z),Q)}async invalidate($,Z){this.cache.delete(WG1($,Z))}teardown(){this.cache.clear()}}var u26=600000,l26=5000;var Ys$=()=>{};function Tq0($,Z){return`${$}:${Z}`}function HG1($){let Z=al({ttlMs:$?.ttlMs??c26,maxSize:$?.maxSize??d26}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(Xs$,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(Tq0(K,H))},set(K,H,F){Z.set(Tq0(K,H),F)},invalidate(K,H){Z.delete(Tq0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(Xs$),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(Tq0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var Xs$="studio.ai-provider-keys.invalidate",c26=30000,d26=5000;var Js$=()=>{};class FG1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Gs$=($)=>{let Z;return()=>Z??=$()},UG1,NG1;var Ws$=D(()=>{X6();UG1=Gs$(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),NG1=Gs$(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function r26($=Fs$){return{name:yH,subjects:[`${J11}.>`],storage:GK.StorageType.File,max_age:p26,max_bytes:t26,max_msgs_per_subject:o26,discard:GK.DiscardPolicy.Old,retention:GK.RetentionPolicy.Limits,duplicate_window:n26,num_replicas:$}}class Us${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Ks$($){let Z=Hs$.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function $T6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,i26().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function ZT6($,Z){return $.info?.cluster?Z:1}function QT6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class BG1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=r26(X);try{await Y.streams.info(yH),await Y.streams.update(yH,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(yH,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(yH),await Y.streams.add(J);else throw G}},Q=await b8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await GK.jetstreamManager($),X=ZT6($,Fs$);try{await Z(Y,X)}catch(J){if(X<=1||!QT6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Tu});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=$T6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=_j$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=W11(H,{runId:Z}),N=performance.now()-F;UG1().record(N),NG1().add(1,{"org.id":Y??"unknown"}),e26?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?Ks$(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),a26)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await b8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Ks$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Tu}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=W11(Z,{runId:$,dedup:Q});UG1().record(performance.now()-X),NG1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Cj$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?GK.DeliverPolicy.New:GK.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=OL($),W;try{W=await b8(async()=>{return(await Y.consumers.get(yH,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Tu})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=pj0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(cj0()).pipeThrough(dj0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(yH,{filter:OL($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var GK,Hs$,m26=($)=>{let Z;return()=>Z??=$()},i26,p26=86400000000000,n26=120000000000,t26=4294967296,Fs$,o26=500000,s26,a26,e26;var Ns$=D(()=>{G8();K11();nj0();mj0();X6();Ws$();GK=V(IF(),1),Hs$=V(Nd(),1),i26=m26(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),Fs$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);s26=process.env.STREAM_ENCODE_TRACE==="1",a26=process.env.DECOPILOT_STREAM_TRACE==="1";e26=s26?new Us$:null});function Rq0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,IK(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var Bs$=D(()=>{V8()});class OG1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function YT6($,Z){let Q=$.startsWith("thread:")?RW($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function Os$($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await wH($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await Vh($,{threadId:X,runBranch:G?.branch}),K=YT6(W,await Jw0($,X)),H=await nt($,Q,rn0(J)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await aG(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var Ds$=D(()=>{sZ();pG();IZ()});async function Ls$($,Z,Q){let Y=Z.organizationId;if(!RX(Z))return!1;if(!Uv(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=XH(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await S6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),H8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var ws$=D(()=>{j4();kQ();Gu();fW();Y9()});function FT6($){return $ instanceof wY}function UT6($,Z){return Z-$>=KT6}class DG1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??XT6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??GT6,Q=this.options.itemIntervalMs??JT6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-Va0),le0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-HT6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await ge0(this.taskBoard,X,Y),await he0(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==A$.progress||G.assigneeId!==n$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await bW(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),FT6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+WT6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==A$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),H8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!UT6(MU(Q,Z.reviewCycleStartedAt),Date.now()))return;await kH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!RX(Y))return!1;let X=Y.assigneeId===n$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await Os$(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Hu(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Ls$(G,Y,W))return!0;if(await Az$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!fe0(W))return!1;return await aE0(G,Y,{previewMatchesHead:be0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await GL($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var XT6=60000,JT6=300000,GT6=50,WT6=60000,KT6=900000,HT6=120000;var Es$=D(()=>{j4();Ae0();Ds$();VH();ar();fW();ws$();Y9();lG();ce0();IZ();kr();Wu()});import{readdir as NT6,rm as qq0}from"fs/promises";import{join as Iq0}from"path";async function Mq0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-BT6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Xb($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await js$($,X,Z);else if(!X.startsWith(".")){let J=Iq0($,X),G=await Xb(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await js$(J,K,Z)}if((await Xb(J)).length===0)await qq0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function js$($,Z,Q){let Y=0,X=Iq0($,Z),J=await Xb(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Iq0(X,W),H=await Xb(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=Iq0(K,U);await qq0(B,{recursive:!0,force:!0}),Y++}}if((await Xb(K)).length===0)await qq0(K,{recursive:!0,force:!0})}if((await Xb(X)).length===0)await qq0(X,{recursive:!0,force:!0});return Y}async function Xb($){try{return(await NT6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var BT6=30;var LG1=()=>{};import{DBOS as wG1,SchedulerMode as OT6}from"@dbos-inc/dbos-sdk";async function LT6(){let $=[T3(),Jb(),jF()],Z=0;for(let Q of $)try{Z+=await Mq0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function wT6($,Z){await wG1.runStep(()=>LT6(),{name:"monitoringRetention"})}function Ps$(){if(zs$)return;zs$=!0;let $=wG1.registerWorkflow(wT6,{name:"monitoringRetentionWorkflow"});wG1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:DT6,mode:OT6.ExactlyOncePerIntervalWhenActive})}var DT6="23 4 * * *",zs$=!1;var As$=D(()=>{JG();LG1()});function Ts$($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await _7.