npm - decocms - Versions diffs - 4.371.0 → 4.371.1 - Mend

decocms 4.371.0 → 4.371.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (370) hide show

package/dist/server/server.js CHANGED Viewed

@@ -3270,7 +3270,7 @@ ${Z}`}:Y)}}var Ci$=O(()=>{A9()});async function lN6($,Z,Q){if(!$)return!1;let Y=
         AND date >= {since:Date} AND date <= {until:Date}
       GROUP BY ${Y}
       ORDER BY pageviews DESC
-      LIMIT 50`,{slug:$,since:Z,until:Q})).map((J)=>({key:J.key,pageviews:Number(J.pageviews),visitors:Number(J.visitors)}))}async function Dt$($){let{since:Z,until:Q}=Ot$(90),Y=await Lt$($,Z,Q);return[...new Set(Y.map(Zc))]}async function WM0($){let Z=$.get("studioContext");if(!uE(Z))return $.json({error:"Unauthorized"},401);let Q=i(Z),Y=$.req.param("site");if(!Y)return $.json({error:"site is required"},400);let X=Y.toLowerCase();if(!await Z.storage.orgSites.isOwnedBy(X,Q.id))return $.json({error:"Site not found in organization"},404);if(!await sG(Z,Q.id,"monitoring"))return $.json({error:"This organization's plan does not include monitoring",code:"feature_not_in_plan"},403);return{slug:X}}var fO6,bO6,Nt$,p3="site_id IN (SELECT id FROM default.dim_sites WHERE name = {slug:String})",dO6,pO6="https://deco.lilstts.com/plausible",nO6=12000,tO6,wt$=()=>{let $=new e0;return $.get("/:site/cdn/data",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;if(!tN())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!fO6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=wG1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J,H=Bt$(Z.req.query("filters"));try{let F;switch(Y){case"summary":F=await yO6(G,W,K,H);break;case"timeline":F=await gO6(G,W,K,J.granularity,H);break;case"cache-status":F=await hO6(G,W,K,H);break;case"status-codes":F=await uO6(G,W,K,H);break;case"top-paths":F=await lO6(G,W,K,Z.req.query("groupByPath")==="1",H);break;case"top-countries":F=await cO6(G,W,K,H);break}return Z.json({available:!0,view:Y,range:X,data:F})}catch(F){return console.error(`[monitor] cdn ${Y} query failed for site="${G}":`,F),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/audience/data",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;if(!tN())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!dO6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=wG1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J;try{let H;switch(Y){case"summary":H=await mO6(G,W,K);break;case"timeline":H=await iO6(G,W,K);break;case"top-sources":H=await jG1(G,W,K,"utm_source");break;case"top-countries":H=await jG1(G,W,K,"country");break;case"devices":H=await jG1(G,W,K,"device_type");break}return Z.json({available:!0,view:Y,range:X,data:H})}catch(H){return console.error(`[monitor] audience ${Y} query failed for site="${G}":`,H),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/hosts",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q;if(!tN())return Z.json({available:!1,hosts:[]});try{let X=await Dt$(Y);return Z.json({available:!0,hosts:X})}catch(X){return console.error(`[monitor] hosts failed for site="${Y}":`,X),Z.json({available:!0,hosts:[]})}}),$.get("/:site/onedollar",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q,X=O0().oneDollarStatsApiKey;if(!X)return Z.json({available:!1,error:"OneDollarStats not configured"});let J=Z.req.query("report")??"kpis",G=tO6[J];if(!G)return Z.json({error:`unknown report: ${J}`},400);let W=Z.req.query("range")??"7d",K=wG1(W,Z.req.query("since"),Z.req.query("until"));if(!K)return Z.json({error:`unknown range: ${W}`},400);let H=await Dt$(Y),F=Z.req.query("host"),U=F&&H.includes(F)?F:H[0];if(!U)return Z.json({available:!0,report:J,range:W,results:[]});let{since:N,until:B}=K,D=J==="timeseries"?K.granularity==="hourly"?"time:hour":"time:day":G.dimension,L={page:"event:page",source:"visit:referrer",referrer:"visit:referrer",country:"visit:country",browser:"visit:browser",os:"visit:os",device:"visit:device",utm_campaign:"visit:utm_campaign",utm_source:"visit:utm_source",utm_medium:"visit:utm_medium",utm_content:"visit:utm_content",utm_term:"visit:utm_term"},w={equals:"is",not_equals:"is_not",contains:"contains",not_contains:"contains_not"},j=Bt$(Z.req.query("filters")).map((z)=>{let P=L[z.field],A=w[z.op];return P&&A?[A,P,[z.value]]:null}).filter(Boolean),E=async(z)=>{let P=await fetch(pO6,{method:"POST",headers:{"Content-Type":"application/json","x-api-key":X,Accept:"application/json"},body:JSON.stringify({site_id:U,metrics:G.metrics,date_range:z,...D?{dimensions:[D]}:{},...G.order?{order_by:[[G.order,"desc"]]}:{},...j.length?{filters:j}:{},pagination:{limit:100,offset:0}}),signal:AbortSignal.timeout(nO6)});if(!P.ok)throw Error(`OneDollarStats ${P.status}`);return(await P.json().catch(()=>null))?.results??[]};try{let z=await E([N,B]),P;if(J==="kpis"||J==="timeseries"&&Z.req.query("compare")==="1"){let q=Date.parse(`${N}T00:00:00Z`),k=86400000,M=KM0(new Date(q-86400000)),S=KM0(new Date(q-K.days*86400000));P=await E([S,M]).catch(()=>{return})}return Z.json({available:!0,report:J,range:W,host:U,metrics:G.metrics,results:z,...P?{previous:P}:{}})}catch(z){return console.error(`[monitor] onedollar ${J} failed for host="${U}":`,z),Z.json({error:"Failed to reach OneDollarStats"},502)}}),$};var jt$=O(()=>{y$();t1();jH();fA0();bA0();fO6=new Set(["summary","timeline","cache-status","status-codes","top-paths","top-countries"]),bO6={today:{days:1,granularity:"hourly"},yesterday:{days:1,granularity:"hourly",endOffsetDays:1},"7d":{days:7,granularity:"daily"},"14d":{days:14,granularity:"daily"},"30d":{days:30,granularity:"daily"},"90d":{days:90,granularity:"daily"},"180d":{days:180,granularity:"daily"},"1y":{days:365,granularity:"daily"}};Nt$=/^\d{4}-\d{2}-\d{2}$/;dO6=new Set(["summary","timeline","top-sources","top-countries","devices"]);tO6={kpis:{metrics:["visitors","visits","pageviews","bounce_rate","visit_duration"]},timeseries:{metrics:["pageviews","visits","visitors","bounce_rate","visit_duration"]},pages:{metrics:["pageviews","visitors"],dimension:"event:page",order:"pageviews"},sources:{metrics:["visitors"],dimension:"visit:referrer",order:"visitors"},countries:{metrics:["visitors"],dimension:"visit:country",order:"visitors"},browsers:{metrics:["visitors"],dimension:"visit:browser",order:"visitors"},os:{metrics:["visitors"],dimension:"visit:os",order:"visitors"},devices:{metrics:["visitors"],dimension:"visit:device",order:"visitors"},events:{metrics:["visitors","events"],dimension:"event:name",order:"events"},utm_campaign:{metrics:["visitors","events"],dimension:"visit:utm_campaign",order:"events"},utm_source:{metrics:["visitors","events"],dimension:"visit:utm_source",order:"events"},utm_medium:{metrics:["visitors","events"],dimension:"visit:utm_medium",order:"events"},utm_content:{metrics:["visitors","events"],dimension:"visit:utm_content",order:"events"},utm_term:{metrics:["visitors","events"],dimension:"visit:utm_term",order:"events"}}});import{timingSafeEqual as oO6}from"crypto";function uF($){let Q=$?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();return Q?Q:null}function j10($,Z){let Q=Buffer.from($),Y=Buffer.from(Z);return Q.length===Y.length&&oO6(Q,Y)}function hw($){let Z=process.env.VAULT_SERVICE_TOKEN;return!!Z&&j10($,Z)}function Et$($){if(!$)return null;return $ instanceof Date?$.toISOString():$}function rO6($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>typeof Z==="string");if(typeof $!=="string")return[];try{let Z=JSON.parse($);return Array.isArray(Z)?Z.filter((Q)=>typeof Q==="string"):[]}catch{return[]}}async function zt$($,Z,Q){let Y=uF($.req.header("authorization"));if(!Y)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let X=$.get("studioContext"),J=X.organization?.id;if(!J)return{ok:!1,response:$.json({error:"Organization context required"},403)};if(hw(Y))return{ok:!0,ctx:X,organizationId:J};let G=await X.storage.connectionCredentialVault.authenticateWorkloadToken(Y);if(!G||G.organizationId!==J)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let W=await X.storage.connections.findById(G.subjectConnectionId,J);if(!W||W.status!=="active")return{ok:!1,response:$.json({error:"Unauthorized"},401)};if(!await X.storage.connectionCredentialVault.hasGrant({organizationId:J,subjectConnectionId:G.subjectConnectionId,targetConnectionId:Z,scope:Q}))return{ok:!1,response:$.json({error:"Forbidden"},403)};return{ok:!0,ctx:X,organizationId:J}}var Pt$=()=>{let $=new e0;return $.post("/vault/connections/batch",async(Z)=>{let Q=uF(Z.req.header("authorization"));if(!Q||!hw(Q))return Z.json({error:"Unauthorized"},401);let Y=Z.get("studioContext"),X=Y.organization?.id;if(!X)return Z.json({error:"Organization context required"},403);let J=await Z.req.json().catch(()=>null),G=Array.isArray(J?.connectionIds)?[...new Set(J.connectionIds)].filter((B)=>typeof B==="string"&&B.length>0):[];if(G.length===0||G.length>20)return Z.json({error:"connectionIds must be a non-empty string array (max 20)"},400);let{items:W}=await Y.storage.connections.list(X,{includeVirtual:!0,where:{field:["id"],operator:"in",value:G},limit:G.length}),K=new Map(W.map((B)=>[B.id,B])),H=new Set((await Y.db.selectFrom("downstream_tokens").select("connectionId").where("connectionId","in",G).execute()).map((B)=>B.connectionId)),F=new Map((await Y.db.selectFrom("connections").select(["id","configuration_state","connection_token"]).where("id","in",G).where("organization_id","=",X).execute()).map((B)=>[B.id,B])),U=new b5(Y.db,Y.vault),N={};return await Promise.all(G.map(async(B)=>{try{let D=K.get(B);if(!D||D.status!=="active"){N[B]={error:"Connection not found"};return}if(F.get(B)?.configuration_state&&!D.configuration_state){N[B]={error:"MCP configuration could not be decrypted"};return}let L={type:"mcp_configuration",state:D.configuration_state??{},scopes:D.configuration_scopes??