decocms 4.358.6 → 4.358.7

package/dist/server/server.js

@@ -2725,7 +2725,7 @@ ${X}`,$.data)}function pT0($){let Z=$;if(!Z||Z.isError!==!0||!Array.isArray(Z.co
 ${Z}`}:Y)}}var Ec$=D(()=>{O9()});async function cW6($,Z,Q){if(!$)return!1;let Y=await $.get("tools",Z).catch(()=>null);if(!Y)return!1;for(let X of Y)if(typeof X==="object"&&X!==null&&X.name===Q)return X.annotations?.readOnlyHint===!0;return!1}function cQ1(){return{kind:"org"}}function sO($,Z,Q,Y){let X=new r9({name:`lazy-${$.id}`,version:"1.0.0"},{capabilities:{},jsonSchemaValidator:T5}),J=$.metadata?.isDevConnection===!0,G=null,W=!1;function K(){if(W)return Promise.reject(Error(`MCP client for connection ${$.id} is closed`));if(!G){Z70($.id);let L=M7($,Z,Q).then((w)=>{Q70($.id);let E=w.onclose;return w.onclose=()=>{if(G===L)G=null;E?.()},w}).catch((w)=>{throw G=null,Y70($.id),w});G=L}return G}let H=(L,w)=>L!==void 0||w!==void 0,F=(L,w,E,j)=>{return async(z,P)=>{if($.connection_type==="VIRTUAL"||J||!Y||H(z,P)){let q=await K();return w(q,z,P)}let A=await rO(L,$.id,async()=>{let q=await K(),k=await w(q);return E(k)},Y,(q)=>Z.pendingRevalidations.push(q),oO);return j(A??[])}};X.listTools=F("tools",(L,w,E)=>L.listTools(w,E),(L)=>L.tools,(L)=>({tools:L})),X.listResources=F("resources",(L,w,E)=>L.listResources(w,E),(L)=>L.resources,(L)=>({resources:L})),X.listPrompts=F("prompts",(L,w,E)=>L.listPrompts(w,E),(L)=>L.prompts,(L)=>({prompts:L}));let U=bQ0(),N=$.connection_type!=="VIRTUAL"&&!J,B=async(L,w,E)=>{let j=L?.name,z=U&&N&&typeof j==="string"&&await cW6(Y,$.id,j);if(U&&z&&!w)return await U.fetch({type:"tools/call",connectionId:$.id,scope:cQ1(),params:{name:j,arguments:L?.arguments},fetchLive:async()=>{return(await K()).callTool(L,w,E)},shouldCache:(q)=>q?.isError!==!0,onRevalidation:(q)=>Z.pendingRevalidations.push(q)});let P=await K();if(U&&N&&!z)try{return await P.callTool(L,w,E)}finally{og($.id)}return P.callTool(L,w,E)};X.callTool=async(L,w,E)=>{let j=L?.name,z=typeof j==="string"?j:null,P=L?.arguments,A=async()=>{return(await Y.get("tools",$.id).catch(()=>null))?.find((f)=>typeof f==="object"&&f!==null&&f.name===z)?.inputSchema},q=async(m)=>{let f=Dc$(m,P);if(!f)return null;return await B({...L,arguments:f},w,E).catch(()=>null)},k;try{k=await B(L,w,E)}catch(m){if(!z||!Y||!(m instanceof w1)||m.code!==q1.InvalidParams)throw m;let f=await A(),b=await q(f);if(b&&!pT0(b))return b;throw Lc$(m,z,f,P)}if(!z||!Y||!pT0(k))return k;let M=await A(),C=await q(M);if(C&&!pT0(C))return C;return wc$(k,lQ1(z,M,P))},X.getPrompt=async(L,w)=>{if(!U||!N)return(await K()).getPrompt(L,w);return await U.fetch({type:"prompts/get",connectionId:$.id,scope:cQ1(),params:L,fetchLive:async()=>{return(await K()).getPrompt(L,w)},onRevalidation:(j)=>Z.pendingRevalidations.push(j)})},X.readResource=async(L,w)=>{if(!U||!N){if(process.env?.MCP_CACHE_DEBUG)console.log("[mcp-read-cache] BYPASS (VIRTUAL)",$.id,"resources/read");return(await K()).readResource(L,w)}return await U.fetch({type:"resources/read",connectionId:$.id,scope:cQ1(),params:L,fetchLive:async()=>{return(await K()).readResource(L,w)},onRevalidation:(j)=>Z.pendingRevalidations.push(j)})},X.listResourceTemplates=async(L,w)=>{return(await K()).listResourceTemplates(L,w)};let O=X.close.bind(X);return X.close=async()=>{if(W=!0,G){let L=await G.catch(()=>null);if(L)await L.close().catch(()=>{})}await O()},X}var Zt=D(()=>{fK();HQ();O9();vd0();$t();Lt();eY();Ot();Ec$()});function v$1($){return{client:{callTool:$.callTool.bind($),listTools:$.listTools.bind($)}}}async function dW6($,Z,{superUser:Q}){if(!Q&&!Z.organization?.id)throw Error("Organization context is required");let Y=typeof $==="string"?await Z.storage.connections.findById($,Z.organization?.id):$;if(!Y)throw Error("Connection not found");if(Z.organization&&Y.organization_id!==Z.organization.id)throw Error("Connection does not belong to the active organization");if(!Z.organization){let H=await Z.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",Y.organization_id).executeTakeFirst();Z.organization=H?{id:H.id,slug:H.slug,name:H.name}:{id:Y.organization_id}}if(Y.status!=="active")throw Error(`Connection inactive: ${Y.status}`);let X=sO(Y,Z,Q,L9()??void 0),J=ME(X,{name:"mcp-cms-proxy-client",version:"1.0.0"},{capabilities:{tools:{},resources:{},prompts:{}},toolCallTimeoutMs:zy}),{client:G,server:W}=hu0();await J.connect(W);let K=new r9({name:"mcp-cms-proxy-client",version:"1.0.0"},{jsonSchemaValidator:T5});return await K.connect(G),K}async function jc$($,Z){return dW6($,Z,{superUser:!1})}var f$1=D(()=>{Zt();eY();HQ();fK()});function dQ1($,Z){for(let[Q,Y]of Object.entries(Z)){let X=$[Q];if(!X||X.length===0){let G=$["*"];if(!G||G.length===0)return!1;if(G.includes("*"))continue;let W=new Set(G);for(let K of Y)if(!W.has(K))return!1;continue}if(X.includes("*"))continue;let J=new Set(X);for(let G of Y)if(!J.has(G))return!1}return!0}import{sql as mQ1}from"kysely";function nT0($){if($==null)return null;return typeof $==="string"?$:$.toISOString()}function tT0($){return`msg_async_stub_${$}`}async function iQ1($,Z){await $.deleteFrom("thread_messages").where("id","=",tT0(Z)).execute(),await $.deleteFrom("thread_message_parts").where("message_id","=",tT0(Z)).execute()}function mW6($){if($==null)return null;if(typeof $!=="string")return $;try{return JSON.parse($)}catch{return null}}function pQ1($){return{id:$.id,interactionId:$.interaction_id??null,toolCallId:$.tool_call_id,organizationId:$.organization_id,threadId:$.thread_id,messageId:$.message_id??null,provider:$.provider,modelId:$.model_id,query:$.query,status:$.status,attempts:$.attempts??0,lastPolledAt:nT0($.last_polled_at),lastError:$.last_error??null,inputTokens:$.input_tokens??null,outputTokens:$.output_tokens??null,citations:mW6($.citations),resultUri:$.result_uri??null,resultPreview:$.result_preview??null,resultContent:$.result_content??null,createdAt:nT0($.created_at)??"",updatedAt:nT0($.updated_at)??"",completedAt:nT0($.completed_at)}}class nQ1{inner;organizationId;constructor($,Z){this.inner=$;this.organizationId=Z}requireOrg(){if(!this.organizationId)throw Error("OrgScopedAsyncResearchJobStorage: requires an authenticated organization");return this.organizationId}setOrganizationId($){this.organizationId=$}upsertPending($){return this.inner.upsertPending({organizationId:this.requireOrg(),...$})}findByToolCall($){return this.inner.findByToolCall(this.requireOrg(),$)}markPolling($,Z,Q){return this.inner.markPolling(this.requireOrg(),$,Z,Q)}recordPoll($,Z){return this.inner.recordPoll(this.requireOrg(),$,Z)}markCompleted($,Z){return this.inner.markCompleted(this.requireOrg(),$,Z)}markFailed($,Z){return this.inner.markFailed(this.requireOrg(),$,Z)}markCancelled($,Z){return this.inner.markCancelled(this.requireOrg(),$,Z)}}class re{db;constructor($){this.db=$}async upsertPending($){let Z=new Date().toISOString(),Q=await this.db.insertInto("async_research_jobs").values({organization_id:$.organizationId,thread_id:$.threadId,tool_call_id:$.toolCallId,message_id:$.messageId??null,provider:$.provider,model_id:$.modelId,query:$.query,status:"pending",attempts:0,updated_at:Z}).onConflict((X)=>X.columns(["organization_id","tool_call_id"]).doNothing()).returningAll().executeTakeFirst();if(Q)return pQ1(Q);let Y=await this.db.selectFrom("async_research_jobs").selectAll().where("organization_id","=",$.organizationId).where("tool_call_id","=",$.toolCallId).executeTakeFirstOrThrow();return pQ1(Y)}async findByToolCall($,Z){let Q=await this.db.selectFrom("async_research_jobs").selectAll().where("organization_id","=",$).where("tool_call_id","=",Z).executeTakeFirst();return Q?pQ1(Q):null}async markPolling($,Z,Q,Y){let X=new Date().toISOString();await this.db.transaction().execute(async(J)=>{if(await J.updateTable("async_research_jobs").set({status:"polling",interaction_id:Q,last_polled_at:X,updated_at:X}).where("organization_id","=",$).where("tool_call_id","=",Z).execute(),(await J.selectFrom("threads").select("message_storage_version").where("id","=",Y.threadId).where("organization_id","=",$).executeTakeFirst())?.message_storage_version!==2)return;let W=tT0(Z);await J.insertInto("thread_message_parts").values([{id:`${Y.threadId}:${W}:0`,seq:0,org_id:$,thread_id:Y.threadId,run_id:Y.threadId,message_id:W,role:"assistant",kind:"tool_call",payload:JSON.stringify({type:`tool-${Y.toolName}`,toolCallId:Z,state:"input-available",input:{query:Y.query}}),payload_ref:null,metadata:null,created_at:X},{id:`${Y.threadId}:${W}:finish`,seq:1,org_id:$,thread_id:Y.threadId,run_id:Y.threadId,message_id:W,role:"assistant",kind:"finish",payload:JSON.stringify({}),payload_ref:null,metadata:null,created_at:X}]).onConflict((K)=>K.column("id").doNothing()).execute()})}async recordPoll($,Z,Q){let Y=new Date().toISOString();await this.db.updateTable("async_research_jobs").set({attempts:mQ1`attempts + 1`,last_polled_at:Y,...Q!==void 0?{last_error:Q}:{},updated_at:Y}).where("organization_id","=",$).where("tool_call_id","=",Z).execute()}async markCompleted($,Z,Q){let Y=new Date().toISOString();await this.db.transaction().execute(async(X)=>{await X.updateTable("async_research_jobs").set({status:"completed",input_tokens:Q.inputTokens,output_tokens:Q.outputTokens,citations:JSON.stringify(Q.citations),result_uri:Q.resultUri,result_preview:Q.resultPreview,result_content:Q.resultContent,completed_at:Y,updated_at:Y}).where("organization_id","=",$).where("tool_call_id","=",Z).execute(),await iQ1(X,Z)})}async markFailed($,Z,Q){let Y=new Date().toISOString();await this.db.transaction().execute(async(X)=>{await X.updateTable("async_research_jobs").set({status:"failed",last_error:Q,completed_at:Y,updated_at:Y}).where("organization_id","=",$).where("tool_call_id","=",Z).execute(),await iQ1(X,Z)})}async markCancelled($,Z,Q){let Y=new Date().toISOString();await this.db.transaction().execute(async(X)=>{await X.updateTable("async_research_jobs").set({status:"cancelled",last_error:Q??null,completed_at:Y,updated_at:Y}).where("organization_id","=",$).where("tool_call_id","=",Z).execute(),await iQ1(X,Z)})}async sweepAbandoned($){let Z=new Date(Date.now()-$).toISOString(),Q=new Date().toISOString();return await this.db.transaction().execute(async(Y)=>{let X=await Y.updateTable("async_research_jobs").set({status:"abandoned",completed_at:Q,updated_at:Q,last_error:mQ1`COALESCE(last_error, '') || ' [abandoned by sweeper]'`}).where("status","in",["pending","polling"]).where(mQ1`COALESCE(last_polled_at, created_at) < ${Z}::timestamptz`).returning(["tool_call_id"]).execute();if(X.length===0)return 0;let J=X.map((G)=>tT0(G.tool_call_id));return await Y.deleteFrom("thread_messages").where("id","in",J).execute(),await Y.deleteFrom("thread_message_parts").where("message_id","in",J).execute(),X.length})}}var tQ1=()=>{};class oQ1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("subsidized_gateway_keys").select("encrypted_key").where("organization_id","=",$).executeTakeFirst();if(!Z)return null;return await this.vault.decrypt(Z.encrypted_key)}async put($,Z){let Q=await this.vault.encrypt(Z);await this.db.insertInto("subsidized_gateway_keys").values({organization_id:$,encrypted_key:Q}).onConflict((Y)=>Y.column("organization_id").doUpdateSet({encrypted_key:Q})).execute()}}import{sql as iW6}from"kysely";function zc$($){return $ instanceof Date?$.toISOString():String($)}class rQ1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,name:$.name,description:$.description,bucket:$.bucket,region:$.region,endpoint:$.endpoint,forcePathStyle:$.force_path_style,prefix:$.prefix,publicUrlBase:$.public_url_base,credentialType:$.credential_type??"static",refreshUrl:$.refresh_url,siteSlug:$.site_slug,createdBy:$.created_by,createdAt:zc$($.created_at),updatedBy:$.updated_by,updatedAt:zc$($.updated_at)}}async create($){let Z=k8("fcfg"),Q=await this.vault.encrypt(JSON.stringify($.credentials)),Y=new Date,X=await this.db.insertInto("org_file_configs").values({id:Z,organization_id:$.organizationId,name:$.name,description:$.description??null,bucket:$.bucket,region:$.region,endpoint:$.endpoint??null,force_path_style:$.forcePathStyle??!1,prefix:$.prefix??null,public_url_base:$.publicUrlBase??null,credential_type:$.credentials.type,refresh_url:$.refreshUrl??null,site_slug:$.siteSlug??null,encrypted_credentials:Q,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(oT0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){if(!await this.db.selectFrom("org_file_configs").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id"]).executeTakeFirst())throw new Hc($.id);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.name!==void 0)Q.name=$.name;if($.description!==void 0)Q.description=$.description;if($.bucket!==void 0)Q.bucket=$.bucket;if($.region!==void 0)Q.region=$.region;if($.endpoint!==void 0)Q.endpoint=$.endpoint;if($.forcePathStyle!==void 0)Q.force_path_style=$.forcePathStyle;if($.prefix!==void 0)Q.prefix=$.prefix;if($.publicUrlBase!==void 0)Q.public_url_base=$.publicUrlBase;if($.refreshUrl!==void 0)Q.refresh_url=$.refreshUrl;if($.siteSlug!==void 0)Q.site_slug=$.siteSlug;if($.credentials!==void 0)Q.credential_type=$.credentials.type,Q.encrypted_credentials=await this.vault.encrypt(JSON.stringify($.credentials));let Y=await this.db.updateTable("org_file_configs").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(oT0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z){if(!await this.db.selectFrom("org_file_configs").where("id","=",$).where("organization_id","=",Z).select(["id"]).executeTakeFirst())throw new Hc($);await this.db.deleteFrom("org_file_configs").where("id","=",$).where("organization_id","=",Z).execute()}async list($){return(await this.db.selectFrom("org_file_configs").where("organization_id","=",$).select(oT0).orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z){let Q=await this.db.selectFrom("org_file_configs").where("id","=",$).where("organization_id","=",Z).select(oT0).executeTakeFirst();if(!Q)throw new Hc($);return this.rowToInfo(Q)}async resolveById($,Z){let Q=await this.db.selectFrom("org_file_configs").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new Hc($);return{info:this.rowToInfo(Q),credentials:await this.decodeCredentials(Q)}}async resolveByName($){let Z=await this.db.selectFrom("org_file_configs").where("organization_id","=",$.organizationId).where(iW6`lower(name) = lower(${$.name})`).selectAll().executeTakeFirst();if(!Z)throw new Hc($.name);return{info:this.rowToInfo(Z),credentials:await this.decodeCredentials(Z)}}async decodeCredentials($){if($.credential_type==="managed")return{type:"managed"};let Z=await this.vault.decrypt($.encrypted_credentials),Q=JSON.parse(Z);if(($.credential_type??"static")==="sts-session")return{type:"sts-session",apiKey:String(Q.apiKey)};return{type:"static",accessKeyId:String(Q.accessKeyId),secretAccessKey:String(Q.secretAccessKey)}}}var oT0,Hc;var Pc$=D(()=>{FQ();oT0=["id","organization_id","name","description","bucket","region","endpoint","force_path_style","prefix","public_url_base","credential_type","refresh_url","site_slug","created_by","created_at","updated_by","updated_at"];Hc=class Hc extends Error{constructor($){super(`File config ${$} not found`);this.name="OrgFileConfigNotFoundError"}}});function Ac$($){return $ instanceof Date?$.toISOString():String($)}function se($){return{slug:$.slug,organizationId:$.organization_id,source:$.source,createdBy:$.created_by,createdAt:Ac$($.created_at),updatedBy:$.updated_by,updatedAt:Ac$($.updated_at)}}class gf{db;constructor($){this.db=$}async claimSite($){if(!V7($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"deco-import",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((J)=>J.column("slug").doNothing()).returningAll().executeTakeFirst();if(Q)return se(Q);let Y=await this.getBySlug($.slug);if(!Y)throw new ae($.slug,"unknown");if(Y.organizationId!==$.organizationId)throw new ae($.slug,Y.organizationId);let X=await this.db.updateTable("org_sites").set({source:$.source??Y.source,updated_by:$.by,updated_at:Z}).where("slug","=",$.slug).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return se(X)}async reassignSite($){if(!V7($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"manual",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((Y)=>Y.column("slug").doUpdateSet({organization_id:$.organizationId,source:$.source??"manual",updated_by:$.by,updated_at:Z})).returningAll().executeTakeFirstOrThrow();return se(Q)}async releaseSite($,Z){let Q=await this.db.deleteFrom("org_sites").where("slug","=",$).where("organization_id","=",Z).executeTakeFirst();return Number(Q.numDeletedRows??0n)>0}async getBySlug($){let Z=await this.db.selectFrom("org_sites").selectAll().where("slug","=",$).executeTakeFirst();return Z?se(Z):null}async listByOrg($){return(await this.db.selectFrom("org_sites").selectAll().where("organization_id","=",$).orderBy("slug","asc").execute()).map((Q)=>se(Q))}async isOwnedBy($,Z){return!!await this.db.selectFrom("org_sites").select("slug").where("slug","=",$).where("organization_id","=",Z).executeTakeFirst()}}var ae;var sQ1=D(()=>{QH();ae=class ae extends Error{slug;ownerOrganizationId;constructor($,Z){super(`Site slug "${$}" is already owned by another organization`);this.slug=$;this.ownerOrganizationId=Z;this.name="OrgSiteConflictError"}}});function aQ1($){return $?`${$.id}:${$.updatedAt}`:null}class eQ1{db;constructor($){this.db=$}async create($,Z){return await this.db.deleteFrom("github_connect_flows").where("expires_at","<=",new Date).execute(),this.db.transaction().execute(async(Q)=>{await Q.selectFrom("organization").select("id").where("id","=",$.organizationId).forUpdate().executeTakeFirstOrThrow(),await Q.deleteFrom("github_connect_flows").where("organization_id","=",$.organizationId).where("user_id","=",$.userId).execute();let Y=crypto.randomUUID();return await Q.insertInto("github_connect_flows").values({id:Y,organization_id:$.organizationId,user_id:$.userId,encrypted_access_token:Z,expires_at:new Date(Date.now()+600000)}).execute(),Y})}async get($,Z){return this.db.selectFrom("github_connect_flows").selectAll().where("id","=",$).where("organization_id","=",Z.organizationId).where("user_id","=",Z.userId).where("expires_at",">",new Date).executeTakeFirst()}async refresh($,Z,Q){return(await this.db.updateTable("github_connect_flows").set({encrypted_access_token:Q}).where("id","=",$).where("organization_id","=",Z.organizationId).where("user_id","=",Z.userId).where("expires_at",">",new Date).executeTakeFirst()).numUpdatedRows>0n}async cancel($,Z){await this.db.deleteFrom("github_connect_flows").where("id","=",$).where("organization_id","=",Z.organizationId).where("user_id","=",Z.userId).execute()}async connect($,Z,Q,Y){return this.db.transaction().execute(async(X)=>{if(await X.selectFrom("organization").select("id").where("id","=",Z.organizationId).forUpdate().executeTakeFirstOrThrow(),!await X.deleteFrom("github_connect_flows").where("id","=",$).where("organization_id","=",Z.organizationId).where("user_id","=",Z.userId).where("expires_at",">",new Date).returning("id").executeTakeFirst())return null;let G=new DD(X),W=await G.findByExternalId({organizationId:Z.organizationId,host:Q.host,externalAccountId:Q.externalAccountId});if(aQ1(W)!