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await xj($.db,Z,Y.role);return X.boundAuth=GY1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new DE(Q,void 0,X.boundAuth,Y.role,"self"),WL(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var Rs$=D(()=>{YU();$H()});function ET6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function jT6(){return{services:ET6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function PT6(){for(let $ of zT6)$()}function qs$($){let Z=[...EG1.logs,$];EG1={...EG1,logs:Z.length>500?Z.slice(-500):Z},PT6()}function jG1(){return AT6}var EG1,zT6,AT6=!1;var zG1=D(()=>{EG1=jT6(),zT6=new Set});import{EventEmitter as TT6}from"events";var PG1;var Is$=D(()=>{zG1();PG1=new TT6;PG1.on("request",($)=>{qs$($)})});function Ms$(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=cc(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((E)=>cc(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${w5.tool}${B}${w5.dim}(${w})${w5.reset}`}else if(N.method)J=`${w5.dim}${cc(N.method)}${w5.reset}`}}catch{}}let W=cc(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${w5.mcp}${cc(F.slice(0,12))}\u2026${w5.reset}`}else if(X==="/mcp")W=`${w5.mcp}/mcp${w5.reset}`;else if(X==="/mcp/registry")W=`${w5.mcp}/mcp/registry${w5.reset}`;let K=qT6(Y),H=G?"\u25C0":"\u2190";if(!jG1())console.log(`${w5.dim}${H}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=RT6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!jG1())console.log(`${w5.dim}${O}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""} ${N}${U}${w5.reset} ${w5.duration}${B}${w5.reset}`);PG1.emit("request",{method:Y,path:cc(X),status:U,duration:F,timestamp:new Date})}}}var w5,RT6=($)=>{if($>=500)return w5.serverError;if($>=400)return w5.clientError;if($>=300)return w5.redirect;return w5.ok},qT6=($)=>{return w5[$]||w5.reset},cc=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var ks$=D(()=>{zG1();Is$();w5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as _s$}from"crypto";import{mkdir as IT6,readdir as MT6,rm as Vs$,stat as vs$}from"fs/promises";import{join as TG1,relative as kT6}from"path";import{z as k$}from"zod";function bs$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return TG1(VT6,Z)}function xs$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function AG1($,Z){let Q=bs$($),Y=xs$(Z);return TG1(Q,Y)}function ST6($,Z,Q,Y){let X=M0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return _s$("sha256",X).update(J).digest("hex")}function Cs$($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=ST6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${xs$(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function ys$($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${_s$("md5","etag").update(Y).digest("hex")}"`}async function gs$($,Z,Q,Y,X){try{let J=await MT6($,{withFileTypes:!0});for(let G of J){let W=TG1($,G.name),H=kT6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await gs$(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await vs$(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:ys$(W,F.mtime,F.size)})}catch{}}}}catch{}}function hs$($,Z){let Y=p($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:k$.object({prefix:k$.string().optional(),maxKeys:k$.number().optional().default(1000),continuationToken:k$.string().optional(),delimiter:k$.string().optional()}),outputSchema:k$.object({objects:k$.array(k$.object({key:k$.string(),size:k$.number(),lastModified:k$.string(),etag:k$.string()})),nextContinuationToken:k$.string().optional(),isTruncated:k$.boolean(),commonPrefixes:k$.array(k$.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=bs$(Y);await IT6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await gs$(F,F,G,K,U),U.objects.sort((w,E)=>w.key.localeCompare(E.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({contentType:k$.string().optional(),contentLength:k$.number(),lastModified:k$.string(),etag:k$.string(),metadata:k$.record(k$.string(),k$.string()).optional()}),handler:async(X)=>{let J=X,G=AG1(Y,J.key),W=await vs$(G);return{contentType:aY1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:ys$(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??Ss$;return{url:Cs$(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional(),contentType:k$.string().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??Ss$;return{url:Cs$(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({success:k$.boolean(),key:k$.string()}),handler:async(X)=>{let J=X,G=AG1(Y,J.key);try{return await Vs$(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:k$.object({keys:k$.array(k$.string()).max(1000)}),outputSchema:k$.object({deleted:k$.array(k$.string()),errors:k$.array(k$.object({key:k$.string(),message:k$.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=AG1(Y,K);try{await Vs$(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function RG1($,Z,Q){let Y=hs$(Z,Q),X=new fK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:T5});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:k$.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:k$.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new MY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),G3(X,J,$,"mcp:dev-assets")}async function us$($,Z,Q,Y){let J=hs$(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var VT6="./data/assets",Ss$=3600,fs$,ls$;var cs$=D(()=>{E$();ku();h$();yi();hv();KQ();PR0();fs$=new Z1;fs$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return RG1($.req.raw,Z,Y)});ls$=fs$});var ds$={};T4(ds$,{mountDevRoutes:()=>CT6});function CT6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return RG1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await us$(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ls$);let Q=new Z1;Q.use("*",XK({mountPath:"/api/dev-assets"})),Q.route("/",zR0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var ms$=D(()=>{h$();mY1();PR0();cs$()});import{sql as _T6}from"kysely";import{randomUUID as is$}from"crypto";import{z as vT6}from"zod";async function bT6($){let Z=new Date().toISOString(),Q=is$(),Y=h8.SELF($.organizationId),X="registry.publish_request.created",J={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(J),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let G=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(G.length>0)await $.db.insertInto("event_deliveries").values(G.map((W)=>({id:is$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await _T6`SELECT
       pg_notify('studio_events', ${Q}),