[]},w=null;if(H.has(B)){let j=await aJ({connectionId:B,connectionUrl:D.connection_url,tokenStorage:U});if(j.state==="valid"||j.state==="refreshed"){let E=await U.get(B);w={type:"oauth_access_token",tokenType:"Bearer",accessToken:j.accessToken,expiresAt:Et$(E?.expiresAt??null),scope:E?.scope??null}}}else if(D.connection_token)w={type:"static_token",tokenType:"Bearer",accessToken:D.connection_token,expiresAt:null,scope:null};else if(F.get(B)?.connection_token){N[B]={error:"Connection token could not be decrypted"};return}N[B]={configuration:L,accessToken:w}}catch(D){N[B]={error:D instanceof Error?D.message:String(D)}}})),Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json(N)}),$.post("/vault/connections/:connectionId/access-token",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await zt$(Z,Q,MQ0);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.storage.connections.findById(Q,J);if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W=new b5(X.db,X.vault),K=await aJ({connectionId:Q,connectionUrl:G.connection_url,tokenStorage:W});if(K.state==="missing"){if(G.connection_token)return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"static_token",tokenType:"Bearer",accessToken:G.connection_token,expiresAt:null,scope:null});if((await X.db.selectFrom("connections").select("connection_token").where("id","=",Q).where("organization_id","=",J).executeTakeFirst())?.connection_token)return Z.json({error:"Connection token could not be decrypted"},424);return Z.json({error:"Downstream token not found"},409)}if(K.state==="expired_without_refresh"||K.state==="refresh_failed")return Z.json({error:"Downstream token refresh failed"},424);let H=await W.get(Q);return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"oauth_access_token",tokenType:"Bearer",accessToken:K.accessToken,expiresAt:Et$(H?.expiresAt??null),scope:H?.scope??null})}),$.post("/vault/connections/:connectionId/configuration",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await zt$(Z,Q,IQ0);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.db.selectFrom("connections").select(["status","configuration_state","configuration_scopes"]).where("id","=",Q).where("organization_id","=",J).executeTakeFirst();if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W={};if(G.configuration_state)try{let K=await X.vault.decrypt(G.configuration_state),H=JSON.parse(K);if(typeof H!=="object"||H===null||Array.isArray(H))throw Error("MCP configuration state is not an object");W=H}catch{return Z.json({error:"MCP configuration could not be decrypted"},424)}return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"mcp_configuration",state:W,scopes:rO6(G.configuration_scopes)})}),$};var hb=O(()=>{y$();O3();VQ0();rW()});import{createHmac as sO6}from"crypto";import{mkdir as aO6,writeFile as eO6}from"fs/promises";import{dirname as $L6,join as Rt$}from"path";function QL6($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return Rt$(ZL6,Z)}function At$($,Z){let Q=QL6($),Y=fG(Z);return Rt$(Q,Y)}function Tt$($,Z,Q,Y,X){let J=O0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`,W=sO6("sha256",J).update(G).digest("hex");return j10(X,W)}function EG1($){let Z=$.split(".").pop()?.toLowerCase()||"";return{jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",bmp:"image/bmp",pdf:"application/pdf",json:"application/json",xml:"application/xml",txt:"text/plain",html:"text/html",htm:"text/html",css:"text/css",csv:"text/csv",md:"text/markdown",js:"application/javascript",mjs:"application/javascript",ts:"application/typescript",mp4:"video/mp4",webm:"video/webm",avi:"video/x-msvideo",mov:"video/quicktime",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf"}[Z]||"application/octet-stream"}var ZL6="./data/assets",HM0=($)=>{let Z=new e0,Q=$.orgFromPath?"/*":"/:orgId/*";return Z.get(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="GET")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!Tt$(X,G,F,"GET",K))return Y.json({error:"Invalid signature"},403);let N=At$(X,G);try{let B=Bun.file(N);if(!await B.exists())return Y.json({error:"File not found"},404);let L=EG1(G);return new Response(B.stream(),{headers:{"Content-Type":L,"Content-Length":B.size.toString(),"Cache-Control":"private, max-age=3600"}})}catch(B){return console.error("Error serving file:",B),Y.json({error:"Failed to read file"},500)}}),Z.put(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="PUT")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!Tt$(X,G,F,"PUT",K))return Y.json({error:"Invalid signature"},403);let N=At$(X,G),B=$L6(N);try{await aO6(B,{recursive:!0});let D=await Y.req.arrayBuffer();return await eO6(N,Buffer.from(D)),Y.json({success:!0,key:G})}catch(D){return console.error("Error saving file:",D),Y.json({error:"Failed to save file"},500)}}),Z};var FM0=O(()=>{y$();t1();FW();hb()});function qt$($,Z,Q){if(!["127.0.0.1","::1","::ffff:127.0.0.1"].includes($??""))return!1;try{let Y=new URL(Q);return["http:","https:"].includes(Y.protocol)&&["localhost","127.0.0.1","[::1]"].includes(Y.hostname)&&Z===Y.origin}catch{return!1}}function zG1($){let Z=new URL(YL6);if(Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("state",$.state),$.selectAccount)Z.searchParams.set("prompt","select_account");return Z.toString()}function XL6($,Z=200){let Q=$!==null&&typeof $==="object"?$:{};if(typeof Q.error==="string"){let Y=typeof Q.error_description==="string"?` (${Q.error_description})`:"";throw new f0({provider:"github",status:400,message:`GitHub OAuth code exchange failed: ${Q.error}${Y}`})}if(typeof Q.access_token!=="string"||Q.access_token.length===0)throw new f0({provider:"github",status:Z,message:"GitHub OAuth code exchange returned no access token"});return{accessToken:Q.access_token,refreshToken:typeof Q.refresh_token==="string"&&Q.refresh_token.length>0?Q.refresh_token:null,expiresIn:typeof Q.expires_in==="number"&&Number.isFinite(Q.expires_in)?Q.expires_in:null,scope:typeof Q.scope==="string"&&Q.scope.length>0?Q.scope:null,tokenEndpoint:Mt$}}async function It$($){let Z;try{let X=process.env.GITHUB_OAUTH_TOKEN_URL??Mt$;Z=await fetch(X,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json"},body:JSON.stringify({client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),signal:AbortSignal.timeout(Qa0)})}catch(X){throw new f0({provider:"github",status:0,message:`GitHub OAuth code exchange failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}let Q=await Z.text();if(!Z.ok)throw new f0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange failed: ${Z.status} ${Q.slice(0,300)}`});let Y;try{Y=JSON.parse(Q)}catch(X){throw new f0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange returned invalid JSON: ${Q.slice(0,300)}`,cause:X})}return XL6(Y,Z.status)}var YL6="https://github.com/login/oauth/authorize",Mt$="https://github.com/login/oauth/access_token";var Vt$=O(()=>{d6();TL()});function kt$($){let Z=new URL(`https://${zN}/site/oauth2/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.toString()}function JL6(){return`https://${zN}/site/oauth2/access_token`}async function St$($){let Z=JL6(),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(GL6)})}catch(J){throw new f0({provider:"bitbucket",status:0,message:`Bitbucket token exchange failed: ${WL6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new f0({provider:"bitbucket",status:Y.status,message:`Bitbucket token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new f0({provider:"bitbucket",status:Y.status,message:"Bitbucket token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scopes==="string"?X.scopes:null,tokenEndpoint:Z}}function WL6($){return $ instanceof Error?$.message:String($)}var GL6=15000;var Ct$=O(()=>{d6();lu()});function _t$($){let Z=new URL(`https://${$.host}/oauth/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.searchParams.set("scope",($.scopes??KL6).join(" ")),Z.toString()}function HL6($){return`https://${$}/oauth/token`}async function vt$($){let Z=HL6($.host),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(FL6)})}catch(J){throw new f0({provider:"gitlab",status:0,message:`GitLab token exchange failed: ${UL6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new f0({provider:"gitlab",status:Y.status,message:`GitLab token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new f0({provider:"gitlab",status:Y.status,message:"GitLab token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scope==="string"?X.scope:null,tokenEndpoint:Z}}function UL6($){return $ instanceof Error?$.message:String($)}var KL6,FL6=15000;var ft$=O(()=>{d6();KL6=["api","read_user"]});import{z as BB}from"zod";function E10($){if(!$)return"/";if(!$.startsWith("/")||$.startsWith("//")||$.includes("\\")||/[\r\n\t]/.test($))return"/";return $}function NL6($){if($.htmlUrl)return $.htmlUrl;return`https://github.com${$.accountType==="Organization"?`/organizations/${encodeURIComponent($.login)}/settings/installations/${$.installationId}`:`/settings/installations/${$.installationId}`}`}function ub($){return`${J5()}/api/_git/${$}/callback`}function GY($,Z){let Q=new URL($,J5());if(Q.searchParams.delete("git_error"),Z)Q.searchParams.set("git_error",Z);return Q.toString()}async function UM0($,Z){let Q=$.organization?.id,Y=$.auth.user?.id;if(!Q||!Y)throw Error("Session with an organization is required");return $.storage.gitProviderOAuthStates.create({organizationId:Q,userId:Y,...Z})}async function NM0($,Z,Q){if(!Q)return{ok:!1,error:"missing_state",returnTo:"/"};let Y=await $.storage.gitProviderOAuthStates.consume(Q);if(!Y||Y.provider!==Z)return{ok:!1,error:"invalid_state",returnTo:"/"};let X=E10(Y.returnTo);if($.auth.user?.id!