==Y)throw new rT0("GitHub repository access changed. Review the selection again.");return G.upsert({...Q,organizationId:Z.organizationId,createdBy:Z.userId})})}}var rT0;var $Y1=D(()=>{XY0();rT0=class rT0 extends Error{}});class ZY1{db;constructor($){this.db=$}async create($){await this.deleteExpired($.organizationId);let Z=crypto.randomUUID();return await this.db.insertInto("git_provider_oauth_states").values({id:Z,organization_id:$.organizationId,user_id:$.userId,provider:$.provider,host:$.host,return_to:$.returnTo,expires_at:new Date(Date.now()+600000)}).execute(),Z}async consume($){let Z=await this.db.deleteFrom("git_provider_oauth_states").where("id","=",$).returningAll().executeTakeFirst();if(!Z)return null;if((Z.expires_at instanceof Date?Z.expires_at:new Date(Z.expires_at))<new Date)return null;return{organizationId:Z.organization_id,userId:Z.user_id,provider:Z.provider,host:Z.host,returnTo:Z.return_to}}async deleteExpired($){await this.db.deleteFrom("git_provider_oauth_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}}function Tc$($){return $ instanceof Date?$.toISOString():String($)}class _N{db;vault;constructor($,Z){this.db=$;this.vault=Z}async toEntity($){return{id:$.id,organizationId:$.organization_id,siteUrl:$.site_url,email:$.email,apiToken:await this.vault.decrypt($.api_token),boardId:$.board_id,boardName:$.board_name,webhookSecret:$.webhook_secret,enabled:$.enabled,createdBy:$.created_by,createdAt:Tc$($.created_at),updatedAt:Tc$($.updated_at)}}async getByOrg($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("organization_id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async upsert($){let Z=await this.vault.encrypt($.apiToken),Q=await this.db.insertInto("org_jira_integrations").values({organization_id:$.organizationId,site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,enabled:$.enabled,created_by:$.createdBy}).onConflict((Y)=>Y.column("organization_id").doUpdateSet({site_url:$.siteUrl,email:$.email,api_token:Z,board_id:$.boardId,board_name:$.boardName,enabled:$.enabled,updated_at:new Date})).returningAll().executeTakeFirstOrThrow();return this.toEntity(Q)}async getByWebhookSecret($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("webhook_secret","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async delete($){return(await this.db.deleteFrom("org_jira_integrations").where("organization_id","=",$).executeTakeFirst()).numDeletedRows>0n}async getById($){let Z=await this.db.selectFrom("org_jira_integrations").selectAll().where("id","=",$).executeTakeFirst();return Z?this.toEntity(Z):null}async listEnabledIds(){return(await this.db.selectFrom("org_jira_integrations").select("id").where("enabled","=",!0).orderBy("created_at","asc").execute()).map((Z)=>Z.id)}async getLinkByIssueId($,Z){let Q=await this.db.selectFrom("task_board_item_jira_links").select(["item_id","jira_issue_id","jira_issue_key"]).where("organization_id","=",$).where("jira_issue_id","=",Z).executeTakeFirst();return Q?Rc$(Q):null}async getLinkByItemId($,Z){let Q=await this.db.selectFrom("task_board_item_jira_links").select(["item_id","jira_issue_id","jira_issue_key"]).where("item_id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?Rc$(Q):null}async createLink($){await this.db.insertInto("task_board_item_jira_links").values({item_id:$.itemId,organization_id:$.organizationId,jira_issue_id:$.jiraIssueId,jira_issue_key:$.jiraIssueKey}).onConflict((Z)=>Z.doNothing()).execute()}async claimTrigger($,Z,Q){return((await this.db.insertInto("jira_trigger_claims").values({organization_id:$,jira_issue_id:Z,changelog_id:Q}).onConflict((X)=>X.doNothing()).executeTakeFirst()).numInsertedOrUpdatedRows??0n)>0n}async listAutomations($){return(await this.db.selectFrom("org_jira_column_automations").select(["jira_status","prompt"]).where("organization_id","=",$).orderBy("jira_status","asc").execute()).map((Q)=>({jiraStatus:Q.jira_status,prompt:Q.prompt}))}async getAutomation($,Z){let Q=await this.db.selectFrom("org_jira_column_automations").select(["jira_status","prompt"]).where("organization_id","=",$).where("jira_status","=",Z).executeTakeFirst();return Q?{jiraStatus:Q.jira_status,prompt:Q.prompt}:null}async upsertAutomation($,Z,Q){return await this.db.insertInto("org_jira_column_automations").values({organization_id:$,jira_status:Z,prompt:Q}).onConflict((Y)=>Y.columns(["organization_id","jira_status"]).doUpdateSet({prompt:Q,updated_at:new Date})).execute(),{jiraStatus:Z,prompt:Q}}async removeAutomation($,Z){return((await this.db.deleteFrom("org_jira_column_automations").where("organization_id","=",$).where("jira_status","=",Z).executeTakeFirst()).numDeletedRows??0n)>0n}}function Rc$($){return{itemId:$.item_id,jiraIssueId:$.jira_issue_id,jiraIssueKey:$.jira_issue_key}}class QY1{db;constructor($){this.db=$}async listByOrg($){return(await this.db.selectFrom("task_board_column_automations").select(["column_key","prompt"]).where("organization_id","=",$).orderBy("column_key","asc").execute()).map((Q)=>({columnKey:Q.column_key,prompt:Q.prompt}))}async get($,Z){let Q=await this.db.selectFrom("task_board_column_automations").select(["column_key","prompt"]).where("organization_id","=",$).where("column_key","=",Z).executeTakeFirst();if(!Q)return null;let Y=Q;return{columnKey:Y.column_key,prompt:Y.prompt}}async upsert($,Z,Q){return await this.db.insertInto("task_board_column_automations").values({id:`tbca_${$}_${Z}`,organization_id:$,column_key:Z,prompt:Q}).onConflict((Y)=>Y.columns(["organization_id","column_key"]).doUpdateSet({prompt:Q,updated_at:new Date})).execute(),{columnKey:Z,prompt:Q}}async remove($,Z){return((await this.db.deleteFrom("task_board_column_automations").where("organization_id","=",$).where("column_key","=",Z).executeTakeFirst()).numDeletedRows??0n)>0n}}class YY1{db;constructor($){this.db=$}async listByOrg($){return(await this.db.selectFrom("task_board_prompts").select(["column_key","prompt"]).where("organization_id","=",$).orderBy("column_key","asc").execute()).map((Q)=>({columnKey:Q.column_key,prompt:Q.prompt})).sort((Q,Y)=>Q.columnKey===null?-1:Y.columnKey===null?1:0)}async promptFor($,Z){let Y=(await this.listByOrg($)).filter((X)=>X.columnKey===null||X.columnKey===Z).map((X)=>X.prompt.trim()).filter(Boolean);return Y.length>0?Y.join(`
 
 `):void 0}async upsert($,Z,Q){return await this.db.insertInto("task_board_prompts").values({id:qc$($,Z),organization_id:$,column_key:Z,prompt:Q}).onConflict((Y)=>Y.column("id").doUpdateSet({prompt:Q,updated_at:new Date})).execute(),{columnKey:Z,prompt:Q}}async remove($,Z){return((await this.db.deleteFrom("task_board_prompts").where("id","=",qc$($,Z)).where("organization_id","=",$).executeTakeFirst()).numDeletedRows??0n)>0n}}var qc$=($,Z)=>`tbp_${$}_${Z??""}`;function XY1($){let Z=new Set;for(let Q of $.matchAll(pW6))if(Z.add(Q[2]),Z.size>=50)break;return[...Z]}var pW6;var Ic$=D(()=>{pW6=/\[@([^\]]+)\]\(mention:([^)\s]+)\)/g});async function Mc$($){let{db:Z,organizationId:Q,actorId:Y}=$;try{let X=new Set(XY1($.previousBody??"")),G=XY1($.body).filter((H)=>!X.has(H)).filter((H)=>H!==Y);if(G.length===0)return;let K=(await Z.selectFrom("member").select("userId").where("organizationId","=",Q).where("userId","in",G).execute()).map((H)=>H.userId);if(K.length===0)return;await Wu({db:Z,taskBoardItemId:$.taskBoardItemId,type:"mentioned",actorId:Y,alsoSubscribe:K,recipients:K})}catch(X){console.error("[notifications] mention fan-out failed",X)}}var kc$=D(()=>{Ic$();iE0()});import{sql as nW6}from"kysely";class JY1{db;constructor($){this.db=$}async listUnread($,Z,Q={}){let Y=Math.min(Q.limit??tW6,oW6),X=Q.cursor?await this.anchorExists(Q.cursor):!1,J=this.db.selectFrom("notifications").select(["id","task_board_item_id","type","data","created_at"]).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).orderBy("created_at","desc").orderBy("id","desc").limit(Y+1);if(X)J=J.where(nW6`(created_at, id) <
-          (SELECT created_at, id FROM notifications WHERE id = ${Q.cursor})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Gu.parse(F.data),createdAt:rW6(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:k8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await Wu({...$,db:this.db})}async notifyMentions($){await Mc$({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var tW6=20,oW6=50,rW6=($)=>$ instanceof Date?$.toISOString():$;var Vc$=D(()=>{FQ();mE0();iE0();kc$()});class GY1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class WY1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function sW6($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function aW6($){let Z=$.supported_parameters.includes("tools"),Q=$.supported_parameters.includes("reasoning");return{providerId:"openrouter",modelId:sW6($.id),title:$.name,description:$.description||null,logo:null,capabilities:[...new Set([...$.architecture.input_modalities.map((Y)=>Y==="image"?"vision":Y),...$.architecture.output_modalities,...Z?["tools"]:[],...Q?["reasoning"]:[]])],limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:$.pricing.prompt,output:$.pricing.completion}}}function Cc$($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function eW6($){if($){let Z=await $.get(Sc$,"openrouter");if(Z)return Cc$(Z)}try{let Z=await fetch("https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)return new Map;let{data:Q}=await Z.json(),Y=Q.map(aW6);if($)await $.set(Sc$,"openrouter",Y);return Cc$(Y)}catch{return new Map}}function $K6($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function ZK6($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function vc$($,Z){if(ZK6(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function QK6($,Z){return $.map((Q)=>{let X=$K6(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=vc$(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class KY1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=u7()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=u7()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return _c$(U,J,Y)}let W=await J.create(Y).listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"){let U=await eW6(this.cache);H=QK6(H,U)}else H=H.map((U)=>({...U,capabilities:vc$(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return _c$(F,J,Y)}}function _c$($,Z,Q){let X=Z.create(Q).asyncResearch;if(!X)return $;return $.map((J)=>X.canHandle(J.modelId)?{...J,asyncResearch:!0}:J)}var Sc$="_global";var fc$=D(()=>{LN()});import{SpanStatusCode as bc$}from"@opentelemetry/api";function XK6($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=YK6)break;if(typeof X==="string"&&Y.length<=xc$&&X.length<=xc$)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function JK6($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function GK6($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function UY1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return dQ1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(V9(B))return!0;if(X&&!N)return dQ1(X,F);let O=Nl$(U?.role,F,Bl$());if(O!=="fallback")return O==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let L=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...L}}))?.success===!0)return!0;let E=xo1(F);return(await H({headers:Q,body:{permission:E,...L}}))?.success===!0}catch(w){let E=w?.statusCode;if(E!==401&&E!==403)console.error("[Auth] Permission check failed:",w instanceof Error?w.message:String(w));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!l5(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},listMembers:async(F)=>{return Z.api.listMembers({headers:Q,query:F?{organizationId:F.organizationId,limit:F.limit,offset:F.offset,filterField:F.filterField,filterValue:F.filterValue}:void 0})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function gj($,Z,Q){if(lx.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function KK6($,Z,Q){$.delete(Z),$.set(Z,{archived:Q,at:Date.now()})}function HK6($,Z,Q){if($.size<=Z)return;let Y=Date.now();for(let[X,J]of $)if(Y-J.at>=Q)$.delete(X);if($.size>Z){let X=$.size-Z,J=0;for(let G of $.keys()){if(J>=X)break;$.delete(G),J++}}}async function gc$($,Z,Q,Y){let X=HY1.get(Q);if(X&&Date.now()-X.at<yc$)return X.archived;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=l5(J);return KK6(HY1,Q,G),HK6(HY1,WK6,yc$),G}async function FY1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function FK6($,Z){if(!$)return!0;return Z===$}async function UK6($,Z,Q,Y,X){let J=$70($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>Gg0(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!FK6(Y,W))return;let K=Y?await FY1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function NK6($,Z,Q,Y=uc$,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=GK6($),N=await Y.measure("auth_query_membership",()=>{let w=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return w.where("organization.slug","=",U).executeTakeFirst();if(H)return w.where("organization.id","=",H).executeTakeFirst();if(F)return w.where("organization.slug","=",F).executeTakeFirst();return w.orderBy("member.createdAt","asc").limit(2).execute().then((E)=>E.length===1?E[0]:void 0)});if(l5({metadata:N?.orgMetadata}))throw Error("Organization is archived");let B=N?.role,O=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let L;if(N&&B)L=await Y.measure("auth_fetch_role_permissions",()=>gj(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:L,organization:O}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>Gg0(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await FY1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await gc$(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let O=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(l5(O))return{user:void 0};F=O?{id:O.id,slug:O.slug,name:O.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await gc$(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await FY1(Q,Y,U,K.id,X);let N=await UK6($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(l5({metadata:N?.orgMetadata}))throw Error("Organization is archived");if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N){if(l5(N))throw Error("Organization is archived");K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((O)=>O.userId===W.user.id)?.role}else K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function lc$($){let Z=new XY($.encryption.key),Q=M0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(R3()),H=W(PF()),F=(A)=>`read_ndjson('${K}/${A}/**/*.ndjson', auto_detect=true)`,U=(A)=>`read_ndjson('${H}/${A}/**/*.ndjson', auto_detect=true)`,N,B,O,L,w=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,O=F,L=U;else if(X){let A=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new Hn(Y,A),B=new Hn(Y,A),O=(q)=>"studio_monitoring_logs",L=(q)=>"studio_monitoring_logs"}else if(J){let A=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,q=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,k=Q.duckdbExtensionDirectory;if(!A||!q||!k)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let M={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:A,secretAccessKey:q,extensionDirectory:k},C=new Kn(M,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=C,B=C;let m=Q.monitoringS3Bucket,f=Q.monitoringS3Prefix??"",b=(t,l)=>Lo1({bucket:m,prefix:f,range:l});O=b,L=b,w=!0}else{let{engine:A}=await Bd0({basePath:R3()}),{engine:q}=await Bd0({basePath:PF()});N=A,B=q,O=F,L=U}let E=new Ty($.db),j=new re($.db),z=new Bn($.db),P={connections:new ri($.db,Z),connectionCredentialVault:new kl0($.db),organizationSettings:new Kj($.db),userModelPreferences:new Dd0($.db),monitoring:new bl0(N,O,B,L,G,w),virtualMcps:new Ry($.db),users:new Sd0($.db),tags:new On($.db),organizationBilling:new mK($.db),virtualMcpPluginConfigs:new Ld0($.db),aiProviderKeys:new cn($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new oQ1($.db,Z),secrets:new Ua0($.db,Z),orgFileConfigs:new rQ1($.db,Z),orgSites:new gf($.db),orgRepoSyncs:new Xz($.db),gitProviderAccounts:new DD($.db),gitProviderAccountCredentials:new yt($.db,Z),gitProviderOAuthStates:new ZY1($.db),githubConnectFlows:new eQ1($.db),repositories:new gt($.db),jiraIntegrations:new _N($.db,Z),taskBoard:new hJ($.db),columnAutomations:new QY1($.db),taskBoardPrompts:new YY1($.db),notifications:new JY1($.db),orgFsEntries:new pm($.db),oauthPkceStates:new GY1($.db),claudeSubscriptions:new WY1($.db,Z),automations:uZ0($.db),triggerCallbackTokens:new Un($.db),orgSsoConfig:new Td0($.db,Z),orgSsoSessions:new Rd0($.db),registry:{items:new Ag($.db),publishRequests:new Tg($.db),publishApiKeys:new Rg($.db),monitorRuns:new rZ0($.db),monitorResults:new sZ0($.db),monitorConnections:new aZ0($.db)},brandContext:new Nn($.db),organizationDomains:new UJ($.db),organizationJoinRequests:new Pg($.db),kv:z,interests:new Ad0(z)};return async(A,q)=>{let k=q?.timings??uc$,M=iT0(),C=A?await $.observability.tracer.startActiveSpan("studio.auth",async(A0)=>{try{let x0=await NK6(A,$.auth,$.db,k,$.memberRoleCache);return A0.setStatus({code:bc$.OK}),x0}catch(x0){throw A0.setStatus({code:bc$.ERROR,message:x0.message}),A0.recordException(x0),x0}finally{A0.end()}}):{user:void 0},m=JK6(A,C.user),f=UY1({auth:$.auth,headers:A?.headers??new Headers,role:C.role,permissions:C.permissions,userId:C.user?.id,apiKeyId:C.apiKeyId,organizationId:C.organization?.id}),b={user:C.user,tokenOrganizationId:C.tokenOrganizationId,permissions:C.permissions,permissionsOrganizationId:C.permissions?C.organization?.id:void 0};if(C.apiKey)b.apiKey=C.apiKey;let t=C.organization,l=A?M0().baseUrl??`${new URL(A.url).origin}`:y5(),r=new LE(b.user?.id,void 0,f,C.role,"self",void 0,t?.id),H0={...P,virtualMcps:vm1(P.virtualMcps),threads:new Rl0(E,t?.id),asyncResearchJobs:new nQ1(j,t?.id)},j0=new KY1(H0.aiProviderKeys,$.modelListCache),e=QY(),s=!t?null:e?YJ(e,t.id):new wG(t.id,l),w0=t&&s?new EG(s,H0.orgFsEntries,t.id):null;wQ1(H0,{objectStorage:s,baseUrl:l,orgSlug:t?.slug});let X0={timings:k,auth:b,connectionId:m,organization:t,storage:H0,vault:Z,authInstance:$.auth,boundAuth:f,access:r,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:l,objectStorage:s,orgFs:w0,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(BK6.map((A0)=>[A0,A?.headers.get(A0)??null]).filter(([A0,x0])=>x0!==null)),userAgent:(A?$70(A.headers,"client"):null)||A?.headers.get("User-Agent")||void 0,ipAddress:(A?.headers.get("CF-Connecting-IP")||A?.headers.get("X-Forwarded-For"))??void 0,properties:XK6(A?$70(A.headers,"properties"):null)},aiProviders:j0,createMCPProxy:async(A0)=>{return await jc$(A0,X0)},invalidateMemberRole:$.memberRoleCache?(A0,x0)=>$.memberRoleCache.invalidate(A0,x0):void 0,getOrCreateClient:M,pendingRevalidations:[],firecrawlApiKey:M0().firecrawlApiKey};return X0}}function WL($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=QY();$.objectStorage=Q?YJ(Q,Z.id):new wG(Z.id,$.baseUrl),$.orgFs=new EG($.objectStorage,$.storage.orgFsEntries,Z.id),wQ1($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var YK6=50,xc$=500,yc$=60000,WK6=1e4,HY1,hc$,v7,uc$,BK6;var ZH=D(()=>{fB();bB();E$();P5();ql0();d90();Vl0();hm1();wo1();GG();Od0();Eo1();wd0();Ed0();zd0();fo1();Vd0();eZ0();JU();_d0();f$1();WQ();AQ1();oi();tQ1();hQ1();em0();Gr();Pc$();sQ1();XY0();ht();$Y1();YN();Vc$();ey0();$U();fc$();CB();Vx();EQ1();HY1=new Map;v7={set:($)=>{hc$=$},create:async($,Z)=>{return await hc$($,Z)}},uc$={measure:async($,Z)=>{return await Z()}},BK6=["x-hub-signature-256"]});import{DBOS as sT0,SchedulerMode as OK6}from"@dbos-inc/dbos-sdk";function cc$($){BY1=$}function dc$(){if(!BY1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return BY1}async function LK6($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await v7.