==Y.userId)return{ok:!1,error:"session_mismatch",returnTo:X};return{ok:!0,state:Y,returnTo:X}}var bt$=()=>{let $=new e0;return $.post("/git-providers/github/cli/connect",async(Z)=>{if(!OP())return Z.json({error:"GitHub CLI requires local mode"},403);let Q;try{Q=F10(Z).remote.address}catch{}if(!qt$(Q,Z.req.header("Origin"),J5()))return Z.json({error:"GitHub CLI requires a local, same-origin request"},403);let Y=Z.get("studioContext");if(!Y.auth.user||!Y.organization)return Z.json({error:"Unauthorized"},401);try{await Y.access.check("GIT_ACCOUNT_CONNECT_TOKEN")}catch(G){if(G instanceof F7)return Z.json({error:"Forbidden"},403);throw G}if(Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let X;try{X=await JG$()}catch{return Z.json({error:"Could not connect to GitHub CLI. Install gh and run gh auth login --hostname github.com, then try again."},400)}let J=await Y.storage.gitProviderAccounts.upsert({organizationId:Y.organization.id,type:"github",host:"github.com",authKind:"github_cli",...X,createdBy:Y.auth.user.id});return Z.json({account:{id:J.id,login:J.login}})}),$.get("/git-providers/github/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=jL();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await UM0(Q,{provider:"github",host:"github.com",returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(zG1({clientId:Y.clientId,redirectUri:ub("github"),state:X,selectAccount:!0}))}),$.get("/git-providers/github/install",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=jL();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await UM0(Q,{provider:"github",host:"github.com",returnTo:E10(Z.req.query("returnTo"))}),J=new URL(`https://github.com/apps/${encodeURIComponent(Y.slug)}/installations/new`);return J.searchParams.set("state",X),Z.redirect(J.toString())}),$.get("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y={organizationId:Q.organization.id,userId:Q.auth.user.id},X=await Q.storage.githubConnectFlows.get(Z.req.param("id"),Y);if(!X)return Z.json({error:"flow_expired"},410);let J=QK();if(!J)return Z.json({error:"not_configured"},503);try{let G=await J.listConnectableInstallations(X.id,await Q.vault.decrypt(X.encrypted_access_token));return Z.json({installations:G.map((W)=>({installationId:W.installationId,login:W.login,avatarUrl:W.avatarUrl,accountType:W.accountType})),expiresAt:X.expires_at})}catch{return Z.json({error:"github_unavailable"},502)}}),$.get("/git-providers/github/flows/:id/repositories",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y=BB.object({installationId:BB.coerce.number().int().positive().safe(),page:BB.coerce.number().int().positive().safe().default(1),query:BB.string().trim().max(256).optional()}).safeParse(Z.req.query());if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=QK();if(!G)return Z.json({error:"not_configured"},503);try{let W=await Q.vault.decrypt(J.encrypted_access_token),K=await G.connectableInstallation(J.id,W,Y.data.installationId);if(!K)return Z.json({error:"installation_forbidden"},403);let H=await G.delegableRepositories(J.id,W,K.installationId),F=await Q.storage.gitProviderAccounts.findByExternalId({organizationId:X.organizationId,host:"github.com",externalAccountId:String(K.installationId)});return Z.json({...rJ$(H,Y.data.page,Y.data.query),accountVersion:KJ1(F)})}catch{return Z.json({error:"github_unavailable"},502)}}),$.post("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);if(await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let Y=BB.object({installationId:BB.number().int().positive().safe(),repositoryIds:BB.array(BB.number().int().positive().safe()).min(1).max(xJ0).refine((H)=>new Set(H).size===H.length),accountVersion:BB.string().max(200).nullable()}).safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=QK();if(!G)return Z.json({error:"not_configured"},503);let W,K;try{let H=await Q.vault.decrypt(J.encrypted_access_token);if(W=await G.connectableInstallation(J.id,H,Y.data.installationId,{fresh:!0}),!W)return Z.json({error:"installation_forbidden"},403);let F=await G.delegableRepositories(J.id,H,W.installationId,{fresh:!0});if(!sJ$(F,Y.data.repositoryIds))return Z.json({error:"repositories_forbidden"},403);K=await G.connectingUserId(H)}catch{return Z.json({error:"github_unavailable"},502)}try{let H=await Q.storage.githubConnectFlows.connect(J.id,X,{organizationId:X.organizationId,type:"github",host:"github.com",authKind:"github_app",externalAccountId:String(W.installationId),login:W.login,avatarUrl:W.avatarUrl,installationId:W.installationId,installationAuthorizedBy:K,installationRepositoryIds:Y.data.repositoryIds},Y.data.accountVersion);if(!H)return Z.json({error:"flow_expired"},410);return G.forgetFlow(J.id),Z.json({account:{id:H.id,login:H.login}})}catch(H){if(H instanceof Vq0)return Z.json({error:"account_changed"},409);throw H}}),$.delete("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);return await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),await Q.storage.githubConnectFlows.cancel(Z.req.param("id"),{organizationId:Q.organization.id,userId:Q.auth.user.id}),QK()?.forgetFlow(Z.req.param("id")),Z.body(null,204)}),$.get("/git-providers/github/accounts/:id/manage",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=await Q.storage.gitProviderAccounts.get(Z.req.param("id"),Q.organization.id);if(!Y||Y.type!=="github"||!Y.installationId)return Z.json({error:"Account not found"},404);let X=QK();if(!X)return Z.json({error:"not_configured"},503);let J=await X.getInstallation(Y.installationId);if(!J)return Z.json({error:"Installation not found"},404);return Z.redirect(NL6(J))}),$.get("/git-providers/gitlab/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=YG0(),X=(Z.req.query("host")??Y?.host??"gitlab.com").trim().toLowerCase();if(!Y||Y.host!==X)return Z.json({error:`No GitLab OAuth application is configured for ${X}. Connect with an access token instead.`},503);let J=await UM0(Q,{provider:"gitlab",host:X,returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(_t$({host:X,clientId:Y.clientId,redirectUri:ub("gitlab"),state:J}))}),$.get("/git-providers/bitbucket/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=lJ0();if(!Y)return Z.json({error:"No Bitbucket OAuth consumer is configured. Connect with an access token instead."},503);let X=await UM0(Q,{provider:"bitbucket",host:Y.host,returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(kt$({clientId:Y.clientId,redirectUri:ub("bitbucket"),state:X}))}),$},zd;var PG1=O(()=>{y$();mJ1();mH();OW();k5();yJ0();FJ1();Wa0();hJ0();Vt$();qL();lu();wP();Ct$();ft$();zd=new e0;zd.get("/github/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=jL(),G=QK(),W=$.req.query("code");if(!J||!G)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await It$({clientId:J.clientId,clientSecret:J.clientSecret,code:W,redirectUri:ub("github")}),H={organizationId:X.organizationId,userId:X.userId},F=new URL(Y,J5()),U=F.searchParams.get("git_flow"),N=await Z.vault.encrypt(K.accessToken),B=U&&await Z.storage.githubConnectFlows.refresh(U,H,N)?U:await Z.storage.githubConnectFlows.create(H,N);return F.searchParams.delete("git_error"),F.searchParams.set("git_flow",B),$.redirect(F.toString())}catch(K){return console.error("[git-providers] github callback failed",{message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}});zd.get("/github/setup",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=jL();if(!J)return $.redirect(GY(Y,"not_configured"));let G=await Z.storage.gitProviderOAuthStates.create(X);return $.redirect(zG1({clientId:J.clientId,redirectUri:ub("github"),state:G}))});zd.get("/gitlab/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"gitlab",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=YG0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await vt$({host:J,clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:ub("gitlab")}),H=await uJ0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"gitlab",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(GY(Y))}catch(K){return console.error("[git-providers] gitlab callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}});zd.get("/bitbucket/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"bitbucket",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=lJ0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await St$({clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:ub("bitbucket")}),H=await cJ0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"bitbucket",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(GY(Y))}catch(K){return console.error("[git-providers] bitbucket callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}})});var P10=_((jL6)=>{jL6.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(jL6.HttpAuthLocation||(jL6.HttpAuthLocation={}));jL6.HttpApiKeyAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(jL6.HttpApiKeyAuthLocation||(jL6.HttpApiKeyAuthLocation={}));jL6.EndpointURLScheme=void 0;(function($){$.HTTP="http",$.HTTPS="https"})(jL6.EndpointURLScheme||(jL6.EndpointURLScheme={}));jL6.AlgorithmId=void 0;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(jL6.AlgorithmId||(jL6.AlgorithmId={}));var BL6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>jL6.AlgorithmId.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>jL6.AlgorithmId.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},DL6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},OL6=($)=>{return BL6($)},LL6=($)=>{return DL6($)};jL6.FieldPosition=void 0;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(jL6.FieldPosition||(jL6.FieldPosition={}));var wL6="__smithy_context";jL6.IniSectionType=void 0;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(jL6.IniSectionType||(jL6.IniSectionType={}));jL6.RequestHandlerProtocol=void 0;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(jL6.RequestHandlerProtocol||(jL6.RequestHandlerProtocol={}));jL6.SMITHY_CONTEXT_KEY=wL6;jL6.getDefaultClientConfiguration=OL6;jL6.resolveDefaultRuntimeConfig=LL6});var mG1=_((sw6)=>{var CG1=A0("crypto"),VG1=A0("fs"),AL6=I10(),TL6=V10(),lF=A0("stream"),ct$=($)=>typeof ArrayBuffer==="function"&&$ instanceof ArrayBuffer||Object.prototype.toString.call($)==="[object ArrayBuffer]",Td=($,Z=0,Q=$.byteLength-Z)=>{if(!ct$($))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof $} (${$})`);return Buffer.from($,Z,Q)},LM0=($,Z)=>{if(typeof $!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof $} (${$})`);return Z?Buffer.from($,Z):Buffer.from($)},RL6=/^[A-Za-z0-9+/]*={0,2}$/,dt$=($)=>{if($.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!RL6.exec($))throw TypeError("Invalid base64 string.");let Z=LM0($,"base64");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength)},wM0=($)=>{let Z=LM0($,"utf8");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength/Uint8Array.BYTES_PER_ELEMENT)},xG1=($)=>{let Z;if(typeof $==="string")Z=wM0($);else Z=$;if(typeof Z!=="object"||typeof Z.byteOffset!=="number"||typeof Z.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return Td(Z.buffer,Z.byteOffset,Z.byteLength).toString("base64")};function qL6($,Z,Q,Y){return class X extends Uint8Array{static fromString(J,G="utf-8"){if(typeof J==="string"){if(G==="base64")return X.mutate(Y(J));return X.mutate(Z(J))}throw Error(`Unsupported conversion from ${typeof J} to Uint8ArrayBlobAdapter.`)}static mutate(J){return Object.setPrototypeOf(J,X.prototype),J}transformToString(J="utf-8"){if(J==="base64")return Q(this);return $(this)}}}var mt$=($)=>{if(typeof $==="string")return $;if(typeof $!=="object"||typeof $.byteOffset!=="number"||typeof $.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return Td($.buffer,$.byteOffset,$.byteLength).toString("utf8")},WY=Array.from({length:256},($,Z)=>Z.toString(16).padStart(2,"0"));function ML6($){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let Z=new Uint8Array(16);return $(Z),Z[6]=Z[6]&15|64,Z[8]=Z[8]&63|128,WY[Z[0]]+WY[Z[1]]+WY[Z[2]]+WY[Z[3]]+"-"+WY[Z[4]]+WY[Z[5]]+"-"+WY[Z[6]]+WY[Z[7]]+"-"+WY[Z[8]]+WY[Z[9]]+"-"+WY[Z[10]]+WY[Z[11]]+WY[Z[12]]+WY[Z[13]]+WY[Z[14]]+WY[Z[15]]}}var IL6=($,Z,Q=(Y)=>Y)=>$,VL6=($)=>{switch($){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${$}"`)}},kL6=($)=>{if($===null||$===void 0)return;if(typeof $==="number"){if($===0||$===1)M10.warn(DM0(`Expected boolean, got ${typeof $}: ${$}`));if($===0)return!1;if($===1)return!0}if(typeof $==="string"){let Z=$.toLowerCase();if(Z==="false"||Z==="true")M10.warn(DM0(`Expected boolean, got ${typeof $}: ${$}`));if(Z==="false")return!1;if(Z==="true")return!0}if(typeof $==="boolean")return $;throw TypeError(`Expected boolean, got ${typeof $}: ${$}`)},R10=($)=>{if($===null||$===void 0)return;if(typeof $==="string"){let Z=parseFloat($);if(!Number.isNaN(Z)){if(String(Z)!==String($))M10.warn(DM0(`Expected number but observed string: ${$}`));return Z}}if(typeof $==="number")return $;throw TypeError(`Expected number, got ${typeof $}: ${$}`)},SL6=Math.ceil(340282346638528860000000000000000000000),BM0=($)=>{let Z=R10($);if(Z!==void 0&&!Number.isNaN(Z)&&Z!==1/0&&Z!==-1/0){if(Math.abs(Z)>SL6)throw TypeError(`Expected 32-bit float, got ${$}`)}return Z},q10=($)=>{if($===null||$===void 0)return;if(Number.isInteger($)&&!Number.isNaN($))return $;throw TypeError(`Expected integer, got ${typeof $}: ${$}`)},CL6=q10,_G1=($)=>yG1($,32),vG1=($)=>yG1($,16),fG1=($)=>yG1($,8),yG1=($,Z)=>{let Q=q10($);if(Q!==void 0&&_L6(Q,Z)!==Q)throw TypeError(`Expected ${Z}-bit integer, got ${$}`);return Q},_L6=($,Z)=>{switch(Z){case 32:return Int32Array.of($)[0];case 16:return Int16Array.of($)[0];case 8:return Int8Array.of($)[0]}},vL6=($,Z)=>{if($===null||$===void 0){if(Z)throw TypeError(`Expected a non-null value for ${Z}`);throw TypeError("Expected a non-null value")}return $},it$=($)=>{if($===null||$===void 0)return;if(typeof $==="object"&&!Array.isArray($))return $;let Z=Array.isArray($)?"array":typeof $;throw TypeError(`Expected object, got ${Z}: ${$}`)},fL6=($)=>{if($===null||$===void 0)return;if(typeof $==="string")return $;if(["boolean","number","bigint"].includes(typeof $))return M10.warn(DM0(`Expected string, got ${typeof $}: ${$}`)),String($);throw TypeError(`Expected string, got ${typeof $}: ${$}`)},bL6=($)=>{if($===null||$===void 0)return;let Z=it$($),Q=[];for(let Y in Z)if(Z[Y]!=null)Q.push(Y);if(Q.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(Q.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${Q} were not null.`);return Z},gG1=($)=>{if(typeof $=="string")return R10(Md($));return R10($)},xL6=gG1,pt$=($)=>{if(typeof $=="string")return BM0(Md($));return BM0($)},yL6=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,Md=($)=>{let Z=$.match(yL6);if(Z===null||Z[0].length!==$.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat($)},hG1=($)=>{if(typeof $=="string")return nt$($);return R10($)},gL6=hG1,hL6=hG1,uL6=($)=>{if(typeof $=="string")return nt$($);return BM0($)},nt$=($)=>{switch($){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${$}`)}},tt$=($)=>{if(typeof $==="string")return q10(Md($));return q10($)},lL6=tt$,cL6=($)=>{if(typeof $==="string")return _G1(Md($));return _G1($)},Rd=($)=>{if(typeof $==="string")return vG1(Md($));return vG1($)},ot$=($)=>{if(typeof $==="string")return fG1(Md($));return fG1($)},DM0=($)=>{return String(TypeError($).stack||$).split(`
+      LIMIT 50`,{slug:$,since:Z,until:Q})).map((J)=>({key:J.key,pageviews:Number(J.pageviews),visitors:Number(J.visitors)}))}async function Dt$($){let{since:Z,until:Q}=Ot$(90),Y=await Lt$($,Z,Q);return[...new Set(Y.map(Zc))]}async function WM0($){let Z=$.get("studioContext");if(!uE(Z))return $.json({error:"Unauthorized"},401);let Q=i(Z),Y=$.req.param("site");if(!Y)return $.json({error:"site is required"},400);let X=Y.toLowerCase();if(!await Z.storage.orgSites.isOwnedBy(X,Q.id))return $.json({error:"Site not found in organization"},404);if(!await sG(Z,Q.id,"monitoring"))return $.json({error:"This organization's plan does not include monitoring",code:"feature_not_in_plan"},403);return{slug:X}}var fO6,bO6,Nt$,p3="site_id IN (SELECT id FROM default.dim_sites WHERE name = {slug:String})",dO6,pO6="https://deco.lilstts.com/plausible",nO6=12000,tO6,wt$=()=>{let $=new e0;return $.get("/:site/cdn/data",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;if(!tN())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!fO6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=wG1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J,H=Bt$(Z.req.query("filters"));try{let F;switch(Y){case"summary":F=await yO6(G,W,K,H);break;case"timeline":F=await gO6(G,W,K,J.granularity,H);break;case"cache-status":F=await hO6(G,W,K,H);break;case"status-codes":F=await uO6(G,W,K,H);break;case"top-paths":F=await lO6(G,W,K,Z.req.query("groupByPath")==="1",H);break;case"top-countries":F=await cO6(G,W,K,H);break}return Z.json({available:!0,view:Y,range:X,data:F})}catch(F){return console.error(`[monitor] cdn ${Y} query failed for site="${G}":`,F),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/audience/data",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;if(!tN())return Z.json({available:!1,error:"Monitor is not configured"});let Y=Z.req.query("view")??"summary";if(!dO6.has(Y))return Z.json({error:`unknown or unavailable view: ${Y}`},400);let X=Z.req.query("range")??"7d",J=wG1(X,Z.req.query("since"),Z.req.query("until"));if(!J)return Z.json({error:`unknown range: ${X}`},400);let{slug:G}=Q,{since:W,until:K}=J;try{let H;switch(Y){case"summary":H=await mO6(G,W,K);break;case"timeline":H=await iO6(G,W,K);break;case"top-sources":H=await jG1(G,W,K,"utm_source");break;case"top-countries":H=await jG1(G,W,K,"country");break;case"devices":H=await jG1(G,W,K,"device_type");break}return Z.json({available:!0,view:Y,range:X,data:H})}catch(H){return console.error(`[monitor] audience ${Y} query failed for site="${G}":`,H),Z.json({error:"Failed to query monitor warehouse"},502)}}),$.get("/:site/hosts",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q;if(!tN())return Z.json({available:!1,hosts:[]});try{let X=await Dt$(Y);return Z.json({available:!0,hosts:X})}catch(X){return console.error(`[monitor] hosts failed for site="${Y}":`,X),Z.json({available:!0,hosts:[]})}}),$.get("/:site/onedollar",async(Z)=>{let Q=await WM0(Z);if(Q instanceof Response)return Q;let{slug:Y}=Q,X=O0().oneDollarStatsApiKey;if(!X)return Z.json({available:!1,error:"OneDollarStats not configured"});let J=Z.req.query("report")??"kpis",G=tO6[J];if(!G)return Z.json({error:`unknown report: ${J}`},400);let W=Z.req.query("range")??"7d",K=wG1(W,Z.req.query("since"),Z.req.query("until"));if(!K)return Z.json({error:`unknown range: ${W}`},400);let H=await Dt$(Y),F=Z.req.query("host"),U=F&&H.includes(F)?F:H[0];if(!U)return Z.json({available:!0,report:J,range:W,results:[]});let{since:N,until:B}=K,D=J==="timeseries"?K.granularity==="hourly"?"time:hour":"time:day":G.dimension,L={page:"event:page",source:"visit:referrer",referrer:"visit:referrer",country:"visit:country",browser:"visit:browser",os:"visit:os",device:"visit:device",utm_campaign:"visit:utm_campaign",utm_source:"visit:utm_source",utm_medium:"visit:utm_medium",utm_content:"visit:utm_content",utm_term:"visit:utm_term"},w={equals:"is",not_equals:"is_not",contains:"contains",not_contains:"contains_not"},j=Bt$(Z.req.query("filters")).map((z)=>{let P=L[z.field],A=w[z.op];return P&&A?[A,P,[z.value]]:null}).filter(Boolean),E=async(z)=>{let P=await fetch(pO6,{method:"POST",headers:{"Content-Type":"application/json","x-api-key":X,Accept:"application/json"},body:JSON.stringify({site_id:U,metrics:G.metrics,date_range:z,...D?{dimensions:[D]}:{},...G.order?{order_by:[[G.order,"desc"]]}:{},...j.length?{filters:j}:{},pagination:{limit:100,offset:0}}),signal:AbortSignal.timeout(nO6)});if(!P.ok)throw Error(`OneDollarStats ${P.status}`);return(await P.json().catch(()=>null))?.results??