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},WL(Y,{id:Q.id,slug:Q.slug}),Y}async function wK6($){try{let{db:Z}=dc$(),Q=await LK6(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await CY0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function EK6($,Z){let Q=await sT0.runStep(()=>new Xz(dc$().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await sT0.runStep(()=>wK6(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function mc$(){if(NY1)return;NY1=sT0.registerWorkflow(EK6,{name:"orgRepoSyncWorkflow"}),sT0.registerScheduled(NY1,{name:"orgRepoSyncWorkflow",crontab:DK6,mode:OK6.ExactlyOncePerIntervalWhenActive})}var DK6="7-59/10 * * * *",BY1=null,NY1=null;var ic$=D(()=>{ZH();_Y0()});import{DBOS as aT0,SchedulerMode as jK6}from"@dbos-inc/dbos-sdk";function pc$($){DY1=$}function nc$(){if(!DY1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return DY1}async function TK6($,Z){try{let Q=await _H(nc$().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await QD$(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function RK6($,Z){let Q=new Date($.getTime()-PK6),Y=await aT0.runStep(()=>new hJ(nc$().db).listItemsAwaitingArchive(Q,AK6),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(tE0(Y).map(({organizationId:G,itemIds:W})=>aT0.runStep(()=>TK6(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function tc$(){if(OY1)return;OY1=aT0.registerWorkflow(RK6,{name:"taskBoardArchiveSweepWorkflow"}),aT0.registerScheduled(OY1,{name:"taskBoardArchiveSweepWorkflow",crontab:zK6,mode:jK6.ExactlyOncePerIntervalWhenActive})}var zK6="23 * * * *",PK6=432000000,AK6=200,DY1=null,OY1=null;var oc$=D(()=>{YN();Ku();Fu()});async function qK6($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===eT0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,eT0,$Y0(Q.length))).id}async function IK6($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!GD$(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!Bv(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await S6($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),H8(Z,K),!0}async function rc$($,Z,Q,Y=oE0){let X=null,J=()=>X??=qK6($,Z),G=0;for(let W of Q)try{if(await IK6($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var eT0="merged";var sc$=D(()=>{j4();VQ();Ku();bW();IZ();X9()});import{DBOS as $R0,SchedulerMode as MK6}from"@dbos-inc/dbos-sdk";function ac$($){wY1=$}function ec$(){if(!wY1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return wY1}async function SK6($,Z){try{let Q=await _H(ec$().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await rc$(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function CK6(){let $=await $R0.runStep(()=>new hJ(ec$().db).listItemsAwaitingMergedTag(eT0,VK6),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(tE0($).map(({organizationId:Y,itemIds:X})=>$R0.runStep(()=>SK6(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function $d$(){if(LY1)return;LY1=$R0.registerWorkflow(CK6,{name:"taskBoardMergedTagSweepWorkflow"}),$R0.registerScheduled(LY1,{name:"taskBoardMergedTagSweepWorkflow",crontab:kK6,mode:MK6.ExactlyOncePerIntervalWhenActive})}var kK6="41 * * * *",VK6=200,wY1=null,LY1=null;var Zd$=D(()=>{YN();Ku();Fu();sc$()});function Yd$($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"&&$!=="https://studio.decocms.com/org/deco/registry/mcp"}catch{return!1}}var Qd$="https://studio.decocms.com/org/deco/registry/mcp";var Jd$,_K6,Xd$=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},EY1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=Xd$(X.substring(0,J));if(Z&&Z!==G||!Jd$.test(G))continue;let W=Xd$(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if(_K6.test(W)){if(Y[G]=W.indexOf("%")!==-1?Ig(W,Ln):W,Z)break}}return Y},vK6=($,Z,Q={})=>{if(!Jd$.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},ZR0=($,Z,Q)=>{return Z=encodeURIComponent(Z),vK6($,Z,Q)};var Gd$=D(()=>{fO();Jd$=/^[\w!#$%&'*.^`|~+-]+$/,_K6=/^[ !#-:<-[\]-~]*$/});var Fc=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return EY1(Y,J)[J]}if(!Y)return{};return EY1(Y)},fK6=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=ZR0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=ZR0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=ZR0($,Z,{path:"/",...Q});return Y},ee=($,Z,Q,Y)=>{let X=fK6(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var QR0=D(()=>{Gd$()});var Wd$=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var Kd$=()=>{};function jY1($,Z){return`${$}:${Z}`}function Hd$($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=jY1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=jY1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(jY1(J,G))}}}class zY1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=Fd$.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of Fd$)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Fd$;var Ud$=D(()=>{Fd$=["studio.sse.broadcast","mesh.sse.broadcast"]});async function bK6($,Z,Q=5){try{await b8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof f5?Y.cause:Y)}}function Nd$($){let Z=new zY1({getConnection:()=>$.getConnection()});S5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{bK6("[NatsSSEBroadcast]",()=>Z.start())})}var PY1=D(()=>{G8();Ud$();Rr();Rr()});var Bd$=()=>{};var AY1=()=>{};var Od$=()=>{};var xK6,gVZ;var Dd$=D(()=>{Bd$();AY1();fO();Od$();xK6={br:".br",zstd:".zst",gzip:".gz"},gVZ=Object.keys(xK6)});var Ld$=D(()=>{Dd$()});var wd$=()=>{};var Ed$=D(()=>{wd$()});var jd$=()=>{};var zd$=D(()=>{dd0()});var TY1=D(()=>{bO();zd$()});var RY1="x-hono-disable-ssg",YSZ;var qY1=D(()=>{TY1();YSZ=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[RY1]:"true"}})}catch{return null}})()});var Pd$=D(()=>{H70()});var IY1=D(()=>{Pd$()});var Ad$=D(()=>{Ed$();jd$();AY1();qY1();IY1();TY1()});var Td$=D(()=>{qY1();IY1();Ad$()});var hSZ;var Rd$=D(()=>{Td$();({write:hSZ}=Bun)});var hK6=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},qd$=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var Id$=()=>{};var $00=($)=>("server"in $.env)?$.env.server:$.env;var YR0=()=>{};var uK6;var Md$=D(()=>{Id$();YR0();uK6=qd$(($,Z)=>{let Q=$00($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var MY1=($)=>{let Z=$00($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var kd$=D(()=>{YR0()});var Vd$=D(()=>{Ld$();Rd$();Md$();kd$();YR0()});var Sd$;var Cd$=D(()=>{Sd$={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function _d$(){let $=Object.keys($4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:Sd$[X].icon})),Y=M0().localMode;return{emailAndPassword:{enabled:$4.emailAndPassword?.enabled??!1},magicLink:{enabled:$4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:$4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:cT0},socialProviders:{enabled:Z,providers:Q},sso:$4.ssoConfig?{enabled:!0,providerId:$4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:JN()}}async function lK6($,Z,Q){try{if(!$4.inviteEmailProviderId||!$4.emailProviders||$4.emailProviders.length===0)return;let Y=OJ($4.emailProviders,$4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=Wi,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=BJ(Y),K=`${y5()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:DJ({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:wj("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var vN,vd$;var kY1=D(()=>{g$();Vd$();V4();E$();zJ();bG();MQ1();lp0();hT0();Lj();WQ();P5();zd0();Cd$();Tv();ux();vN=new $1;vN.post("/local-session",async($)=>{if(!JN())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=MY1($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (Tv(),wj0));await Y();let{auth:X}=await Promise.resolve().then(() => (zJ(),_l$)),J=await Q01();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await Lj0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});vN.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await Q8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(V9(G))return $.json({role:G,capabilities:Ty1()});if(G==="user")return $.json({role:G,capabilities:lg0({self:[...K50]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:lg0(K)})});vN.get("/domain-lookup",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new UJ(Z8().db).getAllByDomain(Q)).filter(gT0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await Z8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(l5(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});vN.post("/domain-join",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=Z8().db,K=(await new UJ(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!l5(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let O=F.get(B.organizationId);return O?[O]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((O)=>O.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await Q8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!HD(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return I1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return I1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});vN.post("/domain-setup",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=Z8().db,K=new UJ(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((P)=>P.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let P=0;P<3;P++){let A=P===0?"":`-${Math.random().toString(36).slice(2,6)}`,q=P===0?U:`${U}${A}`,k=`${N}${A}`;try{B=await Q8.api.createOrganization({body:{name:q,slug:k,userId:Z.user.id}});break}catch(M){if(!(M instanceof Error&&("body"in M)&&M.body?.code==="ORGANIZATION_ALREADY_EXISTS")||P===2)throw M}}if(!B?.id)throw Error("Failed to create organization");let O=B.id;if(G)await K.add(O,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let L=!1,w=null,E=null;try{let z=M0().firecrawlApiKey;if(z){let P=await oQ0(Q,z,U);if(P){let A=new Nn(Z8().db),q=await A.create(O,P);if(await A.setDefault(q.id,O),L=!0,P.name&&P.name!==U)w=P.name;E=P.favicon??P.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let j={};if(!X&&w)j.name=w;if(J)j.logo=J;else if(E)j.logo=E;if(Object.keys(j).length>0)try{await Q8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:O,data:j}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return I1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),I1.groupIdentify({groupType:"organization",groupKey:O,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:L,created_at:new Date().toISOString()}}),I1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:O},properties:{organization_id:O,organization_slug:B.slug??N,email_domain:Q,brand_extracted:L}}),$.json({success:!0,slug:B.slug??N,brandExtracted:L})}catch(W){return I1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});vN.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await Q8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await Q8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!OW.has(W)){let K=await new UJ(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new Pg(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});vN.post("/domain-request-join",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=Z8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new UJ(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new Pg(J).create(G.id,Z.user.id),await lK6(J,G,Z.user.email),I1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return I1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});vN.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await Q8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await uT0({db:Z8().db,authApi:Q8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)I1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});vd$=vN});import{createHmac as cK6}from"crypto";function fd$($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function bd$($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function dK6($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function mK6($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return bd$($.key)}async function xd$($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await Q8.api.getMcpSession({headers:Z}).catch(()=>null),Y=bd$(Q);if(Y)return Y;let X=await Q8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return mK6(X)}function iK6($,Z){let Q=cK6("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var VY1,yd$;var gd$=D(()=>{g$();zJ();VY1=new $1;VY1.get("/me",async($)=>{let Z=fd$($.req.raw.headers),Q;if(Z)Q=await xd$(Z);else{let Y=await Q8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=dK6(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});VY1.post("/session-from-oauth",async($)=>{let Z=fd$($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await xd$(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await Q8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=iK6(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});yd$=VY1});var Uc=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function pK6($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function SY1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function tK6($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return nK6.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var nK6,Nc=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=tK6($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst();if(!G){if(Uc($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=SY1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(l5(G)){if(Uc($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(!F){if(!pK6($)){if(Uc($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}else H=F.role}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),WL(Y,G),await Z()};var XR0=D(()=>{ZH();nK6=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"]]});function oK6($){if(UQ($.id)!==null)return!0;if(sd1($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function rK6($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function sK6($){let Z=$.auth?.apiKey?.id?SY1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return JR0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return JR0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return JR0;return Y}var hd$="/api/_me",JR0,aK6=256,eK6=20,$H6=50,ZH6=10,QH6=5,ud$=()=>{let $=new $1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=n0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=sK6(Q);if(X===JR0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>aK6)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,$H6):eK6,K=rK6(Q,Y),H=W+ZH6,F=[];for(let U=0;U<QH6&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((O)=>!oK6(O)).filter((O)=>!l5({metadata:O.organization_metadata})).map((O)=>({id:O.id,title:O.title,icon:O.icon,orgId:O.organization_id,orgName:O.organization_name,orgSlug:O.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var ld$=D(()=>{g$();V8();XR0();JR0=Symbol("deny")});var cd$="Payload Too Large",dd$,v5=($)=>{let Z=$.onError||(()=>{let Y=new Response(cd$,{status:413});throw new Y$(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:O}=await H.read();if(B)break;if(K+=O.length,K>Q){N.error(new dd$(cd$));break}N.enqueue(O)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof dd$)X.res=await Z(X)}};var XK=D(()=>{JW();dd$=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as YH6}from"crypto";function Z00($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function id$($){if(Z00($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(Z00($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(Z00($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(Z00($,[82,73,70,70])&&Z00($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function _Y1($){return zK($)}function GH6($,Z){let Q=YH6("sha256").update($).digest("hex");return`${GR0}/${Q}.${Z}`}function KR0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${WR0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Bc($){let Z=QY(),Q=Z?YJ(Z,CY1):new wG(CY1,$.baseUrl);return new EG(Q,$.storage.orgFsEntries,CY1,XH6)}async function Q00($,Z){return(await $.listDir(Z,GR0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function pd$($,Z){return(await Q00($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function WH6($,Z){if((await $.stat(Z,GR0))?.readPublic)await $.setReadPublic(Z,GR0,!1,{actor:Z})}async function vY1($,Z,Q){let Y=await Q00($,Z);if(!Y.some((X)=>X.path===Q))throw new YY(`No such avatar: ${Q}`);await WH6($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function KH6($,Z,Q){try{let X=(await Q00($,Z)).filter((J)=>J.path!==Q).slice(JH6-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function nd$($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=GH6(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await vY1($,Q,G),await KH6($,Q,G),G}async function td$($,Z,Q){if(!(await Q00($,Z)).some((X)=>X.path===Q))throw new YY(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function od$($,Z){try{let Q=await Q00($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var CY1="org_user_fs",WR0="/api/_users",GR0="avatars",XH6,md$=2097152,JH6=5;var fY1=D(()=>{Vx();CB();$U();HE();XH6={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function Y00($,Z,Q,Y){let X=dZ(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var bY1=D(()=>{l3()});function HR0($,Z){if(Z instanceof YY)return $.json({error:Z.message},404);if(Z instanceof XJ)return $.json({error:Z.message},400);if(Z instanceof FE)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function FR0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!_Y1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var rd$=()=>{let $=new $1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!_Y1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Bc(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return Y00(Z,await J.read(Q,Y),Y,W)}catch(K){return HR0(Z,K)}}),$.post("/avatar",v5({maxSize:md$,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=id$(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await nd$(Bc(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:KR0(X.baseUrl,Y,W)})}catch(W){return HR0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await pd$(Bc(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:KR0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await vY1(Bc(Y),Q.userId,X.path),Z.json({url:KR0(Y.baseUrl,Q.userId,X.path)})}catch(J){return HR0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Bc(Y),J=Z.req.query("path");if(!J)return await od$(X,Q.userId),Z.json({ok:!0});try{return await td$(X,Q.userId,J),Z.json({ok:!0})}catch(G){return HR0(Z,G)}}),$};var sd$=D(()=>{g$();XK();$U();fY1();bY1()});import{z as Oc}from"zod";var HH6,FH6,UH6=200,NH6=2000,BH6=60,OH6=2000,DH6,UR0;var xY1=D(()=>{HH6=["warn","block"],FH6=Oc.enum(HH6),DH6=Oc.string().max(OH6).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),UR0=Oc.object({severity:FH6,title:Oc.string().trim().min(1).max(UH6),message:Oc.string().trim().min(1).max(NH6),ctaLabel:Oc.string().trim().max(BH6).nullable().optional(),ctaUrl:DH6.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as yY1}from"zod";function gY1($){let Z=$??{},Q=new Set([...Object.keys(pj.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=S7(Z,X);return{flags:Z,effective:Y}}var LH6,ad$;var ed$=D(()=>{v9();LH6=yY1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),ad$=yY1.record(LH6,yY1.boolean())});function $m$($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
+          (SELECT created_at, id FROM notifications WHERE id = ${Q.cursor})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Gu.parse(F.data),createdAt:rW6(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:k8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await Wu({...$,db:this.db})}async notifyMentions($){await Mc$({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var tW6=20,oW6=50,rW6=($)=>$ instanceof Date?$.toISOString():$;var Vc$=D(()=>{FQ();mE0();iE0();kc$()});class GY1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class WY1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function sW6($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function aW6($){let Z=$.supported_parameters?.includes("tools")??!1,Q=$.supported_parameters?.includes("reasoning")??!1;return{providerId:"openrouter",modelId:sW6($.id),title:$.name,description:$.description||null,logo:null,capabilities:[...new Set([...$.architecture.input_modalities.map((Y)=>Y==="image"?"vision":Y),...$.architecture.output_modalities,...Z?["tools"]:[],...Q?["reasoning"]:[]])],limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:$.pricing.prompt,output:$.pricing.completion}}}function Cc$($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function eW6($){if($){let Z=await $.get(Sc$,"openrouter");if(Z)return Cc$(Z)}try{let Z=await fetch("https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)return new Map;let{data:Q}=await Z.json(),Y=Q.map(aW6);if($)await $.set(Sc$,"openrouter",Y);return Cc$(Y)}catch{return new Map}}function $K6($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function ZK6($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function vc$($,Z){if(ZK6(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function QK6($,Z){return $.map((Q)=>{let X=$K6(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=vc$(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class KY1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=u7()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=u7()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return _c$(U,J,Y)}let W=await J.create(Y).listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"){let U=await eW6(this.cache);H=QK6(H,U)}else H=H.map((U)=>({...U,capabilities:vc$(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return _c$(F,J,Y)}}function _c$($,Z,Q){let X=Z.create(Q).asyncResearch;if(!X)return $;return $.map((J)=>X.canHandle(J.modelId)?{...J,asyncResearch:!0}:J)}var Sc$="_global";var fc$=D(()=>{LN()});import{SpanStatusCode as bc$}from"@opentelemetry/api";function XK6($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=YK6)break;if(typeof X==="string"&&Y.length<=xc$&&X.length<=xc$)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function JK6($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function GK6($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function UY1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return dQ1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(V9(B))return!0;if(X&&!N)return dQ1(X,F);let O=Nl$(U?.role,F,Bl$());if(O!=="fallback")return O==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let L=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...L}}))?.success===!0)return!0;let E=xo1(F);return(await H({headers:Q,body:{permission:E,...L}}))?.success===!0}catch(w){let E=w?.statusCode;if(E!==401&&E!==403)console.error("[Auth] Permission check failed:",w instanceof Error?w.message:String(w));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!l5(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},listMembers:async(F)=>{return Z.api.listMembers({headers:Q,query:F?{organizationId:F.organizationId,limit:F.limit,offset:F.offset,filterField:F.filterField,filterValue:F.filterValue}:void 0})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function gj($,Z,Q){if(lx.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function KK6($,Z,Q){$.delete(Z),$.set(Z,{archived:Q,at:Date.now()})}function HK6($,Z,Q){if($.size<=Z)return;let Y=Date.now();for(let[X,J]of $)if(Y-J.at>=Q)$.delete(X);if($.size>Z){let X=$.size-Z,J=0;for(let G of $.keys()){if(J>=X)break;$.delete(G),J++}}}async function gc$($,Z,Q,Y){let X=HY1.get(Q);if(X&&Date.now()-X.at<yc$)return X.archived;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=l5(J);return KK6(HY1,Q,G),HK6(HY1,WK6,yc$),G}async function FY1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function FK6($,Z){if(!$)return!0;return Z===$}async function UK6($,Z,Q,Y,X){let J=$70($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>Gg0(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!FK6(Y,W))return;let K=Y?await FY1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function NK6($,Z,Q,Y=uc$,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=GK6($),N=await Y.measure("auth_query_membership",()=>{let w=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return w.where("organization.slug","=",U).executeTakeFirst();if(H)return w.where("organization.id","=",H).executeTakeFirst();if(F)return w.where("organization.slug","=",F).executeTakeFirst();return w.orderBy("member.createdAt","asc").limit(2).execute().then((E)=>E.length===1?E[0]:void 0)});if(l5({metadata:N?.orgMetadata}))throw Error("Organization is archived");let B=N?.role,O=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let L;if(N&&B)L=await Y.measure("auth_fetch_role_permissions",()=>gj(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:L,organization:O}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>Gg0(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await FY1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await gc$(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let O=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(l5(O))return{user:void 0};F=O?{id:O.id,slug:O.slug,name:O.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await gc$(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await FY1(Q,Y,U,K.id,X);let N=await UK6($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(l5({metadata:N?.orgMetadata}))throw Error("Organization is archived");if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N){if(l5(N))throw Error("Organization is archived");K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((O)=>O.userId===W.user.id)?.role}else K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function lc$($){let Z=new XY($.encryption.key),Q=M0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(R3()),H=W(PF()),F=(A)=>`read_ndjson('${K}/${A}/**/*.ndjson', auto_detect=true)`,U=(A)=>`read_ndjson('${H}/${A}/**/*.ndjson', auto_detect=true)`,N,B,O,L,w=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,O=F,L=U;else if(X){let A=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new Hn(Y,A),B=new Hn(Y,A),O=(q)=>"studio_monitoring_logs",L=(q)=>"studio_monitoring_logs"}else if(J){let A=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,q=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,k=Q.duckdbExtensionDirectory;if(!A||!q||!k)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let M={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:A,secretAccessKey:q,extensionDirectory:k},C=new Kn(M,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=C,B=C;let m=Q.monitoringS3Bucket,f=Q.monitoringS3Prefix??"",b=(t,l)=>Lo1({bucket:m,prefix:f,range:l});O=b,L=b,w=!0}else{let{engine:A}=await Bd0({basePath:R3()}),{engine:q}=await Bd0({basePath:PF()});N=A,B=q,O=F,L=U}let E=new Ty($.db),j=new re($.db),z=new Bn($.db),P={connections:new ri($.db,Z),connectionCredentialVault:new kl0($.db),organizationSettings:new Kj($.db),userModelPreferences:new Dd0($.db),monitoring:new bl0(N,O,B,L,G,w),virtualMcps:new Ry($.db),users:new Sd0($.db),tags:new On($.db),organizationBilling:new mK($.db),virtualMcpPluginConfigs:new Ld0($.db),aiProviderKeys:new cn($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new oQ1($.db,Z),secrets:new Ua0($.db,Z),orgFileConfigs:new rQ1($.db,Z),orgSites:new gf($.db),orgRepoSyncs:new Xz($.db),gitProviderAccounts:new DD($.db),gitProviderAccountCredentials:new yt($.db,Z),gitProviderOAuthStates:new ZY1($.db),githubConnectFlows:new eQ1($.db),repositories:new gt($.db),jiraIntegrations:new _N($.db,Z),taskBoard:new hJ($.db),columnAutomations:new QY1($.db),taskBoardPrompts:new YY1($.db),notifications:new JY1($.db),orgFsEntries:new pm($.db),oauthPkceStates:new GY1($.db),claudeSubscriptions:new WY1($.db,Z),automations:uZ0($.db),triggerCallbackTokens:new Un($.db),orgSsoConfig:new Td0($.db,Z),orgSsoSessions:new Rd0($.db),registry:{items:new Ag($.db),publishRequests:new Tg($.db),publishApiKeys:new Rg($.db),monitorRuns:new rZ0($.db),monitorResults:new sZ0($.db),monitorConnections:new aZ0($.db)},brandContext:new Nn($.db),organizationDomains:new UJ($.db),organizationJoinRequests:new Pg($.db),kv:z,interests:new Ad0(z)};return async(A,q)=>{let k=q?.timings??uc$,M=iT0(),C=A?await $.observability.tracer.startActiveSpan("studio.auth",async(A0)=>{try{let x0=await NK6(A,$.auth,$.db,k,$.memberRoleCache);return A0.setStatus({code:bc$.OK}),x0}catch(x0){throw A0.setStatus({code:bc$.ERROR,message:x0.message}),A0.recordException(x0),x0}finally{A0.end()}}):{user:void 0},m=JK6(A,C.user),f=UY1({auth:$.auth,headers:A?.headers??new Headers,role:C.role,permissions:C.permissions,userId:C.user?.id,apiKeyId:C.apiKeyId,organizationId:C.organization?.id}),b={user:C.user,tokenOrganizationId:C.tokenOrganizationId,permissions:C.permissions,permissionsOrganizationId:C.permissions?C.organization?.id:void 0};if(C.apiKey)b.apiKey=C.apiKey;let t=C.organization,l=A?M0().baseUrl??`${new URL(A.url).origin}`:y5(),r=new LE(b.user?.id,void 0,f,C.role,"self",void 0,t?.id),H0={...P,virtualMcps:vm1(P.virtualMcps),threads:new Rl0(E,t?.id),asyncResearchJobs:new nQ1(j,t?.id)},j0=new KY1(H0.aiProviderKeys,$.modelListCache),e=QY(),s=!t?null:e?YJ(e,t.id):new wG(t.id,l),w0=t&&s?new EG(s,H0.orgFsEntries,t.id):null;wQ1(H0,{objectStorage:s,baseUrl:l,orgSlug:t?.slug});let X0={timings:k,auth:b,connectionId:m,organization:t,storage:H0,vault:Z,authInstance:$.auth,boundAuth:f,access:r,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:l,objectStorage:s,orgFs:w0,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(BK6.map((A0)=>[A0,A?.headers.get(A0)??null]).filter(([A0,x0])=>x0!==null)),userAgent:(A?$70(A.headers,"client"):null)||A?.headers.get("User-Agent")||void 0,ipAddress:(A?.headers.get("CF-Connecting-IP")||A?.headers.get("X-Forwarded-For"))??void 0,properties:XK6(A?$70(A.headers,"properties"):null)},aiProviders:j0,createMCPProxy:async(A0)=>{return await jc$(A0,X0)},invalidateMemberRole:$.memberRoleCache?(A0,x0)=>$.memberRoleCache.invalidate(A0,x0):void 0,getOrCreateClient:M,pendingRevalidations:[],firecrawlApiKey:M0().firecrawlApiKey};return X0}}function WL($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=QY();$.objectStorage=Q?YJ(Q,Z.id):new wG(Z.id,$.baseUrl),$.orgFs=new EG($.objectStorage,$.storage.orgFsEntries,Z.id),wQ1($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var YK6=50,xc$=500,yc$=60000,WK6=1e4,HY1,hc$,v7,uc$,BK6;var ZH=D(()=>{fB();bB();E$();P5();ql0();d90();Vl0();hm1();wo1();GG();Od0();Eo1();wd0();Ed0();zd0();fo1();Vd0();eZ0();JU();_d0();f$1();WQ();AQ1();oi();tQ1();hQ1();em0();Gr();Pc$();sQ1();XY0();ht();$Y1();YN();Vc$();ey0();$U();fc$();CB();Vx();EQ1();HY1=new Map;v7={set:($)=>{hc$=$},create:async($,Z)=>{return await hc$($,Z)}},uc$={measure:async($,Z)=>{return await Z()}},BK6=["x-hub-signature-256"]});import{DBOS as sT0,SchedulerMode as OK6}from"@dbos-inc/dbos-sdk";function cc$($){BY1=$}function dc$(){if(!BY1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return BY1}async function LK6($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await v7.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},WL(Y,{id:Q.id,slug:Q.slug}),Y}async function wK6($){try{let{db:Z}=dc$(),Q=await LK6(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await CY0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function EK6($,Z){let Q=await sT0.runStep(()=>new Xz(dc$().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await sT0.runStep(()=>wK6(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function mc$(){if(NY1)return;NY1=sT0.registerWorkflow(EK6,{name:"orgRepoSyncWorkflow"}),sT0.registerScheduled(NY1,{name:"orgRepoSyncWorkflow",crontab:DK6,mode:OK6.ExactlyOncePerIntervalWhenActive})}var DK6="7-59/10 * * * *",BY1=null,NY1=null;var ic$=D(()=>{ZH();_Y0()});import{DBOS as aT0,SchedulerMode as jK6}from"@dbos-inc/dbos-sdk";function pc$($){DY1=$}function nc$(){if(!DY1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return DY1}async function TK6($,Z){try{let Q=await _H(nc$().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await QD$(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function RK6($,Z){let Q=new Date($.getTime()-PK6),Y=await aT0.runStep(()=>new hJ(nc$().db).listItemsAwaitingArchive(Q,AK6),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(tE0(Y).map(({organizationId:G,itemIds:W})=>aT0.runStep(()=>TK6(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function tc$(){if(OY1)return;OY1=aT0.registerWorkflow(RK6,{name:"taskBoardArchiveSweepWorkflow"}),aT0.registerScheduled(OY1,{name:"taskBoardArchiveSweepWorkflow",crontab:zK6,mode:jK6.ExactlyOncePerIntervalWhenActive})}var zK6="23 * * * *",PK6=432000000,AK6=200,DY1=null,OY1=null;var oc$=D(()=>{YN();Ku();Fu()});async function qK6($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===eT0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,eT0,$Y0(Q.length))).id}async function IK6($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!GD$(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!Bv(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await S6($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),H8(Z,K),!0}async function rc$($,Z,Q,Y=oE0){let X=null,J=()=>X??=qK6($,Z),G=0;for(let W of Q)try{if(await IK6($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var eT0="merged";var sc$=D(()=>{j4();VQ();Ku();bW();IZ();X9()});import{DBOS as $R0,SchedulerMode as MK6}from"@dbos-inc/dbos-sdk";function ac$($){wY1=$}function ec$(){if(!wY1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return wY1}async function SK6($,Z){try{let Q=await _H(ec$().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await rc$(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function CK6(){let $=await $R0.runStep(()=>new hJ(ec$().db).listItemsAwaitingMergedTag(eT0,VK6),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(tE0($).map(({organizationId:Y,itemIds:X})=>$R0.runStep(()=>SK6(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function $d$(){if(LY1)return;LY1=$R0.registerWorkflow(CK6,{name:"taskBoardMergedTagSweepWorkflow"}),$R0.registerScheduled(LY1,{name:"taskBoardMergedTagSweepWorkflow",crontab:kK6,mode:MK6.ExactlyOncePerIntervalWhenActive})}var kK6="41 * * * *",VK6=200,wY1=null,LY1=null;var Zd$=D(()=>{YN();Ku();Fu();sc$()});function Yd$($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"&&$!=="https://studio.decocms.com/org/deco/registry/mcp"}catch{return!1}}var Qd$="https://studio.decocms.com/org/deco/registry/mcp";var Jd$,_K6,Xd$=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},EY1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=Xd$(X.substring(0,J));if(Z&&Z!==G||!Jd$.test(G))continue;let W=Xd$(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if(_K6.test(W)){if(Y[G]=W.indexOf("%")!==-1?Ig(W,Ln):W,Z)break}}return Y},vK6=($,Z,Q={})=>{if(!Jd$.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},ZR0=($,Z,Q)=>{return Z=encodeURIComponent(Z),vK6($,Z,Q)};var Gd$=D(()=>{fO();Jd$=/^[\w!#$%&'*.^`|~+-]+$/,_K6=/^[ !#-:<-[\]-~]*$/});var Fc=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return EY1(Y,J)[J]}if(!Y)return{};return EY1(Y)},fK6=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=ZR0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=ZR0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=ZR0($,Z,{path:"/",...Q});return Y},ee=($,Z,Q,Y)=>{let X=fK6(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var QR0=D(()=>{Gd$()});var Wd$=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var Kd$=()=>{};function jY1($,Z){return`${$}:${Z}`}function Hd$($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=jY1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=jY1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(jY1(J,G))}}}class zY1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=Fd$.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of Fd$)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Fd$;var Ud$=D(()=>{Fd$=["studio.sse.broadcast","mesh.sse.broadcast"]});async function bK6($,Z,Q=5){try{await b8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof f5?Y.cause:Y)}}function Nd$($){let Z=new zY1({getConnection:()=>$.getConnection()});S5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{bK6("[NatsSSEBroadcast]",()=>Z.start())})}var PY1=D(()=>{G8();Ud$();Rr();Rr()});var Bd$=()=>{};var AY1=()=>{};var Od$=()=>{};var xK6,gVZ;var Dd$=D(()=>{Bd$();AY1();fO();Od$();xK6={br:".br",zstd:".zst",gzip:".gz"},gVZ=Object.keys(xK6)});var Ld$=D(()=>{Dd$()});var wd$=()=>{};var Ed$=D(()=>{wd$()});var jd$=()=>{};var zd$=D(()=>{dd0()});var TY1=D(()=>{bO();zd$()});var RY1="x-hono-disable-ssg",YSZ;var qY1=D(()=>{TY1();YSZ=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[RY1]:"true"}})}catch{return null}})()});var Pd$=D(()=>{H70()});var IY1=D(()=>{Pd$()});var Ad$=D(()=>{Ed$();jd$();AY1();qY1();IY1();TY1()});var Td$=D(()=>{qY1();IY1();Ad$()});var hSZ;var Rd$=D(()=>{Td$();({write:hSZ}=Bun)});var hK6=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},qd$=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var Id$=()=>{};var $00=($)=>("server"in $.env)?$.env.server:$.env;var YR0=()=>{};var uK6;var Md$=D(()=>{Id$();YR0();uK6=qd$(($,Z)=>{let Q=$00($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var MY1=($)=>{let Z=$00($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var kd$=D(()=>{YR0()});var Vd$=D(()=>{Ld$();Rd$();Md$();kd$();YR0()});var Sd$;var Cd$=D(()=>{Sd$={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function _d$(){let $=Object.keys($4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:Sd$[X].icon})),Y=M0().localMode;return{emailAndPassword:{enabled:$4.emailAndPassword?.enabled??!1},magicLink:{enabled:$4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:$4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:cT0},socialProviders:{enabled:Z,providers:Q},sso:$4.ssoConfig?{enabled:!0,providerId:$4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:JN()}}async function lK6($,Z,Q){try{if(!$4.inviteEmailProviderId||!$4.emailProviders||$4.emailProviders.length===0)return;let Y=OJ($4.emailProviders,$4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=Wi,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=BJ(Y),K=`${y5()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:DJ({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:wj("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var vN,vd$;var kY1=D(()=>{g$();Vd$();V4();E$();zJ();bG();MQ1();lp0();hT0();Lj();WQ();P5();zd0();Cd$();Tv();ux();vN=new $1;vN.post("/local-session",async($)=>{if(!JN())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=MY1($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (Tv(),wj0));await Y();let{auth:X}=await Promise.resolve().then(() => (zJ(),_l$)),J=await Q01();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await Lj0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});vN.