[]};try{let z=await E([N,B]),P;if(J==="kpis"||J==="timeseries"&&Z.req.query("compare")==="1"){let q=Date.parse(`${N}T00:00:00Z`),k=86400000,M=KM0(new Date(q-86400000)),S=KM0(new Date(q-K.days*86400000));P=await E([S,M]).catch(()=>{return})}return Z.json({available:!0,report:J,range:W,host:U,metrics:G.metrics,results:z,...P?{previous:P}:{}})}catch(z){return console.error(`[monitor] onedollar ${J} failed for host="${U}":`,z),Z.json({error:"Failed to reach OneDollarStats"},502)}}),$};var jt$=O(()=>{y$();t1();jH();fA0();bA0();fO6=new Set(["summary","timeline","cache-status","status-codes","top-paths","top-countries"]),bO6={today:{days:1,granularity:"hourly"},yesterday:{days:1,granularity:"hourly",endOffsetDays:1},"7d":{days:7,granularity:"daily"},"14d":{days:14,granularity:"daily"},"30d":{days:30,granularity:"daily"},"90d":{days:90,granularity:"daily"},"180d":{days:180,granularity:"daily"},"1y":{days:365,granularity:"daily"}};Nt$=/^\d{4}-\d{2}-\d{2}$/;dO6=new Set(["summary","timeline","top-sources","top-countries","devices"]);tO6={kpis:{metrics:["visitors","visits","pageviews","bounce_rate","visit_duration"]},timeseries:{metrics:["pageviews","visits","visitors","bounce_rate","visit_duration"]},pages:{metrics:["pageviews","visitors"],dimension:"event:page",order:"pageviews"},sources:{metrics:["visitors"],dimension:"visit:referrer",order:"visitors"},countries:{metrics:["visitors"],dimension:"visit:country",order:"visitors"},browsers:{metrics:["visitors"],dimension:"visit:browser",order:"visitors"},os:{metrics:["visitors"],dimension:"visit:os",order:"visitors"},devices:{metrics:["visitors"],dimension:"visit:device",order:"visitors"},events:{metrics:["visitors","events"],dimension:"event:name",order:"events"},utm_campaign:{metrics:["visitors","events"],dimension:"visit:utm_campaign",order:"events"},utm_source:{metrics:["visitors","events"],dimension:"visit:utm_source",order:"events"},utm_medium:{metrics:["visitors","events"],dimension:"visit:utm_medium",order:"events"},utm_content:{metrics:["visitors","events"],dimension:"visit:utm_content",order:"events"},utm_term:{metrics:["visitors","events"],dimension:"visit:utm_term",order:"events"}}});import{timingSafeEqual as oO6}from"crypto";function uF($){let Q=$?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();return Q?Q:null}function j10($,Z){let Q=Buffer.from($),Y=Buffer.from(Z);return Q.length===Y.length&&oO6(Q,Y)}function hw($){let Z=process.env.VAULT_SERVICE_TOKEN;return!!Z&&j10($,Z)}function Et$($){if(!$)return null;return $ instanceof Date?$.toISOString():$}function rO6($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>typeof Z==="string");if(typeof $!=="string")return[];try{let Z=JSON.parse($);return Array.isArray(Z)?Z.filter((Q)=>typeof Q==="string"):[]}catch{return[]}}async function zt$($,Z,Q){let Y=uF($.req.header("authorization"));if(!Y)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let X=$.get("studioContext"),J=X.organization?.id;if(!J)return{ok:!1,response:$.json({error:"Organization context required"},403)};if(hw(Y))return{ok:!0,ctx:X,organizationId:J};let G=await X.storage.connectionCredentialVault.authenticateWorkloadToken(Y);if(!G||G.organizationId!==J)return{ok:!1,response:$.json({error:"Unauthorized"},401)};let W=await X.storage.connections.findById(G.subjectConnectionId,J);if(!W||W.status!=="active")return{ok:!1,response:$.json({error:"Unauthorized"},401)};if(!await X.storage.connectionCredentialVault.hasGrant({organizationId:J,subjectConnectionId:G.subjectConnectionId,targetConnectionId:Z,scope:Q}))return{ok:!1,response:$.json({error:"Forbidden"},403)};return{ok:!0,ctx:X,organizationId:J}}var Pt$=()=>{let $=new e0;return $.post("/vault/connections/batch",async(Z)=>{let Q=uF(Z.req.header("authorization"));if(!Q||!hw(Q))return Z.json({error:"Unauthorized"},401);let Y=Z.get("studioContext"),X=Y.organization?.id;if(!X)return Z.json({error:"Organization context required"},403);let J=await Z.req.json().catch(()=>null),G=Array.isArray(J?.connectionIds)?[...new Set(J.connectionIds)].filter((B)=>typeof B==="string"&&B.length>0):[];if(G.length===0||G.length>20)return Z.json({error:"connectionIds must be a non-empty string array (max 20)"},400);let{items:W}=await Y.storage.connections.list(X,{includeVirtual:!0,where:{field:["id"],operator:"in",value:G},limit:G.length}),K=new Map(W.map((B)=>[B.id,B])),H=new Set((await Y.db.selectFrom("downstream_tokens").select("connectionId").where("connectionId","in",G).execute()).map((B)=>B.connectionId)),F=new Map((await Y.db.selectFrom("connections").select(["id","configuration_state","connection_token"]).where("id","in",G).where("organization_id","=",X).execute()).map((B)=>[B.id,B])),U=new b5(Y.db,Y.vault),N={};return await Promise.all(G.map(async(B)=>{try{let D=K.get(B);if(!D||D.status!=="active"){N[B]={error:"Connection not found"};return}if(F.get(B)?.configuration_state&&!D.configuration_state){N[B]={error:"MCP configuration could not be decrypted"};return}let L={type:"mcp_configuration",state:D.configuration_state??{},scopes:D.configuration_scopes??[]},w=null;if(H.has(B)){let j=await aJ({connectionId:B,connectionUrl:D.connection_url,tokenStorage:U});if(j.state==="valid"||j.state==="refreshed"){let E=await U.get(B);w={type:"oauth_access_token",tokenType:"Bearer",accessToken:j.accessToken,expiresAt:Et$(E?.expiresAt??null),scope:E?.scope??null}}}else if(D.connection_token)w={type:"static_token",tokenType:"Bearer",accessToken:D.connection_token,expiresAt:null,scope:null};else if(F.get(B)?.connection_token){N[B]={error:"Connection token could not be decrypted"};return}N[B]={configuration:L,accessToken:w}}catch(D){N[B]={error:D instanceof Error?D.message:String(D)}}})),Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json(N)}),$.post("/vault/connections/:connectionId/access-token",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await zt$(Z,Q,MQ0);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.storage.connections.findById(Q,J);if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W=new b5(X.db,X.vault),K=await aJ({connectionId:Q,connectionUrl:G.connection_url,tokenStorage:W});if(K.state==="missing"){if(G.connection_token)return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"static_token",tokenType:"Bearer",accessToken:G.connection_token,expiresAt:null,scope:null});if((await X.db.selectFrom("connections").select("connection_token").where("id","=",Q).where("organization_id","=",J).executeTakeFirst())?.connection_token)return Z.json({error:"Connection token could not be decrypted"},424);return Z.json({error:"Downstream token not found"},409)}if(K.state==="expired_without_refresh"||K.state==="refresh_failed")return Z.json({error:"Downstream token refresh failed"},424);let H=await W.get(Q);return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"oauth_access_token",tokenType:"Bearer",accessToken:K.accessToken,expiresAt:Et$(H?.expiresAt??null),scope:H?.scope??null})}),$.post("/vault/connections/:connectionId/configuration",async(Z)=>{let Q=Z.req.param("connectionId"),Y=await zt$(Z,Q,IQ0);if(!Y.ok)return Y.response;let{ctx:X,organizationId:J}=Y,G=await X.db.selectFrom("connections").select(["status","configuration_state","configuration_scopes"]).where("id","=",Q).where("organization_id","=",J).executeTakeFirst();if(!G||G.status!=="active")return Z.json({error:"Connection not found"},404);let W={};if(G.configuration_state)try{let K=await X.vault.decrypt(G.configuration_state),H=JSON.parse(K);if(typeof H!=="object"||H===null||Array.isArray(H))throw Error("MCP configuration state is not an object");W=H}catch{return Z.json({error:"MCP configuration could not be decrypted"},424)}return Z.header("Cache-Control","no-store"),Z.header("Pragma","no-cache"),Z.json({type:"mcp_configuration",state:W,scopes:rO6(G.configuration_scopes)})}),$};var hb=O(()=>{y$();O3();VQ0();rW()});import{createHmac as sO6}from"crypto";import{mkdir as aO6,writeFile as eO6}from"fs/promises";import{dirname as $L6,join as Rt$}from"path";function QL6($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return Rt$(ZL6,Z)}function At$($,Z){let Q=QL6($),Y=fG(Z);return Rt$(Q,Y)}function Tt$($,Z,Q,Y,X){let J=O0().encryptionKey||"dev-secret",G=`${$}:${Z}:${Q}:${Y}`,W=sO6("sha256",J).update(G).digest("hex");return j10(X,W)}function EG1($){let Z=$.split(".").pop()?.toLowerCase()||"";return{jpg:"image/jpeg",jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",svg:"image/svg+xml",ico:"image/x-icon",bmp:"image/bmp",pdf:"application/pdf",json:"application/json",xml:"application/xml",txt:"text/plain",html:"text/html",htm:"text/html",css:"text/css",csv:"text/csv",md:"text/markdown",js:"application/javascript",mjs:"application/javascript",ts:"application/typescript",mp4:"video/mp4",webm:"video/webm",avi:"video/x-msvideo",mov:"video/quicktime",mp3:"audio/mpeg",wav:"audio/wav",ogg:"audio/ogg",zip:"application/zip",gz:"application/gzip",tar:"application/x-tar",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf"}[Z]||"application/octet-stream"}var ZL6="./data/assets",HM0=($)=>{let Z=new e0,Q=$.orgFromPath?"/*":"/:orgId/*";return Z.get(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="GET")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!Tt$(X,G,F,"GET",K))return Y.json({error:"Invalid signature"},403);let N=At$(X,G);try{let B=Bun.file(N);if(!await B.exists())return Y.json({error:"File not found"},404);let L=EG1(G);return new Response(B.stream(),{headers:{"Content-Type":L,"Content-Length":B.size.toString(),"Cache-Control":"private, max-age=3600"}})}catch(B){return console.error("Error serving file:",B),Y.json({error:"Failed to read file"},500)}}),Z.put(Q,async(Y)=>{let X=$.orgFromPath?Y.get("studioContext")?.organization?.id:Y.req.param("orgId");if(!X)return Y.json({error:"Missing organization context"},500);let J=$.orgFromPath?`/api/${Y.req.param("org")??""