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await Q8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(V9(G))return $.json({role:G,capabilities:Ty1()});if(G==="user")return $.json({role:G,capabilities:lg0({self:[...K50]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:lg0(K)})});vN.get("/domain-lookup",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new UJ(Z8().db).getAllByDomain(Q)).filter(gT0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await Z8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(l5(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});vN.post("/domain-join",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=Z8().db,K=(await new UJ(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!l5(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let O=F.get(B.organizationId);return O?[O]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((O)=>O.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await Q8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!HD(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return I1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return I1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});vN.post("/domain-setup",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=Z8().db,K=new UJ(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((P)=>P.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let P=0;P<3;P++){let A=P===0?"":`-${Math.random().toString(36).slice(2,6)}`,q=P===0?U:`${U}${A}`,k=`${N}${A}`;try{B=await Q8.api.createOrganization({body:{name:q,slug:k,userId:Z.user.id}});break}catch(M){if(!(M instanceof Error&&("body"in M)&&M.body?.code==="ORGANIZATION_ALREADY_EXISTS")||P===2)throw M}}if(!B?.id)throw Error("Failed to create organization");let O=B.id;if(G)await K.add(O,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let L=!1,w=null,E=null;try{let z=M0().firecrawlApiKey;if(z){let P=await oQ0(Q,z,U);if(P){let A=new Nn(Z8().db),q=await A.create(O,P);if(await A.setDefault(q.id,O),L=!0,P.name&&P.name!==U)w=P.name;E=P.favicon??P.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let j={};if(!X&&w)j.name=w;if(J)j.logo=J;else if(E)j.logo=E;if(Object.keys(j).length>0)try{await Q8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:O,data:j}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return I1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),I1.groupIdentify({groupType:"organization",groupKey:O,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:L,created_at:new Date().toISOString()}}),I1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:O},properties:{organization_id:O,organization_slug:B.slug??N,email_domain:Q,brand_extracted:L}}),$.json({success:!0,slug:B.slug??N,brandExtracted:L})}catch(W){return I1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});vN.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await Q8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await Q8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!OW.has(W)){let K=await new UJ(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new Pg(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});vN.post("/domain-request-join",async($)=>{let Z=await Q8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||OW.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=Z8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new UJ(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new Pg(J).create(G.id,Z.user.id),await lK6(J,G,Z.user.email),I1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return I1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});vN.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await Q8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await uT0({db:Z8().db,authApi:Q8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)I1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});vd$=vN});import{createHmac as cK6}from"crypto";function fd$($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function bd$($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function dK6($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function mK6($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return bd$($.key)}async function xd$($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await Q8.api.getMcpSession({headers:Z}).catch(()=>null),Y=bd$(Q);if(Y)return Y;let X=await Q8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return mK6(X)}function iK6($,Z){let Q=cK6("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var VY1,yd$;var gd$=D(()=>{g$();zJ();VY1=new $1;VY1.get("/me",async($)=>{let Z=fd$($.req.raw.headers),Q;if(Z)Q=await xd$(Z);else{let Y=await Q8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=dK6(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});VY1.post("/session-from-oauth",async($)=>{let Z=fd$($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await xd$(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await Q8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=iK6(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});yd$=VY1});var Uc=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function pK6($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function SY1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function tK6($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return nK6.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var nK6,Nc=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=tK6($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst();if(!G){if(Uc($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=SY1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(l5(G)){if(Uc($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(!F){if(!pK6($)){if(Uc($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}else H=F.role}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),WL(Y,G),await Z()};var XR0=D(()=>{ZH();nK6=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"]]});function oK6($){if(UQ($.id)!==null)return!0;if(sd1($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function rK6($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function sK6($){let Z=$.auth?.apiKey?.id?SY1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return JR0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return JR0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return JR0;return Y}var hd$="/api/_me",JR0,aK6=256,eK6=20,$H6=50,ZH6=10,QH6=5,ud$=()=>{let $=new $1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=n0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=sK6(Q);if(X===JR0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>aK6)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,$H6):eK6,K=rK6(Q,Y),H=W+ZH6,F=[];for(let U=0;U<QH6&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((O)=>!oK6(O)).filter((O)=>!l5({metadata:O.organization_metadata})).map((O)=>({id:O.id,title:O.title,icon:O.icon,orgId:O.organization_id,orgName:O.organization_name,orgSlug:O.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var ld$=D(()=>{g$();V8();XR0();JR0=Symbol("deny")});var cd$="Payload Too Large",dd$,v5=($)=>{let Z=$.onError||(()=>{let Y=new Response(cd$,{status:413});throw new Y$(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:O}=await H.read();if(B)break;if(K+=O.length,K>Q){N.error(new dd$(cd$));break}N.enqueue(O)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof dd$)X.res=await Z(X)}};var XK=D(()=>{JW();dd$=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as YH6}from"crypto";function Z00($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function id$($){if(Z00($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(Z00($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(Z00($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(Z00($,[82,73,70,70])&&Z00($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function _Y1($){return zK($)}function GH6($,Z){let Q=YH6("sha256").update($).digest("hex");return`${GR0}/${Q}.${Z}`}function KR0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${WR0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Bc($){let Z=QY(),Q=Z?YJ(Z,CY1):new wG(CY1,$.baseUrl);return new EG(Q,$.storage.orgFsEntries,CY1,XH6)}async function Q00($,Z){return(await $.listDir(Z,GR0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function pd$($,Z){return(await Q00($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function WH6($,Z){if((await $.stat(Z,GR0))?.readPublic)await $.setReadPublic(Z,GR0,!1,{actor:Z})}async function vY1($,Z,Q){let Y=await Q00($,Z);if(!Y.some((X)=>X.path===Q))throw new YY(`No such avatar: ${Q}`);await WH6($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function KH6($,Z,Q){try{let X=(await Q00($,Z)).filter((J)=>J.path!==Q).slice(JH6-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function nd$($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=GH6(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await vY1($,Q,G),await KH6($,Q,G),G}async function td$($,Z,Q){if(!(await Q00($,Z)).some((X)=>X.path===Q))throw new YY(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function od$($,Z){try{let Q=await Q00($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var CY1="org_user_fs",WR0="/api/_users",GR0="avatars",XH6,md$=2097152,JH6=5;var fY1=D(()=>{Vx();CB();$U();HE();XH6={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function Y00($,Z,Q,Y){let X=dZ(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var bY1=D(()=>{l3()});function HR0($,Z){if(Z instanceof YY)return $.json({error:Z.message},404);if(Z instanceof XJ)return $.json({error:Z.message},400);if(Z instanceof FE)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function FR0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!_Y1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var rd$=()=>{let $=new $1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!_Y1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Bc(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return Y00(Z,await J.read(Q,Y),Y,W)}catch(K){return HR0(Z,K)}}),$.post("/avatar",v5({maxSize:md$,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=id$(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await nd$(Bc(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:KR0(X.baseUrl,Y,W)})}catch(W){return HR0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await pd$(Bc(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:KR0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await vY1(Bc(Y),Q.userId,X.path),Z.json({url:KR0(Y.baseUrl,Q.userId,X.path)})}catch(J){return HR0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=FR0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Bc(Y),J=Z.req.query("path");if(!J)return await od$(X,Q.userId),Z.json({ok:!0});try{return await td$(X,Q.userId,J),Z.json({ok:!0})}catch(G){return HR0(Z,G)}}),$};var sd$=D(()=>{g$();XK();$U();fY1();bY1()});import{z as Oc}from"zod";var HH6,FH6,UH6=200,NH6=2000,BH6=60,OH6=2000,DH6,UR0;var xY1=D(()=>{HH6=["warn","block"],FH6=Oc.enum(HH6),DH6=Oc.string().max(OH6).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),UR0=Oc.object({severity:FH6,title:Oc.string().trim().min(1).max(UH6),message:Oc.string().trim().min(1).max(NH6),ctaLabel:Oc.string().trim().max(BH6).nullable().optional(),ctaUrl:DH6.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as yY1}from"zod";function gY1($){let Z=$??{},Q=new Set([...Object.keys(pj.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=S7(Z,X);return{flags:Z,effective:Y}}var LH6,ad$;var ed$=D(()=>{v9();LH6=yY1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),ad$=yY1.record(LH6,yY1.boolean())});function $m$($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
 `||X==="\r")return Y;Y+=Z.length}}function Zm$($,Z){let Q=$m$($,wH6(Z),0);if(Q===-1)return null;let Y=$.indexOf(`
 `,Q);if(Y===-1)return null;let X=$m$($,EH6(Z),Y);if(X===-1)return null;let J=$.lastIndexOf(`
 `,X);return{from:Y+1,to:J+1}}function Qm$($,Z){let Q=Zm$($,Z);return Q?$.slice(Q.from,Q.to):null}function Ym$($,Z,Q){let Y=Zm$($,Z);if(!Y)throw Error(`prompt region "${Z}" not found in source`);let X=Q.endsWith(`
@@ -2938,7 +2938,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${J.join(`
 `)}`:X}function KA6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var Io$=200,aP6=12,$A6,QA6=300,Pq0=3;var $G1=D(()=>{sZ();G8();zq0();$A6={aheadBy:0,behindBy:0,files:[]}});function FA6($){if(!$||$.includes(".."))return!1;return HA6.test($)}function ko$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!FA6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function Vo$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var HA6;var So$=D(()=>{HA6=/^[\w./@-]+$/});function l00($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function _o$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Xw(zZ);let J=await ID($.storage,X,Y);if(J&&await vU($.storage,J)){let F=await HH($,J,{forceRefresh:!0}).catch((U)=>{throw new Xw(U instanceof Error?U.message:zZ)});await Co$($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Xw("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Oh({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:zZ;throw new Xw(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await FH(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=f5$(F instanceof Error?F.message:String(F));throw U?new Xw(N):F});await Co$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function Co$($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=yc($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await $L(K,UA6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var UA6=10485760,Xw;var ZG1=D(()=>{uG();Uq0();Wr();kY0();$o();sZ();Xw=class Xw extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function BA6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!NA6.test(Z))throw Error(`Invalid branch name: ${$}`)}function Qb($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(DA6)])}async function wA6($,Z){let Q=$.var.studioContext,Y=EH(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=a_(G?.metadata?.runtime);if(W)return W;let K=LE0(Z.virtualMcpMetadata),H=K==="cms"?await fJ1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)Kr(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function EA6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await RY($.var.studioContext)}catch{return null}}function Yb($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function cc($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=l00(Z,Q);if(!X)throw new p0({provider:"github",status:404,message:"Project has no GitHub repository"});let J=p(Y);return Nh(Y,J.id,X)}function QG1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=O6$(Z);if(Y!==void 0)return $.json({error:Q},429,{...L5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof D6)return $.json({error:Q},409,L5);let X=dG(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,L5)}return $.json({error:Q},502,L5)}async function bo$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function xo$($){try{let Z=await cc($),Q=await Aq0(Z,$.get("vmClaim").branch);return $.json(Q,200,L5)}catch(Z){return QG1($,Z)}}function c00($,Z){let Y=(qq0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return qq0.set($,X),X.finally(()=>{if(qq0.get($)===X)qq0.delete($)}),Y}async function K7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,L5);let Y=Q?.runner??Yb($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...L5}})}}let O=await B.text(),L=Q?.redactRepoDir?jA6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...L5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function jA6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Iq0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function zA6($){return yo$.includes($)}var NA6,vo$=524288,OA6=65536,DA6=1e4,fo$=2000,LA6,qq0,L5,yo$,go$=()=>{let $=new $1;$.use("/:virtualMcpId/:branch/*",LA6),$.post("/:virtualMcpId/:branch/write",(Q)=>K7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>K7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>K7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>K7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>K7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>K7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>K7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:Qb(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return K7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>K7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!zA6(Y))return Q.json({error:`step must be one of: ${yo$.join(", ")}`},400);let X=Q.get("vmClaim"),J=await fJ1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await EA6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,L5);if(Y==="start"){let G=p(Q.var.studioContext),W=sh(X.virtualMcpMetadata);try{await NE0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return K7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return cN(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return yt$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return xo$(Q);return Z(Q)});let Z=(Q)=>K7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(fo$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return xo$(Q);return K7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(fo$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await cc(Q),G=await Tq0(J,Y.branch,X.base);return Q.json(G,200,L5)}catch(X){return QG1(Q,X)}return K7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,L5);let Y=Yb(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return c00(X,async()=>{try{await bJ1(W,Y,X);let K=l00(J,G);if(K)await _o$(W,Y,X,K)}catch(K){if(K instanceof Xw)return Q.json({error:K.message},403,L5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,L5)}return K7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return c00(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,L5);try{let G=await cc(Q);return await Mo$(G,Y.branch,J),Q.json({ok:!0},200,L5)}catch(G){let W=dG(G)===409||G instanceof D6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,L5)}});return c00(Y.claimName,()=>K7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return c00(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await cc(Q),H=W.base??await K.getDefaultBranch();return await Rq0(K,Y.branch,H),Q.json({ok:!0},200,L5)}catch(W){return QG1(Q,W)}});let X=Yb(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return c00(J,async()=>{try{await bJ1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,L5)}return K7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",v5({maxSize:vo$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Yb(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=gJ1(F)&&N?[F,U]:X?await Promise.all([Iq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Iq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await cc(Q);return Promise.all([Aq0(w,Y.branch),Tq0(w,Y.branch)])})(),L=await ct$(K,B,O);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",v5({maxSize:vo$,onError:(Q)=>Q.json({error:"Payload too large"},413,L5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Yb(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=gJ1(F)&&N?[F,U]:X?await Promise.all([Iq0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),Iq0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await cc(Q);return Promise.all([Aq0(w,Y.branch),Tq0(w,Y.branch)])})(),L=await mt$(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,L5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,L5);return Q.json({error:F},502,L5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=Yb(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return bo$(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",v5({maxSize:OA6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=Yb(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=ko$(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=Vo$(J,W.resolveType);return bo$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var ho$=D(()=>{g$();XK();xc();vJ1();Yr();ft$();nG();ah();bt$();RW();xt$();gt$();Na0();Jr();lJ1();it$();sZ();o5();$G1();So$();ZG1();NA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;LA6=Fq0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=n0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=p(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{BA6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=qo({orgId:X.id,virtualMcpId:J,branch:G}),H=await Sr0(Q,G),F=Cr0(H,Y),U=vt$({userId:F,projectRef:K}),N=W.metadata??null,B=await wA6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await RY(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});qq0=new Map;L5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};yo$=["clone","install","start"]});function uo$($,Z,Q){let Y=YG1.get($);if(!Y)Y={pending:null,running:!1},YG1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)AA6($,Y);return J}async function AA6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await TA6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)YG1.delete($)}}async function TA6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await lc(Z,Q),W=await Z.listDecofileEntries(G,Y),K=sJ1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=aJ1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await Ao$(Z.repo,L);let w=O[0]??`${jq0(Y)}/${mJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of aJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await To$(Z,F.values(),X),{decofile:B,skipped:O}=x00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:wW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:RA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=PA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function RA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Yr0(Y,$.deps.coAuthor)}var PA6=3,YG1;var lo$=D(()=>{Zw0();Bq0();c6();G8();sZ();zq0();YG1=new Map});import{createHmac as co$,randomBytes as qA6,timingSafeEqual as IA6}from"crypto";function do$(){if(Mq0)return Mq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Mq0=$?Buffer.from($):qA6(32),Mq0}function XG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+MA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=co$("sha256",do$()).update(Y).digest("base64url");return`${Y}.${X}`}function mo$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(co$("sha256",do$()).update(Y).digest("base64url"));if(X.length!==J.length||!IA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var MA6=21600000,Mq0=null;var io$=D(()=>{E$()});import{z as dc}from"zod";function VA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&kA6.test($)}function ro$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function d00($){let Z=$.get("decofileScope");return Nh($.var.studioContext,Z.organizationId,Z.githubRepo)}function m00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=dG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function so$(){let $=new $1;return $.use("/:virtualMcpId/:branch",oo$),$.use("/:virtualMcpId/:branch/*",oo$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Ro$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=XG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(ro$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return m00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await d00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return m00(Z,X)}}),$.patch("/:virtualMcpId/:branch",CA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=_A6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Nq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(dJ1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await d00(Z),W=await uo$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:yc(Y)},J),K=XG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:ro$(Z)})}catch(G){return m00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(dG(W)!==409)throw W;await Rq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(dG(G)===409)return Z.json({error:"merge-conflict"},409);if(dG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return m00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(dG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return m00(Z,Y)}}),$}var kA6,po$=500,no$=1048576,to$=1024,SA6=8388608,CA6,_A6,oo$;var ao$=D(()=>{Ba0();Bq0();g$();XK();vJ1();Uq0();ZG1();sZ();lo$();io$();$G1();zq0();kA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;CA6=v5({maxSize:SA6,onError:($)=>$.json({error:"Payload too large"},413)}),_A6=dc.object({set:dc.record(dc.string(),dc.unknown()).optional(),delete:dc.array(dc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=po$,{message:`Patch cannot touch more than ${po$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=no$),{message:`Each block must be at most ${no$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=to$),{message:`Each block key must be at most ${to$} characters`}),oo$=Fq0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!VA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!mo$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!DE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=l00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var eo$=($)=>{let Z=new $1;if(Z.use("*",Nc),Z.use("*",Cm$),Z.route("/",zR0()),Z.route("/",Ni$()),Z.route("/",em$()),Z.route("/",zt$()),Z.route("/",Bt$()),Z.route("/",wt$()),Z.route("/",Wq0()),Z.route("/tools",Mt$()),Z.route("/",Rt$()),Z.route("/",in$({kvStorage:$.kvStorage})),Z.route("/",dn$()),Z.route("/fs",Xt$({getConnection:$.getNatsConnection})),Z.route("/sandbox",go$()),Z.route("/decofile",so$()),Z.route("/",Ft$()),Z.route("/",Gt$()),Z.route("/deco-sites",AR0()),Z.route("/hosting",cm$()),Z.route("/monitor",om$()),Z.route("/sso",OR0()),Z.route("/",Kq0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ym$()),$.mountDevAssets)Z.route("/dev-assets",IR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ol$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Kt$()),Z.route("/mcp",wz0()),Z.route("/mcp/self",Xq0()),Z.route("/mcp",zz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var $r$=D(()=>{g$();_m$();XR0();gm$();$X1();dm$();rm$();MR0();jc();oY1();JX1();mn$();pn$();Jt$();Wt$();Hs();dY1();Pz0();RJ1();Ht$();Ut$();Ot$();MJ1();Pt$();qt$();kJ1();kt$();VJ1();Ez0();ho$();ao$()});function vA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var fA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Zr$=()=>{let $=new $1;return $.use("*",fA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:vA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var Qr$=D(()=>{g$();E$();UT0()});import{z as k1}from"zod";function LF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function mA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function iA6($,Z,Q){try{return JSON.parse($)}catch{throw new Jr$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function pA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:iA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function nA6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?bJ(Q.function.parameters):bJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function tA6($){if(!$)return;return{openai:{response_format:$}}}function oA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Yr$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function Xr$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var bA6=256,xA6,yA6,gA6,hA6,uA6,lA6,cA6,dA6,Jr$,Gr$,Wr$;var Kr$=D(()=>{C4();g$();xc();EN();xA6=k1.object({type:k1.literal("function"),function:k1.object({name:k1.string(),description:k1.string().optional(),parameters:k1.record(k1.string(),k1.unknown()).optional()})}),yA6=k1.object({id:k1.string(),type:k1.literal("function"),function:k1.object({name:k1.string(),arguments:k1.string()})}),gA6=k1.discriminatedUnion("role",[k1.object({role:k1.literal("system"),content:k1.string(),name:k1.string().optional()}),k1.object({role:k1.literal("user"),content:k1.union([k1.string(),k1.array(k1.union([k1.object({type:k1.literal("text"),text:k1.string()}),k1.object({type:k1.literal("image_url"),image_url:k1.object({url:k1.string(),detail:k1.string().optional()})})]))]),name:k1.string().optional()}),k1.object({role:k1.literal("assistant"),content:k1.string().nullable().optional(),name:k1.string().optional(),tool_calls:k1.array(yA6).optional()}),k1.object({role:k1.literal("tool"),content:k1.string(),tool_call_id:k1.string()})]),hA6=k1.object({type:k1.literal("text")}),uA6=k1.object({type:k1.literal("json_object")}),lA6=k1.object({type:k1.literal("json_schema"),json_schema:k1.object({name:k1.string(),description:k1.string().optional(),schema:k1.record(k1.string(),k1.unknown()),strict:k1.boolean().optional()})}),cA6=k1.union([hA6,uA6,lA6]),dA6=k1.object({model:k1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:k1.array(gA6),stream:k1.boolean().optional().default(!1),temperature:k1.number().min(0).max(2).optional(),max_tokens:k1.number().positive().optional(),top_p:k1.number().min(0).max(1).optional(),frequency_penalty:k1.number().min(-2).max(2).optional(),presence_penalty:k1.number().min(-2).max(2).optional(),stop:k1.union([k1.string(),k1.array(k1.string())]).optional(),tools:k1.array(xA6).optional(),tool_choice:k1.union([k1.literal("auto"),k1.literal("none"),k1.literal("required"),k1.object({type:k1.literal("function"),function:k1.object({name:k1.string()})})]).optional(),response_format:cA6.optional(),user:k1.string().optional()});Jr$=class Jr$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Gr$=new $1;Gr$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(LF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(LF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(LF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=dA6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(LF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=mA6(J.model);if(!G)return $.json(LF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>OE(j.providerId));if(!E)return $.json(LF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(LF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=pA6(J.messages),N=J.tools?nA6(J.tools):void 0,B=tA6(J.response_format),O=oA6(),L=Math.floor(Date.now()/1000);if(J.stream)return cN($,async(w)=>{let E=Yr$(F,U,N,J,B,$.req.raw.signal);try{let j=sD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=bA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:Xr$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Yr$(F,U,N,J,B,$.req.raw.signal),E=await oD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:Xr$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(LF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(LF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(LF(X.message,"server_error"),500)}});Wr$=Gr$});function rA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Hr$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!V7(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||l5(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(Z4$(U)!==J)continue;if(!rA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Fr$=D(()=>{g$();QH()});var Nr$;var Ur$=D(()=>{Nr$={name:"decocms",version:"4.358.6",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function eA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??aA6}}var Br$,aA6="https://ph.studio.decocms.com",Or$;var Dr$=D(()=>{g$();Tn();Tv();P5();E$();kY1();Ur$();Br$=new $1;Br$.get("/",($)=>{let Z={version:Nr$.version,theme:qr1(),...GW().logo&&{logo:GW().logo},...JN()&&{internalUrl:gx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:_d$(),posthog:eA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:a00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Or$=Br$});function mc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function JG1($){return(mc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function wr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(mc($))}&sz=${Z}`}function Lr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Er$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Lr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Lr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var Xb,$26,Z26,Q26,Y26,jr$;var zr$=D(()=>{Xb=c0.enum(["good","bad","neutral"]),$26=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:Xb.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),Z26=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array($26)),Q26={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},Y26=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:Xb.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:Xb.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:Xb.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:Xb.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(Z26).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:Xb.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:Xb.optional()})).min(1)})]),jr$=c0.object({...Q26,template:Y26})});function kq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=jr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var GG1=D(()=>{zr$()});import{join as Pr$}from"path";async function J26($){try{let Z=await fetch(`${tK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(X26)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=kq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||JG1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function $G($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function G26($,Z){let Q=mc($),Y=Z?.brand?.trim()||JG1(Q),X=wr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Er$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${$G(W)}</title>`,`<meta name="description" content="${$G(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${$G(W)}" />`,`<meta property="og:description" content="${$G(K)}" />`,`<meta property="og:url" content="${$G(G)}" />`,`<meta property="og:image" content="${$G(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${$G(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${$G(W)}" />`,`<meta name="twitter:description" content="${$G(K)}" />`,`<meta name="twitter:image" content="${$G(H)}" />`,`<meta name="twitter:image:alt" content="${$G(F)}" />`,`<link rel="canonical" href="${$G(G)}" />`,`<link rel="icon" href="${$G(X)}" sizes="any" />`].join(`
+`;await Ao$(Z.repo,L);let w=O[0]??`${jq0(Y)}/${mJ1(N)}.json`;H.push({path:w,content:L});let E=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:E,content:L});for(let j of O.slice(1))H.push({path:j,deleted:!0}),F.delete(j)}for(let N of $.del)for(let B of aJ1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await To$(Z,F.values(),X),{decofile:B,skipped:O}=x00(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:wW(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:RA6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof D6)||J>=PA6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function RA6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return Yr0(Y,$.deps.coAuthor)}var PA6=3,YG1;var lo$=D(()=>{Zw0();Bq0();c6();G8();sZ();zq0();YG1=new Map});import{createHmac as co$,randomBytes as qA6,timingSafeEqual as IA6}from"crypto";function do$(){if(Mq0)return Mq0;let $;try{let Z=M0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Mq0=$?Buffer.from($):qA6(32),Mq0}function XG1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+MA6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=co$("sha256",do$()).update(Y).digest("base64url");return`${Y}.${X}`}function mo$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(co$("sha256",do$()).update(Y).digest("base64url"));if(X.length!==J.length||!IA6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var MA6=21600000,Mq0=null;var io$=D(()=>{E$()});import{z as dc}from"zod";function VA6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&kA6.test($)}function ro$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function d00($){let Z=$.get("decofileScope");return Nh($.var.studioContext,Z.organizationId,Z.githubRepo)}function m00($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof D6)return $.json({error:Q},409);let Y=dG(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function so$(){let $=new $1;return $.use("/:virtualMcpId/:branch",oo$),$.use("/:virtualMcpId/:branch/*",oo$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Ro$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=XG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(ro$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return m00(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await d00(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return m00(Z,X)}}),$.patch("/:virtualMcpId/:branch",CA6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=_A6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Nq0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(dJ1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await d00(Z),W=await uo$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:yc(Y)},J),K=XG1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:ro$(Z)})}catch(G){return m00(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(dG(W)!==409)throw W;await Rq0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(dG(G)===409)return Z.json({error:"merge-conflict"},409);if(dG(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return m00(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await d00(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(dG(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return m00(Z,Y)}}),$}var kA6,po$=500,no$=1048576,to$=1024,SA6=8388608,CA6,_A6,oo$;var ao$=D(()=>{Ba0();Bq0();g$();XK();vJ1();Uq0();ZG1();sZ();lo$();io$();$G1();zq0();kA6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;CA6=v5({maxSize:SA6,onError:($)=>$.json({error:"Payload too large"},413)}),_A6=dc.object({set:dc.record(dc.string(),dc.unknown()).optional(),delete:dc.array(dc.