}/dev-assets/`:`/api/dev-assets/${X}/`,G=Y.req.path.replace(J,"");if(!G)return Y.json({error:"Missing key"},400);let W=Y.req.query("expires"),K=Y.req.query("signature"),H=Y.req.query("method");if(!W||!K||H!=="PUT")return Y.json({error:"Invalid or missing signature parameters"},400);let F=parseInt(W,10);if(!Number.isFinite(F))return Y.json({error:"Invalid expires parameter"},400);let U=Math.floor(Date.now()/1000);if(F<U)return Y.json({error:"URL has expired"},403);if(!Tt$(X,G,F,"PUT",K))return Y.json({error:"Invalid signature"},403);let N=At$(X,G),B=$L6(N);try{await aO6(B,{recursive:!0});let D=await Y.req.arrayBuffer();return await eO6(N,Buffer.from(D)),Y.json({success:!0,key:G})}catch(D){return console.error("Error saving file:",D),Y.json({error:"Failed to save file"},500)}}),Z};var FM0=O(()=>{y$();t1();FW();hb()});function qt$($,Z,Q){if(!["127.0.0.1","::1","::ffff:127.0.0.1"].includes($??""))return!1;try{let Y=new URL(Q),X=["localhost","127.0.0.1","[::1]"].includes(Y.hostname)||Y.hostname.endsWith(".localhost");return["http:","https:"].includes(Y.protocol)&&X&&Z===Y.origin}catch{return!1}}function zG1($){let Z=new URL(YL6);if(Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("state",$.state),$.selectAccount)Z.searchParams.set("prompt","select_account");return Z.toString()}function XL6($,Z=200){let Q=$!==null&&typeof $==="object"?$:{};if(typeof Q.error==="string"){let Y=typeof Q.error_description==="string"?` (${Q.error_description})`:"";throw new f0({provider:"github",status:400,message:`GitHub OAuth code exchange failed: ${Q.error}${Y}`})}if(typeof Q.access_token!=="string"||Q.access_token.length===0)throw new f0({provider:"github",status:Z,message:"GitHub OAuth code exchange returned no access token"});return{accessToken:Q.access_token,refreshToken:typeof Q.refresh_token==="string"&&Q.refresh_token.length>0?Q.refresh_token:null,expiresIn:typeof Q.expires_in==="number"&&Number.isFinite(Q.expires_in)?Q.expires_in:null,scope:typeof Q.scope==="string"&&Q.scope.length>0?Q.scope:null,tokenEndpoint:Mt$}}async function It$($){let Z;try{let X=process.env.GITHUB_OAUTH_TOKEN_URL??Mt$;Z=await fetch(X,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json"},body:JSON.stringify({client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),signal:AbortSignal.timeout(Qa0)})}catch(X){throw new f0({provider:"github",status:0,message:`GitHub OAuth code exchange failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}let Q=await Z.text();if(!Z.ok)throw new f0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange failed: ${Z.status} ${Q.slice(0,300)}`});let Y;try{Y=JSON.parse(Q)}catch(X){throw new f0({provider:"github",status:Z.status,message:`GitHub OAuth code exchange returned invalid JSON: ${Q.slice(0,300)}`,cause:X})}return XL6(Y,Z.status)}var YL6="https://github.com/login/oauth/authorize",Mt$="https://github.com/login/oauth/access_token";var Vt$=O(()=>{d6();TL()});function kt$($){let Z=new URL(`https://${zN}/site/oauth2/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.toString()}function JL6(){return`https://${zN}/site/oauth2/access_token`}async function St$($){let Z=JL6(),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(GL6)})}catch(J){throw new f0({provider:"bitbucket",status:0,message:`Bitbucket token exchange failed: ${WL6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new f0({provider:"bitbucket",status:Y.status,message:`Bitbucket token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new f0({provider:"bitbucket",status:Y.status,message:"Bitbucket token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scopes==="string"?X.scopes:null,tokenEndpoint:Z}}function WL6($){return $ instanceof Error?$.message:String($)}var GL6=15000;var Ct$=O(()=>{d6();lu()});function _t$($){let Z=new URL(`https://${$.host}/oauth/authorize`);return Z.searchParams.set("client_id",$.clientId),Z.searchParams.set("redirect_uri",$.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("state",$.state),Z.searchParams.set("scope",($.scopes??KL6).join(" ")),Z.toString()}function HL6($){return`https://${$}/oauth/token`}async function vt$($){let Z=HL6($.host),Q=new URLSearchParams({grant_type:"authorization_code",client_id:$.clientId,client_secret:$.clientSecret,code:$.code,redirect_uri:$.redirectUri}),Y;try{Y=await fetch(Z,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/x-www-form-urlencoded"},body:Q,signal:AbortSignal.timeout(FL6)})}catch(J){throw new f0({provider:"gitlab",status:0,message:`GitLab token exchange failed: ${UL6(J)}`,cause:J})}let X=await Y.json().catch(()=>null);if(!Y.ok||!X||typeof X.error==="string"){let J=X&&typeof X.error_description==="string"?X.error_description:X&&typeof X.error==="string"?X.error:Y.statusText;throw new f0({provider:"gitlab",status:Y.status,message:`GitLab token exchange failed (${Y.status}): ${J}`})}if(typeof X.access_token!=="string"||!X.access_token)throw new f0({provider:"gitlab",status:Y.status,message:"GitLab token exchange returned no access_token"});return{accessToken:X.access_token,refreshToken:typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:null,expiresIn:typeof X.expires_in==="number"&&Number.isFinite(X.expires_in)?X.expires_in:null,scope:typeof X.scope==="string"?X.scope:null,tokenEndpoint:Z}}function UL6($){return $ instanceof Error?$.message:String($)}var KL6,FL6=15000;var ft$=O(()=>{d6();KL6=["api","read_user"]});import{z as BB}from"zod";function E10($){if(!$)return"/";if(!$.startsWith("/")||$.startsWith("//")||$.includes("\\")||/[\r\n\t]/.test($))return"/";return $}function NL6($){if($.htmlUrl)return $.htmlUrl;return`https://github.com${$.accountType==="Organization"?`/organizations/${encodeURIComponent($.login)}/settings/installations/${$.installationId}`:`/settings/installations/${$.installationId}`}`}function ub($){return`${J5()}/api/_git/${$}/callback`}function GY($,Z){let Q=new URL($,J5());if(Q.searchParams.delete("git_error"),Z)Q.searchParams.set("git_error",Z);return Q.toString()}async function UM0($,Z){let Q=$.organization?.id,Y=$.auth.user?.id;if(!Q||!Y)throw Error("Session with an organization is required");return $.storage.gitProviderOAuthStates.create({organizationId:Q,userId:Y,...Z})}async function NM0($,Z,Q){if(!Q)return{ok:!1,error:"missing_state",returnTo:"/"};let Y=await $.storage.gitProviderOAuthStates.consume(Q);if(!Y||Y.provider!==Z)return{ok:!1,error:"invalid_state",returnTo:"/"};let X=E10(Y.returnTo);if($.auth.user?.id!==Y.userId)return{ok:!1,error:"session_mismatch",returnTo:X};return{ok:!0,state:Y,returnTo:X}}var bt$=()=>{let $=new e0;return $.post("/git-providers/github/cli/connect",async(Z)=>{if(!OP())return Z.json({error:"GitHub CLI requires local mode"},403);let Q;try{Q=F10(Z).remote.address}catch{}if(!qt$(Q,Z.req.header("Origin"),J5()))return Z.json({error:"GitHub CLI requires a local, same-origin request"},403);let Y=Z.get("studioContext");if(!Y.auth.user||!Y.organization)return Z.json({error:"Unauthorized"},401);try{await Y.access.check("GIT_ACCOUNT_CONNECT_TOKEN")}catch(G){if(G instanceof F7)return Z.json({error:"Forbidden"},403);throw G}if(Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let X;try{X=await JG$()}catch{return Z.json({error:"Could not connect to GitHub CLI. Install gh and run gh auth login --hostname github.com, then try again."},400)}let J=await Y.storage.gitProviderAccounts.upsert({organizationId:Y.organization.id,type:"github",host:"github.com",authKind:"github_cli",...X,createdBy:Y.auth.user.id});return Z.json({account:{id:J.id,login:J.login}})}),$.get("/git-providers/github/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=jL();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await UM0(Q,{provider:"github",host:"github.com",returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(zG1({clientId:Y.clientId,redirectUri:ub("github"),state:X,selectAccount:!0}))}),$.get("/git-providers/github/install",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=jL();if(!Y)return Z.json({error:"GitHub App is not configured"},503);let X=await UM0(Q,{provider:"github",host:"github.com",returnTo:E10(Z.req.query("returnTo"))}),J=new URL(`https://github.com/apps/${encodeURIComponent(Y.slug)}/installations/new`);return J.searchParams.set("state",X),Z.redirect(J.toString())}),$.get("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y={organizationId:Q.organization.id,userId:Q.auth.user.id},X=await Q.storage.githubConnectFlows.get(Z.req.param("id"),Y);if(!X)return Z.json({error:"flow_expired"},410);let J=QK();if(!J)return Z.json({error:"not_configured"},503);try{let G=await J.listConnectableInstallations(X.id,await Q.vault.decrypt(X.encrypted_access_token));return Z.json({installations:G.map((W)=>({installationId:W.installationId,login:W.login,avatarUrl:W.avatarUrl,accountType:W.accountType})),expiresAt:X.expires_at})}catch{return Z.json({error:"github_unavailable"},502)}}),$.get("/git-providers/github/flows/:id/repositories",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store");let Y=BB.object({installationId:BB.coerce.number().int().positive().safe(),page:BB.coerce.number().int().positive().safe().default(1),query:BB.string().trim().max(256).optional()}).safeParse(Z.req.query());if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=QK();if(!G)return Z.json({error:"not_configured"},503);try{let W=await Q.vault.decrypt(J.encrypted_access_token),K=await G.connectableInstallation(J.id,W,Y.data.installationId);if(!K)return Z.json({error:"installation_forbidden"},403);let H=await G.delegableRepositories(J.id,W,K.installationId),F=await Q.storage.gitProviderAccounts.findByExternalId({organizationId:X.organizationId,host:"github.com",externalAccountId:String(K.installationId)});return Z.json({...rJ$(H,Y.data.page,Y.data.query),accountVersion:KJ1(F)})}catch{return Z.json({error:"github_unavailable"},502)}}),$.post("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);if(await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),Z.header("Cache-Control","no-store"),!Z.req.header("Content-Type")?.startsWith("application/json"))return Z.json({error:"Invalid content type"},415);let Y=BB.object({installationId:BB.number().int().positive().safe(),repositoryIds:BB.array(BB.number().int().positive().safe()).min(1).max(xJ0).refine((H)=>new Set(H).size===H.length),accountVersion:BB.string().max(200).nullable()}).safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid installation"},400);let X={organizationId:Q.organization.id,userId:Q.auth.user.id},J=await Q.storage.githubConnectFlows.get(Z.req.param("id"),X);if(!J)return Z.json({error:"flow_expired"},410);let G=QK();if(!G)return Z.json({error:"not_configured"},503);let W,K;try{let H=await Q.vault.decrypt(J.encrypted_access_token);if(W=await G.connectableInstallation(J.id,H,Y.data.installationId,{fresh:!0}),!W)return Z.json({error:"installation_forbidden"},403);let F=await G.delegableRepositories(J.id,H,W.installationId,{fresh:!0});if(!sJ$(F,Y.data.repositoryIds))return Z.json({error:"repositories_forbidden"},403);K=await G.connectingUserId(H)}catch{return Z.json({error:"github_unavailable"},502)}try{let H=await Q.storage.githubConnectFlows.connect(J.id,X,{organizationId:X.organizationId,type:"github",host:"github.com",authKind:"github_app",externalAccountId:String(W.installationId),login:W.login,avatarUrl:W.avatarUrl,installationId:W.installationId,installationAuthorizedBy:K,installationRepositoryIds:Y.data.repositoryIds},Y.data.accountVersion);if(!H)return Z.json({error:"flow_expired"},410);return G.forgetFlow(J.id),Z.json({account:{id:H.id,login:H.login}})}catch(H){if(H instanceof Vq0)return Z.json({error:"account_changed"},409);throw H}}),$.delete("/git-providers/github/flows/:id",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);return await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN"),await Q.storage.githubConnectFlows.cancel(Z.req.param("id"),{organizationId:Q.organization.id,userId:Q.auth.user.id}),QK()?.forgetFlow(Z.req.param("id")),Z.body(null,204)}),$.get("/git-providers/github/accounts/:id/manage",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user||!Q.organization)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=await Q.storage.gitProviderAccounts.get(Z.req.param("id"),Q.organization.id);if(!Y||Y.type!=="github"||!Y.installationId)return Z.json({error:"Account not found"},404);let X=QK();if(!X)return Z.json({error:"not_configured"},503);let J=await X.getInstallation(Y.installationId);if(!J)return Z.json({error:"Installation not found"},404);return Z.redirect(NL6(J))}),$.get("/git-providers/gitlab/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=YG0(),X=(Z.req.query("host")??Y?.host??"gitlab.com").trim().toLowerCase();if(!Y||Y.host!==X)return Z.json({error:`No GitLab OAuth application is configured for ${X}. Connect with an access token instead.`},503);let J=await UM0(Q,{provider:"gitlab",host:X,returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(_t$({host:X,clientId:Y.clientId,redirectUri:ub("gitlab"),state:J}))}),$.get("/git-providers/bitbucket/connect",async(Z)=>{let Q=Z.get("studioContext");if(!Q.auth.user)return Z.json({error:"Unauthorized"},401);await Q.access.check("GIT_ACCOUNT_CONNECT_TOKEN");let Y=lJ0();if(!Y)return Z.json({error:"No Bitbucket OAuth consumer is configured. Connect with an access token instead."},503);let X=await UM0(Q,{provider:"bitbucket",host:Y.host,returnTo:E10(Z.req.query("returnTo"))});return Z.redirect(kt$({clientId:Y.clientId,redirectUri:ub("bitbucket"),state:X}))}),$},zd;var PG1=O(()=>{y$();mJ1();mH();OW();k5();yJ0();FJ1();Wa0();hJ0();Vt$();qL();lu();wP();Ct$();ft$();zd=new e0;zd.get("/github/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=jL(),G=QK(),W=$.req.query("code");if(!J||!G)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await It$({clientId:J.clientId,clientSecret:J.clientSecret,code:W,redirectUri:ub("github")}),H={organizationId:X.organizationId,userId:X.userId},F=new URL(Y,J5()),U=F.searchParams.get("git_flow"),N=await Z.vault.encrypt(K.accessToken),B=U&&await Z.storage.githubConnectFlows.refresh(U,H,N)?U:await Z.storage.githubConnectFlows.create(H,N);return F.searchParams.delete("git_error"),F.searchParams.set("git_flow",B),$.redirect(F.toString())}catch(K){return console.error("[git-providers] github callback failed",{message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}});zd.get("/github/setup",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"github",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,J=jL();if(!J)return $.redirect(GY(Y,"not_configured"));let G=await Z.storage.gitProviderOAuthStates.create(X);return $.redirect(zG1({clientId:J.clientId,redirectUri:ub("github"),state:G}))});zd.get("/gitlab/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"gitlab",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=YG0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await vt$({host:J,clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:ub("gitlab")}),H=await uJ0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"gitlab",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(GY(Y))}catch(K){return console.error("[git-providers] gitlab callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}});zd.get("/bitbucket/callback",async($)=>{let Z=await XQ.create($.req.raw),Q=await NM0(Z,"bitbucket",$.req.query("state"));if(!Q.ok)return $.redirect(GY(Q.returnTo,Q.error));let{returnTo:Y,state:X}=Q,{host:J}=X,G=lJ0(),W=$.req.query("code");if(!G||G.host!==J)return $.redirect(GY(Y,"not_configured"));if(!W)return $.redirect(GY(Y,$.req.query("error")??"denied"));try{let K=await St$({clientId:G.clientId,clientSecret:G.clientSecret,code:W,redirectUri:ub("bitbucket")}),H=await cJ0(J,K.accessToken),F=await Z.storage.gitProviderAccounts.upsert({organizationId:X.organizationId,type:"bitbucket",host:J,authKind:"oauth",externalAccountId:H.externalAccountId,login:H.login,avatarUrl:H.avatarUrl,createdBy:X.userId});return await Z.storage.gitProviderAccountCredentials.upsert({connectionId:F.id,accessToken:K.accessToken,refreshToken:K.refreshToken,scope:K.scope,expiresAt:K.expiresIn!==null?new Date(Date.now()+K.expiresIn*1000):null,clientId:G.clientId,clientSecret:G.clientSecret,tokenEndpoint:K.tokenEndpoint}),$.redirect(GY(Y))}catch(K){return console.error("[git-providers] bitbucket callback failed",{host:J,message:K instanceof Error?K.message:String(K)}),$.redirect(GY(Y,"exchange_failed"))}})});var P10=_((jL6)=>{jL6.HttpAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(jL6.HttpAuthLocation||(jL6.HttpAuthLocation={}));jL6.HttpApiKeyAuthLocation=void 0;(function($){$.HEADER="header",$.QUERY="query"})(jL6.HttpApiKeyAuthLocation||(jL6.HttpApiKeyAuthLocation={}));jL6.EndpointURLScheme=void 0;(function($){$.HTTP="http",$.HTTPS="https"})(jL6.EndpointURLScheme||(jL6.EndpointURLScheme={}));jL6.AlgorithmId=void 0;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(jL6.AlgorithmId||(jL6.AlgorithmId={}));var BL6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>jL6.AlgorithmId.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>jL6.AlgorithmId.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},DL6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},OL6=($)=>{return BL6($)},LL6=($)=>{return DL6($)};jL6.FieldPosition=void 0;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(jL6.FieldPosition||(jL6.FieldPosition={}));var wL6="__smithy_context";jL6.IniSectionType=void 0;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(jL6.IniSectionType||(jL6.IniSectionType={}));jL6.RequestHandlerProtocol=void 0;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(jL6.RequestHandlerProtocol||(jL6.RequestHandlerProtocol={}));jL6.SMITHY_CONTEXT_KEY=wL6;jL6.getDefaultClientConfiguration=OL6;jL6.resolveDefaultRuntimeConfig=LL6});var mG1=_((sw6)=>{var CG1=A0("crypto"),VG1=A0("fs"),AL6=I10(),TL6=V10(),lF=A0("stream"),ct$=($)=>typeof ArrayBuffer==="function"&&$ instanceof ArrayBuffer||Object.prototype.toString.call($)==="[object ArrayBuffer]",Td=($,Z=0,Q=$.byteLength-Z)=>{if(!ct$($))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof $} (${$})`);return Buffer.from($,Z,Q)},LM0=($,Z)=>{if(typeof $!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof $} (${$})`);return Z?Buffer.from($,Z):Buffer.from($)},RL6=/^[A-Za-z0-9+/]*={0,2}$/,dt$=($)=>{if($.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!RL6.exec($))throw TypeError("Invalid base64 string.");let Z=LM0($,"base64");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength)},wM0=($)=>{let Z=LM0($,"utf8");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength/Uint8Array.BYTES_PER_ELEMENT)},xG1=($)=>{let Z;if(typeof $==="string")Z=wM0($);else Z=$;if(typeof Z!=="object"||typeof Z.byteOffset!=="number"||typeof Z.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return Td(Z.buffer,Z.byteOffset,Z.byteLength).toString("base64")};function qL6($,Z,Q,Y){return class X extends Uint8Array{static fromString(J,G="utf-8"){if(typeof J==="string"){if(G==="base64")return X.mutate(Y(J));return X.mutate(Z(J))}throw Error(`Unsupported conversion from ${typeof J} to Uint8ArrayBlobAdapter.`)}static mutate(J){return Object.setPrototypeOf(J,X.prototype),J}transformToString(J="utf-8"){if(J==="base64")return Q(this);return $(this)}}}var mt$=($)=>{if(typeof $==="string")return $;if(typeof $!=="object"||typeof $.byteOffset!=="number"||typeof $.