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=po$,{message:`Patch cannot touch more than ${po$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=no$),{message:`Each block must be at most ${no$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=to$),{message:`Each block key must be at most ${to$} characters`}),oo$=Fq0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!VA6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!mo$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!DE0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=l00(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var eo$=($)=>{let Z=new $1;if(Z.use("*",Nc),Z.use("*",Cm$),Z.route("/",zR0()),Z.route("/",Ni$()),Z.route("/",em$()),Z.route("/",zt$()),Z.route("/",Bt$()),Z.route("/",wt$()),Z.route("/",Wq0()),Z.route("/tools",Mt$()),Z.route("/",Rt$()),Z.route("/",in$({kvStorage:$.kvStorage})),Z.route("/",dn$()),Z.route("/fs",Xt$({getConnection:$.getNatsConnection})),Z.route("/sandbox",go$()),Z.route("/decofile",so$()),Z.route("/",Ft$()),Z.route("/",Gt$()),Z.route("/deco-sites",AR0()),Z.route("/hosting",cm$()),Z.route("/monitor",om$()),Z.route("/sso",OR0()),Z.route("/",Kq0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ym$()),$.mountDevAssets)Z.route("/dev-assets",IR0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ol$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Kt$()),Z.route("/mcp",wz0()),Z.route("/mcp/self",Xq0()),Z.route("/mcp",zz0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var $r$=D(()=>{g$();_m$();XR0();gm$();$X1();dm$();rm$();MR0();jc();oY1();JX1();mn$();pn$();Jt$();Wt$();Hs();dY1();Pz0();RJ1();Ht$();Ut$();Ot$();MJ1();Pt$();qt$();kJ1();kt$();VJ1();Ez0();ho$();ao$()});function vA6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var fA6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Zr$=()=>{let $=new $1;return $.use("*",fA6),$.get("/",async(Z)=>{let Q=M0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await lX(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:vA6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var Qr$=D(()=>{g$();E$();UT0()});import{z as k1}from"zod";function LF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function mA6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function iA6($,Z,Q){try{return JSON.parse($)}catch{throw new Jr$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function pA6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:iA6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function nA6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?bJ(Q.function.parameters):bJ({type:"object",properties:{}});return[Q.function.name,W$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function tA6($){if(!$)return;return{openai:{response_format:$}}}function oA6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Yr$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function Xr$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var bA6=256,xA6,yA6,gA6,hA6,uA6,lA6,cA6,dA6,Jr$,Gr$,Wr$;var Kr$=D(()=>{C4();g$();xc();EN();xA6=k1.object({type:k1.literal("function"),function:k1.object({name:k1.string(),description:k1.string().optional(),parameters:k1.record(k1.string(),k1.unknown()).optional()})}),yA6=k1.object({id:k1.string(),type:k1.literal("function"),function:k1.object({name:k1.string(),arguments:k1.string()})}),gA6=k1.discriminatedUnion("role",[k1.object({role:k1.literal("system"),content:k1.string(),name:k1.string().optional()}),k1.object({role:k1.literal("user"),content:k1.union([k1.string(),k1.array(k1.union([k1.object({type:k1.literal("text"),text:k1.string()}),k1.object({type:k1.literal("image_url"),image_url:k1.object({url:k1.string(),detail:k1.string().optional()})})]))]),name:k1.string().optional()}),k1.object({role:k1.literal("assistant"),content:k1.string().nullable().optional(),name:k1.string().optional(),tool_calls:k1.array(yA6).optional()}),k1.object({role:k1.literal("tool"),content:k1.string(),tool_call_id:k1.string()})]),hA6=k1.object({type:k1.literal("text")}),uA6=k1.object({type:k1.literal("json_object")}),lA6=k1.object({type:k1.literal("json_schema"),json_schema:k1.object({name:k1.string(),description:k1.string().optional(),schema:k1.record(k1.string(),k1.unknown()),strict:k1.boolean().optional()})}),cA6=k1.union([hA6,uA6,lA6]),dA6=k1.object({model:k1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:k1.array(gA6),stream:k1.boolean().optional().default(!1),temperature:k1.number().min(0).max(2).optional(),max_tokens:k1.number().positive().optional(),top_p:k1.number().min(0).max(1).optional(),frequency_penalty:k1.number().min(-2).max(2).optional(),presence_penalty:k1.number().min(-2).max(2).optional(),stop:k1.union([k1.string(),k1.array(k1.string())]).optional(),tools:k1.array(xA6).optional(),tool_choice:k1.union([k1.literal("auto"),k1.literal("none"),k1.literal("required"),k1.object({type:k1.literal("function"),function:k1.object({name:k1.string()})})]).optional(),response_format:cA6.optional(),user:k1.string().optional()});Jr$=class Jr$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Gr$=new $1;Gr$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(LF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(LF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(LF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=dA6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(LF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=mA6(J.model);if(!G)return $.json(LF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>OE(j.providerId));if(!E)return $.json(LF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(LF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=pA6(J.messages),N=J.tools?nA6(J.tools):void 0,B=tA6(J.response_format),O=oA6(),L=Math.floor(Date.now()/1000);if(J.stream)return cN($,async(w)=>{let E=Yr$(F,U,N,J,B,$.req.raw.signal);try{let j=sD(E),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=bA6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:Xr$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Yr$(F,U,N,J,B,$.req.raw.signal),E=await oD(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:j,finish_reason:Xr$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(LF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(LF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(LF(X.message,"server_error"),500)}});Wr$=Gr$});function rA6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function Hr$(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=n0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!V7(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||l5(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(Z4$(U)!==J)continue;if(!rA6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Fr$=D(()=>{g$();QH()});var Nr$;var Ur$=D(()=>{Nr$={name:"decocms",version:"4.358.7",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function eA6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??aA6}}var Br$,aA6="https://ph.studio.decocms.com",Or$;var Dr$=D(()=>{g$();Tn();Tv();P5();E$();kY1();Ur$();Br$=new $1;Br$.get("/",($)=>{let Z={version:Nr$.version,theme:qr1(),...GW().logo&&{logo:GW().logo},...JN()&&{internalUrl:gx1()},...M0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!M0().firecrawlApiKey,hostingEnabled:!!M0().controlplaneRestUrl&&!!M0().controlplaneServiceToken,hostingControlPlaneGa:M0().hostingControlPlaneGa,monitorEnabled:!!M0().clickhouseAnalyticsUrl&&!!M0().clickhouseAnalyticsPassword,monitorGa:M0().monitorGa,auth:_d$(),posthog:eA6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:a00()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Or$=Br$});function mc($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function JG1($){return(mc($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function wr$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(mc($))}&sz=${Z}`}function Lr$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function Er$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?Lr$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):Lr$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as c0}from"zod";var Xb,$26,Z26,Q26,Y26,jr$;var zr$=D(()=>{Xb=c0.enum(["good","bad","neutral"]),$26=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:Xb.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),Z26=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array($26)),Q26={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},Y26=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:Xb.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:Xb.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:Xb.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:Xb.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(Z26).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:Xb.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:Xb.optional()})).min(1)})]),jr$=c0.object({...Q26,template:Y26})});function kq0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=jr$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var GG1=D(()=>{zr$()});import{join as Pr$}from"path";async function J26($){try{let Z=await fetch(`${tK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(X26)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=kq0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||JG1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function $G($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function G26($,Z){let Q=mc($),Y=Z?.brand?.trim()||JG1(Q),X=wr$(Q,128),G=`${(M0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=Er$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${$G(W)}</title>`,`<meta name="description" content="${$G(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${$G(W)}" />`,`<meta property="og:description" content="${$G(K)}" />`,`<meta property="og:url" content="${$G(G)}" />`,`<meta property="og:image" content="${$G(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${$G(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${$G(W)}" />`,`<meta name="twitter:description" content="${$G(K)}" />`,`<meta name="twitter:image" content="${$G(H)}" />`,`<meta name="twitter:image:alt" content="${$G(F)}" />`,`<link rel="canonical" href="${$G(G)}" />`,`<link rel="icon" href="${$G(X)}" sizes="any" />`].join(`
     `)}function W26($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Ar$($){let Z=new $1;return Z.get("/:domain/og.png",async(Q)=>{let Y=mc(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(Pr$($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${tK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(K26)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?Pr$($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await J26(mc(Y)),K=G26(Y,W);return Q.html(W26(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var X26=2500,K26=1e4;var Tr$=D(()=>{g$();GG1();qj();E$()});function i00($,Z){return fetch(`${tK({})}${$}`,Z)}async function H26($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",J=await i00(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(J.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!J.ok)throw Error(`report read HTTP ${J.status}`);let G=await J.json(),{deck:W,drops:K}=kq0(G);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:G.scanned_at,drops:K}}var F26,mN,Rr$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},qr$;var Ir$=D(()=>{g$();zJ();qj();GG1();F26=new Set(["complete","errored","terminated","unknown"]),mN=new $1;mN.use("*",async($,Z)=>{let Q=await Q8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});mN.use("/link-token/*",Rr$);mN.use("/suggest",Rr$);mN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let J=await H26(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!J.deck)return $.json(J);return $.json({...J,deck:{...J.deck,slides:J.deck.slides.slice(0,1)},truncated:J.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});mN.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,J=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let G=await i00("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Rj({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:J})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});mN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await i00(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${Rj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:F26.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});mN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await i00(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});mN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await i00(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});qr$=mN});import{createHmac as U26,timingSafeEqual as N26}from"crypto";function kr$($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>B26)return!1;let W=U26("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&N26(K,F)})}function Vr$($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=T3(Z),Y=T3(T3(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:wF(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function Sr$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function wF($){return typeof $==="string"?$:void 0}function T3($){return typeof $==="object"&&$!==null?$:void 0}function Vq0($){return typeof $==="number"?new Date($*1000):null}function HG1($){return wF($)??wF(T3($)?.id)}function O26($){return HG1($.subscription)??wF(T3(T3($.parent)?.subscription_details)?.subscription)}function D26($){let Z=Vq0($.current_period_end);if(Z)return Z;let Q=T3($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=T3(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function WG1($,Z){let Q=Vq0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function KG1($,Z){let Q=Vq0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function L26($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=wF(T3(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(wF(T3(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(wF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let G=wF(Q.id);if(!G)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let W=Number(T3(Q.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:T3(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:W,referenceId:`stripe-topup:${G}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(wF(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.getBilling(Y);if(!X)return{handled:!1,reason:"unknown org"};let J=HG1(Q.subscription);if(X.stripeSubscriptionId&&J&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};if(WG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y,{stripeCustomerId:HG1(Q.customer),stripeSubscriptionId:J,status:"active",lastStripeEventAt:KG1(Z,X)}),{handled:!0,organizationId:Y}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=wF(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&WG1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":Sr$(Q.status);return await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:D26(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:KG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}case"invoice.paid":{let Y=O26(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(WG1(Z,X))return{handled:!1,reason:"stale event"};return await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:Vq0(Q.period_end),lastStripeEventAt:KG1(Z,X)}),{handled:!0,organizationId:X.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function w26($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Sr$(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function Mr$($,Z){let Q=w26($,Z);if(!Q)return;NJ({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:va1(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function Cr$($){let Z=new mK(Z8().db),Q=await L26(Z,$);if(!(Q.handled&&Q.topUp))Mr$($,Q);if(Q.handled&&Q.topUp)await aT$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),Mr$($,Q);if(!Q.handled&&Q.orphanSubscriptionId)try{await r4$(Q.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:Q.orphanSubscriptionId,eventId:$.id})}catch(Y){if(!(Y instanceof PJ&&(Y.status===400||Y.status===404)))throw Y}return Q}var B26=300;var _r$=D(()=>{bG();V4();eZ0();tj();Z61()});var E26=1048576,FG1;var vr$=D(()=>{g$();XK();E$();_r$();FG1=new $1;FG1.post("/webhook",v5({maxSize:E26,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=M0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!kr$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=Vr$(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await Cr$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as j26}from"crypto";function A26($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return j26(Buffer.from(X),Buffer.from(Y))}function T26($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function fr$($){let Z=new $1;return Z.post("/webhook",v5({maxSize:z26,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!A26(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!P26.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await Mr0())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=T26(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await R26($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function R26($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await VD$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var z26=5242880,P26;var br$=D(()=>{g$();XK();RW();IZ();P26=new Set(["check_suite","issue_comment"])});function xr$($){let Z=new _N($.db,new XY($.encryptionKey)),Q=new $1;return Q.get("/attachments/:token",async(Y)=>{let X=oB$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new gJ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var yr$=D(()=>{g$();bB();ua0();Wv()});function gr$($){let Z=new _N($.db,new XY($.encryptionKey));async function Q(X,J){let G=Cx$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await _H($.db,W.organizationId);if(!K)return;if(await BT0(K,W,G)==="started")console.log(`[jira-webhook] started a run for ${G.issueKey} entering "${G.toStatus}"`)}let Y=new $1;return Y.post("/webhook/:secret",v5({maxSize:q26}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var q26=1048576;var hr$=D(()=>{g$();XK();bB();OT0();Fu()});import{DBOS as Sq0,SchedulerMode as I26}from"@dbos-inc/dbos-sdk";function lr$($){NG1=$}function cr$(){if(!NG1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return NG1}function dr$(){let $=cr$();return new _N($.db,new XY($.encryptionKey))}async function V26($,Z){try{let Q=await dr$().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await _H(cr$().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let J=new gJ(Q.siteUrl,Q.email,Q.apiToken),W=`(${await J.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${ur$}m"`,K=0,H;for(let F=0;F<k26;F++){let U=await J.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=_x$(N,N.changelog?.histories??[],Z);for(let O of B)if(await BT0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function S26($,Z){let Q=new Date($.getTime()-ur$*60000),Y=await Sq0.runStep(()=>dr$().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((J)=>Sq0.runStep(()=>V26(J,Q),{name:`sweepJira:${J}`})));for(let J of X)if(J.error)console.warn(`[jira-trigger] integration ${J.integrationId} failed: ${J.error}`);else if(J.started>0)console.log(`[jira-trigger] integration ${J.integrationId} started ${J.started} run(s) the webhook missed`)}function mr$(){if(UG1)return;UG1=Sq0.registerWorkflow(S26,{name:"jiraTriggerSweepWorkflow"}),Sq0.registerScheduled(UG1,{name:"jiraTriggerSweepWorkflow",crontab:M26,mode:I26.ExactlyOncePerIntervalWhenActive})}var M26="7-59/10 * * * *",ur$=15,k26=5,NG1=null,UG1=null;var ir$=D(()=>{bB();Fu();Wv();OT0()});function pr$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var nr$,C26,_26,tr$;var or$=D(()=>{g$();JW();Ou();vj();nr$=new $1,C26=["range","if-none-match","if-modified-since"],_26=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];nr$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Uc($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Y$(401,{message:"Authentication required"})}if(!Q)throw new Y$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new Y$(400,{message:"Missing file key"});let X=await br(Y,Z);if(!X)throw new Y$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&$X()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Y$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return pr$(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of C26){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new Y$(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new Y$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of _26){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),pr$(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});tr$=nr$});var p00=_((Jb)=>{var v26=Jb&&Jb.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),f26=Jb&&Jb.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))v26(Z,$,Q)};Object.defineProperty(Jb,"__esModule",{value:!0});f26(oX(),Jb)});var ar$=_((rr$)=>{Object.defineProperty(rr$,"__esModule",{value:!0});rr$.version=void 0;rr$.version="3.4.0"});var Zs$=_((EF)=>{var b26=EF&&EF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(EF,"__esModule",{value:!0});EF.NodeTransport=EF.VERSION=void 0;EF.nodeResolveHost=l26;var W5=p00(),x26=z0("net"),BG1=z0("tls"),y26=z0("path"),er$=z0("fs"),g26=b26(z0("dns")),h26=ar$();EF.VERSION=h26.version;var u26="nats.js";class $s${socket;version;lang;yields=[];signal=(0,W5.deferred)();closedNotification=(0,W5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=u26,this.version=EF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,W5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw W5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new W5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new W5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,W5.deferred)(),Q,Y=(0,x26.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,W5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=W5.DataBuffer.concat(...this.yields),X=(0,W5.extractProtocolMessage)(Y);if(X!=="")try{let J=W5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,W5.deferred)();try{if($=(0,y26.resolve)($),!(0,er$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,er$.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,W5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,W5.deferred)();try{let X=(0,BG1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new W5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,W5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,W5.deferred)();try{let Y=(0,BG1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new W5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,W5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,W5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof BG1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,W5.render)($)}`);let Z=(0,W5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,W5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}EF.NodeTransport=$s$;function l26($){let Z=(0,W5.deferred)();return g26.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var Gs$=_((Js$)=>{Object.defineProperty(Js$,"__esModule",{value:!0});Js$.connect=c26;var Qs$=Zs$(),Ys$=p00(),Xs$=p00();function c26($={}){if((0,Xs$.hasWsProtocol)($))return Promise.reject(Xs$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Ys$.setTransportFactory)({factory:()=>{return new Qs$.NodeTransport},dnsResolveFn:Qs$.nodeResolveHost}),Ys$.NatsConnectionImpl.connect($)}});var Ws$=_((iN)=>{var m26=iN&&iN.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),i26=iN&&iN.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))m26(Z,$,Q)};Object.defineProperty(iN,"__esModule",{value:!0});iN.connect=void 0;var p26=Gs$();Object.defineProperty(iN,"connect",{enumerable:!0,get:function(){return p26.connect}});i26(p00(),iN)});function Us$($){let Z=$?.connectFn??r26,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:o26,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(t26,n26,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?Ks$.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=Fs$.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function r26($){return Hs$.connect($)}var Ks$,Hs$,Fs$,n26=100,t26=3000,o26=3000;var Ns$=D(()=>{G8();Ks$=V(Dd(),1),Hs$=V(Ws$(),1),Fs$=V(kF(),1)});function OG1($,Z){return`${$}.${Z}`}class DG1{cache;constructor($){this.cache=$c({ttlMs:$?.ttlMs??s26,maxSize:$?.maxSize??a26})}async get($,Z){return this.cache.get(OG1($,Z))??null}async set($,Z,Q){this.cache.set(OG1($,Z),Q)}async invalidate($,Z){this.cache.delete(OG1($,Z))}teardown(){this.cache.clear()}}var s26=600000,a26=5000;var Bs$=()=>{};function Cq0($,Z){return`${$}:${Z}`}function LG1($){let Z=$c({ttlMs:$?.ttlMs??e26,maxSize:$?.maxSize??$T6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(Os$,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(Cq0(K,H))},set(K,H,F){Z.set(Cq0(K,H),F)},invalidate(K,H){Z.delete(Cq0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(Os$),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(Cq0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var Os$="studio.ai-provider-keys.invalidate",e26=30000,$T6=5000;var Ds$=()=>{};class wG1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var Ls$=($)=>{let Z;return()=>Z??=$()},EG1,jG1;var ws$=D(()=>{X6();EG1=Ls$(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),jG1=Ls$(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function WT6($=zs$){return{name:hH,subjects:[`${F11}.>`],storage:WK.StorageType.File,max_age:YT6,max_bytes:JT6,max_msgs_per_subject:GT6,discard:WK.DiscardPolicy.Old,retention:WK.RetentionPolicy.Limits,duplicate_window:XT6,num_replicas:$}}class Ps${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Es$($){let Z=js$.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function UT6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,QT6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function NT6($,Z){return $.info?.cluster?Z:1}function BT6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class zG1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=WT6(X);try{await Y.streams.info(hH),await Y.streams.update(hH,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(hH,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(hH),await Y.streams.add(J);else throw G}},Q=await b8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await WK.jetstreamManager($),X=NT6($,zs$);try{await Z(Y,X)}catch(J){if(X<=1||!BT6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:qu});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=UT6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=uj$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=N11(H,{runId:Z}),N=performance.now()-F;EG1().record(N),jG1().add(1,{"org.id":Y??"unknown"}),FT6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?Es$(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),HT6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await b8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:Es$(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:qu}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=N11(Z,{runId:$,dedup:Q});EG1().record(performance.now()-X),jG1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=hj$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?WK.DeliverPolicy.New:WK.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=OL($),W;try{W=await b8(async()=>{return(await Y.consumers.get(hH,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:qu})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=sj0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(nj0()).pipeThrough(tj0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){O(),L.close();return}let j=E;if(j.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(hH,{filter:OL($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var WK,js$,ZT6=($)=>{let Z;return()=>Z??=$()},QT6,YT6=86400000000000,XT6=120000000000,JT6=4294967296,zs$,GT6=500000,KT6,HT6,FT6;var As$=D(()=>{G8();B11();aj0();oj0();X6();ws$();WK=V(kF(),1),js$=V(Dd(),1),QT6=ZT6(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),zs$=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);KT6=process.env.STREAM_ENCODE_TRACE==="1",HT6=process.env.DECOPILOT_STREAM_TRACE==="1";FT6=KT6?new Ps$:null});function _q0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,MK(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var Ts$=D(()=>{V8()});class PG1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function OT6($,Z){let Q=$.startsWith("thread:")?qW($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function Rs$($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await jH($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await Ch($,{threadId:X,runBranch:G?.branch}),K=OT6(W,await Fw0($,X)),H=await rt($,Q,Zt0(J)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await eG(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var qs$=D(()=>{sZ();nG();IZ()});async function Is$($,Z,Q){let Y=Z.organizationId;if(!RX(Z))return!1;if(!Bv(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=GH(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await S6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),H8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var Ms$=D(()=>{j4();VQ();Ku();bW();X9()});function PT6($){return $ instanceof wY}function AT6($,Z){return Z-$>=jT6}class AG1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??DT6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??wT6,Q=this.options.itemIntervalMs??LT6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-fa0),pe0);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-zT6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await de0(this.taskBoard,X,Y),await me0(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==A$.progress||G.assigneeId!==n$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await xW(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),PT6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+ET6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==A$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),H8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!AT6(kU(Q,Z.reviewCycleStartedAt),Date.now()))return;await SH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!RX(Y))return!1;let X=Y.assigneeId===n$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await Rs$(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Uu(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Is$(G,Y,W))return!0;if(await Sz$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!he0(W))return!1;return await Yj0(G,Y,{previewMatchesHead:ue0(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await GL($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var DT6=60000,LT6=300000,wT6=50,ET6=60000,jT6=900000,zT6=120000;var ks$=D(()=>{j4();Me0();qs$();CH();Zs();bW();Ms$();X9();cG();ne0();IZ();Cr();Hu()});import{readdir as TT6,rm as vq0}from"fs/promises";import{join as fq0}from"path";async function bq0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-RT6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Gb($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await Vs$($,X,Z);else if(!X.startsWith(".")){let J=fq0($,X),G=await Gb(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await Vs$(J,K,Z)}if((await Gb(J)).length===0)await vq0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function Vs$($,Z,Q){let Y=0,X=fq0($,Z),J=await Gb(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=fq0(X,W),H=await Gb(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=fq0(K,U);await vq0(B,{recursive:!0,force:!0}),Y++}}if((await Gb(K)).length===0)await vq0(K,{recursive:!0,force:!0})}if((await Gb(X)).length===0)await vq0(X,{recursive:!0,force:!0});return Y}async function Gb($){try{return(await TT6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var RT6=30;var TG1=()=>{};import{DBOS as RG1,SchedulerMode as qT6}from"@dbos-inc/dbos-sdk";async function MT6(){let $=[R3(),Wb(),PF()],Z=0;for(let Q of $)try{Z+=await bq0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function kT6($,Z){await RG1.runStep(()=>MT6(),{name:"monitoringRetention"})}function Cs$(){if(Ss$)return;Ss$=!0;let $=RG1.registerWorkflow(kT6,{name:"monitoringRetentionWorkflow"});RG1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:IT6,mode:qT6.ExactlyOncePerIntervalWhenActive})}var IT6="23 4 * * *",Ss$=!1;var _s$=D(()=>{GG();TG1()});function vs$($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await v7.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await gj($.db,Z,Y.role);return X.boundAuth=UY1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new LE(Q,void 0,X.boundAuth,Y.role,"self"),WL(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var fs$=D(()=>{JU();ZH()});function VT6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function ST6(){return{services:VT6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function _T6(){for(let $ of CT6)$()}function bs$($){let Z=[...qG1.logs,$];qG1={...qG1,logs:Z.length>500?Z.slice(-500):Z},_T6()}function IG1(){return vT6}var qG1,CT6,vT6=!1;var MG1=D(()=>{qG1=ST6(),CT6=new Set});import{EventEmitter as fT6}from"events";var kG1;var xs$=D(()=>{MG1();kG1=new fT6;kG1.on("request",($)=>{bs$($)})});function ys$(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=ic(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((E)=>ic(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${w5.tool}${B}${w5.dim}(${w})${w5.reset}`}else if(N.method)J=`${w5.dim}${ic(N.method)}${w5.reset}`}}catch{}}let W=ic(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${w5.mcp}${ic(F.slice(0,12))}\u2026${w5.reset}`}else if(X==="/mcp")W=`${w5.mcp}/mcp${w5.reset}`;else if(X==="/mcp/registry")W=`${w5.mcp}/mcp/registry${w5.reset}`;let K=xT6(Y),H=G?"\u25C0":"\u2190";if(!IG1())console.log(`${w5.dim}${H}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=bT6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!IG1())console.log(`${w5.dim}${O}${w5.reset} ${K}${Y}${w5.reset} ${W}${J?` ${J}`:""} ${N}${U}${w5.reset} ${w5.duration}${B}${w5.reset}`);kG1.emit("request",{method:Y,path:ic(X),status:U,duration:F,timestamp:new Date})}}}var w5,bT6=($)=>{if($>=500)return w5.serverError;if($>=400)return w5.clientError;if($>=300)return w5.redirect;return w5.ok},xT6=($)=>{return w5[$]||w5.reset},ic=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var gs$=D(()=>{MG1();xs$();w5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as cs$}from"crypto";import{mkdir as yT6,readdir as gT6,rm as hs$,stat as ds$}from"fs/promises";import{join as SG1,relative as hT6}from"path";import{z as k$}from"zod";function is$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return SG1(uT6,Z)}function ps$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function VG1($,Z){let Q=is$($),Y=ps$(Z);return SG1(Q,Y)}function lT6($,Z,Q,Y){let X=M0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return cs$("sha256",X).update(J).digest("hex")}function ls$($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=lT6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${ps$(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function ns$($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${cs$("md5","etag").update(Y).digest("hex")}"`}async function ts$($,Z,Q,Y,X){try{let J=await gT6($,{withFileTypes:!0});for(let G of J){let W=SG1($,G.name),H=hT6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await ts$(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await ds$(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:ns$(W,F.mtime,F.size)})}catch{}}}}catch{}}function os$($,Z){let Y=p($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:k$.object({prefix:k$.string().optional(),maxKeys:k$.number().optional().default(1000),continuationToken:k$.string().optional(),delimiter:k$.string().optional()}),outputSchema:k$.object({objects:k$.array(k$.object({key:k$.string(),size:k$.number(),lastModified:k$.string(),etag:k$.string()})),nextContinuationToken:k$.string().optional(),isTruncated:k$.boolean(),commonPrefixes:k$.array(k$.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=is$(Y);await yT6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await ts$(F,F,G,K,U),U.objects.sort((w,E)=>w.key.localeCompare(E.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({contentType:k$.string().optional(),contentLength:k$.number(),lastModified:k$.string(),etag:k$.string(),metadata:k$.record(k$.string(),k$.string()).optional()}),handler:async(X)=>{let J=X,G=VG1(Y,J.key),W=await ds$(G);return{contentType:YX1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:ns$(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??us$;return{url:ls$(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:k$.object({key:k$.string(),expiresIn:k$.number().optional(),contentType:k$.string().optional()}),outputSchema:k$.object({url:k$.string(),expiresIn:k$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??us$;return{url:ls$(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:k$.object({key:k$.string()}),outputSchema:k$.object({success:k$.boolean(),key:k$.string()}),handler:async(X)=>{let J=X,G=VG1(Y,J.key);try{return await hs$(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:k$.object({keys:k$.array(k$.string()).max(1000)}),outputSchema:k$.object({deleted:k$.array(k$.string()),errors:k$.array(k$.object({key:k$.string(),message:k$.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=VG1(Y,K);try{await hs$(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function CG1($,Z,Q){let Y=os$(Z,Q),X=new bK({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:T5});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:k$.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:k$.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new MY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),W3(X,J,$,"mcp:dev-assets")}async function rs$($,Z,Q,Y){let J=os$(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var uT6="./data/assets",us$=3600,ms$,ss$;var as$=D(()=>{E$();Su();g$();ui();lv();HQ();MR0();ms$=new $1;ms$.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return CG1($.req.raw,Z,Y)});ss$=ms$});var es$={};T4(es$,{mountDevRoutes:()=>cT6});function cT6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return CG1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await rs$(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ss$);let Q=new $1;Q.use("*",JK({mountPath:"/api/dev-assets"})),Q.route("/",IR0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var $a$=D(()=>{g$();rY1();MR0();as$()});import{sql as dT6}from"kysely";import{randomUUID as Za$}from"crypto";import{z as mT6}from"zod";async function pT6($){let Z=new Date().toISOString(),Q=Za$(),Y=h8.SELF($.organizationId),X="registry.publish_request.created",J={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(J),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let G=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(G.length>0)await $.db.insertInto("event_deliveries").values(G.map((W)=>({id:Za$(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await dT6`SELECT
       pg_notify('studio_events', ${Q}),