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return Td($.buffer,$.byteOffset,$.byteLength).toString("utf8")},WY=Array.from({length:256},($,Z)=>Z.toString(16).padStart(2,"0"));function ML6($){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let Z=new Uint8Array(16);return $(Z),Z[6]=Z[6]&15|64,Z[8]=Z[8]&63|128,WY[Z[0]]+WY[Z[1]]+WY[Z[2]]+WY[Z[3]]+"-"+WY[Z[4]]+WY[Z[5]]+"-"+WY[Z[6]]+WY[Z[7]]+"-"+WY[Z[8]]+WY[Z[9]]+"-"+WY[Z[10]]+WY[Z[11]]+WY[Z[12]]+WY[Z[13]]+WY[Z[14]]+WY[Z[15]]}}var IL6=($,Z,Q=(Y)=>Y)=>$,VL6=($)=>{switch($){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${$}"`)}},kL6=($)=>{if($===null||$===void 0)return;if(typeof $==="number"){if($===0||$===1)M10.warn(DM0(`Expected boolean, got ${typeof $}: ${$}`));if($===0)return!1;if($===1)return!0}if(typeof $==="string"){let Z=$.toLowerCase();if(Z==="false"||Z==="true")M10.warn(DM0(`Expected boolean, got ${typeof $}: ${$}`));if(Z==="false")return!1;if(Z==="true")return!0}if(typeof $==="boolean")return $;throw TypeError(`Expected boolean, got ${typeof $}: ${$}`)},R10=($)=>{if($===null||$===void 0)return;if(typeof $==="string"){let Z=parseFloat($);if(!Number.isNaN(Z)){if(String(Z)!==String($))M10.warn(DM0(`Expected number but observed string: ${$}`));return Z}}if(typeof $==="number")return $;throw TypeError(`Expected number, got ${typeof $}: ${$}`)},SL6=Math.ceil(340282346638528860000000000000000000000),BM0=($)=>{let Z=R10($);if(Z!==void 0&&!Number.isNaN(Z)&&Z!==1/0&&Z!==-1/0){if(Math.abs(Z)>SL6)throw TypeError(`Expected 32-bit float, got ${$}`)}return Z},q10=($)=>{if($===null||$===void 0)return;if(Number.isInteger($)&&!Number.isNaN($))return $;throw TypeError(`Expected integer, got ${typeof $}: ${$}`)},CL6=q10,_G1=($)=>yG1($,32),vG1=($)=>yG1($,16),fG1=($)=>yG1($,8),yG1=($,Z)=>{let Q=q10($);if(Q!==void 0&&_L6(Q,Z)!==Q)throw TypeError(`Expected ${Z}-bit integer, got ${$}`);return Q},_L6=($,Z)=>{switch(Z){case 32:return Int32Array.of($)[0];case 16:return Int16Array.of($)[0];case 8:return Int8Array.of($)[0]}},vL6=($,Z)=>{if($===null||$===void 0){if(Z)throw TypeError(`Expected a non-null value for ${Z}`);throw TypeError("Expected a non-null value")}return $},it$=($)=>{if($===null||$===void 0)return;if(typeof $==="object"&&!Array.isArray($))return $;let Z=Array.isArray($)?"array":typeof $;throw TypeError(`Expected object, got ${Z}: ${$}`)},fL6=($)=>{if($===null||$===void 0)return;if(typeof $==="string")return $;if(["boolean","number","bigint"].includes(typeof $))return M10.warn(DM0(`Expected string, got ${typeof $}: ${$}`)),String($);throw TypeError(`Expected string, got ${typeof $}: ${$}`)},bL6=($)=>{if($===null||$===void 0)return;let Z=it$($),Q=[];for(let Y in Z)if(Z[Y]!=null)Q.push(Y);if(Q.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(Q.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${Q} were not null.`);return Z},gG1=($)=>{if(typeof $=="string")return R10(Md($));return R10($)},xL6=gG1,pt$=($)=>{if(typeof $=="string")return BM0(Md($));return BM0($)},yL6=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,Md=($)=>{let Z=$.match(yL6);if(Z===null||Z[0].length!==$.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat($)},hG1=($)=>{if(typeof $=="string")return nt$($);return R10($)},gL6=hG1,hL6=hG1,uL6=($)=>{if(typeof $=="string")return nt$($);return BM0($)},nt$=($)=>{switch($){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${$}`)}},tt$=($)=>{if(typeof $==="string")return q10(Md($));return q10($)},lL6=tt$,cL6=($)=>{if(typeof $==="string")return _G1(Md($));return _G1($)},Rd=($)=>{if(typeof $==="string")return vG1(Md($));return vG1($)},ot$=($)=>{if(typeof $==="string")return fG1(Md($));return fG1($)},DM0=($)=>{return String(TypeError($).stack||$).split(`
 `).slice(0,5).filter((Z)=>!Z.includes("stackTraceWarning")).join(`
 `)},M10={warn:console.warn},dL6=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],uG1=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function mL6($){let Z=$.getUTCFullYear(),Q=$.getUTCMonth(),Y=$.getUTCDay(),X=$.getUTCDate(),J=$.getUTCHours(),G=$.getUTCMinutes(),W=$.getUTCSeconds(),K=X<10?`0${X}`:`${X}`,H=J<10?`0${J}`:`${J}`,F=G<10?`0${G}`:`${G}`,U=W<10?`0${W}`:`${W}`;return`${dL6[Y]}, ${K} ${uG1[Q]} ${Z} ${H}:${F}:${U} GMT`}var iL6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?[zZ]$/),pL6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=iL6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H]=Z,F=Rd(qd(Y)),U=cF(X,"month",1,12),N=cF(J,"day",1,31);return A10(F,U,N,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})},nL6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(([-+]\d{2}\:\d{2})|[zZ])$/),tL6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=nL6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H,F]=Z,U=Rd(qd(Y)),N=cF(X,"month",1,12),B=cF(J,"day",1,31),D=A10(U,N,B,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H});if(F.toUpperCase()!="Z")D.setTime(D.getTime()-Ww6(F));return D},oL6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),rL6=new RegExp(/^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),sL6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? (\d{4})$/),aL6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-7231 date-times must be expressed as strings");let Z=oL6.exec($);if(Z){let[Q,Y,X,J,G,W,K,H]=Z;return A10(Rd(qd(J)),kG1(X),cF(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})}if(Z=rL6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return Qw6(A10($w6(J),kG1(X),cF(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H}))}if(Z=sL6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return A10(Rd(qd(H)),kG1(Y),cF(X.trimLeft(),"day",1,31),{hours:J,minutes:G,seconds:W,fractionalMilliseconds:K})}throw TypeError("Invalid RFC-7231 date-time value")},eL6=($)=>{if($===null||$===void 0)return;let Z;if(typeof $==="number")Z=$;else if(typeof $==="string")Z=gG1($);else if(typeof $==="object"&&$.tag===1)Z=$.value;else throw TypeError("Epoch timestamps must be expressed as floating point numbers or their string representation");if(Number.isNaN(Z)||Z===1/0||Z===-1/0)throw TypeError("Epoch timestamps must be valid, non-Infinite, non-NaN numerics");return new Date(Math.round(Z*1000))},A10=($,Z,Q,Y)=>{let X=Z-1;return Xw6($,X,Q),new Date(Date.UTC($,X,Q,cF(Y.hours,"hour",0,23),cF(Y.minutes,"minute",0,59),cF(Y.seconds,"seconds",0,60),Gw6(Y.fractionalMilliseconds)))},$w6=($)=>{let Z=new Date().getUTCFullYear(),Q=Math.floor(Z/100)*100+Rd(qd($));if(Q<Z)return Q+100;return Q},Zw6=1576800000000,Qw6=($)=>{if($.getTime()-new Date().getTime()>Zw6)return new Date(Date.UTC($.getUTCFullYear()-100,$.getUTCMonth(),$.getUTCDate(),$.getUTCHours(),$.getUTCMinutes(),$.getUTCSeconds(),$.getUTCMilliseconds()));return $},kG1=($)=>{let Z=uG1.indexOf($);if(Z<0)throw TypeError(`Invalid month: ${$}`);return Z+1},Yw6=[31,28,31,30,31,30,31,31,30,31,30,31],Xw6=($,Z,Q)=>{let Y=Yw6[Z];if(Z===1&&Jw6($))Y=29;if(Q>Y)throw TypeError(`Invalid day for ${uG1[Z]} in ${$}: ${Q}`)},Jw6=($)=>{return $%4===0&&($%100!==0||$%400===0)},cF=($,Z,Q,Y)=>{let X=ot$(qd($));if(X<Q||X>Y)throw TypeError(`${Z} must be between ${Q} and ${Y}, inclusive`);return X},Gw6=($)=>{if($===null||$===void 0)return 0;return pt$("0."+$)*1000},Ww6=($)=>{let Z=$[0],Q=1;if(Z=="+")Q=1;else if(Z=="-")Q=-1;else throw TypeError(`Offset direction, ${Z}, must be "+" or "-"`);let Y=Number($.substring(1,3)),X=Number($.substring(4,6));return Q*(Y*60+X)*60*1000},qd=($)=>{let Z=0;while(Z<$.length-1&&$.charAt(Z)==="0")Z++;if(Z===0)return $;return $.slice(Z)},lb=function(Z){return Object.assign(new String(Z),{deserializeJSON(){return JSON.parse(String(Z))},toString(){return String(Z)},toJSON(){return String(Z)}})};lb.from=($)=>{if($&&typeof $==="object"&&($ instanceof lb||("deserializeJSON"in $)))return $;else if(typeof $==="string"||Object.getPrototypeOf($)===String.prototype)return lb(String($));return lb(JSON.stringify($))};lb.fromObject=lb.from;function Kw6($){if($.includes(",")||$.includes('"'))$=`"${$.replace(/"/g,"\\\"")}"`;return $}var lG1="(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)(?:[ne|u?r]?s?day)?",cG1="(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)",dG1="(\\d?\\d):(\\d{2}):(\\d{2})(?:\\.(\\d+))?",rt$="(\\d?\\d)",st$="(\\d{4})",Hw6=new RegExp(/^(\d{4})-(\d\d)-(\d\d)[tT](\d\d):(\d\d):(\d\d)(\.(\d+))?(([-+]\d\d:\d\d)|[zZ])$/),Fw6=new RegExp(`^${lG1}, ${rt$} ${cG1} ${st$} ${dG1} GMT$`),Uw6=new RegExp(`^${lG1}, ${rt$}-${cG1}-(\\d\\d) ${dG1} GMT$`),Nw6=new RegExp(`^${lG1} ${cG1} ( [1-9]|\\d\\d) ${dG1} ${st$}$`),Bw6=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],Dw6=($)=>{if($==null)return;let Z=NaN;if(typeof $==="number")Z=$;else if(typeof $==="string"){if(!/^-?\d*\.?\d+$/.test($))throw TypeError("parseEpochTimestamp - numeric string invalid.");Z=Number.parseFloat($)}else if(typeof $==="object"&&$.tag===1)Z=$.value;if(isNaN(Z)||Math.abs(Z)===1/0)throw TypeError("Epoch timestamps must be valid finite numbers.");return new Date(Math.round(Z*1000))},Ow6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC3339 timestamps must be strings");let Z=Hw6.exec($);if(!Z)throw TypeError(`Invalid RFC3339 timestamp format ${$}`);let[,Q,Y,X,J,G,W,,K,H]=Z;DB(Y,1,12),DB(X,1,31),DB(J,0,23),DB(G,0,59),DB(W,0,60);let F=new Date(Date.UTC(Number(Q),Number(Y)-1,Number(X),Number(J),Number(G),Number(W),Number(K)?Math.round(parseFloat(`0.${K}`)*1000):0));if(F.setUTCFullYear(Number(Q)),H.toUpperCase()!="Z"){let[,U,N,B]=/([+-])(\d\d):(\d\d)/.exec(H)||[void 0,"+",0,0],D=U==="-"?1:-1;F.setTime(F.getTime()+D*(Number(N)*60*60*1000+Number(B)*60*1000))}return F},Lw6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC7231 timestamps must be strings.");let Z,Q,Y,X,J,G,W,K;if(K=Fw6.exec($))[,Z,Q,Y,X,J,G,W]=K;else if(K=Uw6.exec($))[,Z,Q,Y,X,J,G,W]=K,Y=(Number(Y)+1900).toString();else if(K=Nw6.exec($))[,Q,Z,X,J,G,W,Y]=K;if(Y&&G){let H=Date.UTC(Number(Y),Bw6.indexOf(Q),Number(Z),Number(X),Number(J),Number(G),W?Math.round(parseFloat(`0.${W}`)*1000):0);DB(Z,1,31),DB(X,0,23),DB(J,0,59),DB(G,0,60);let F=new Date(H);return F.setUTCFullYear(Number(Y)),F}throw TypeError(`Invalid RFC7231 date-time value ${$}.`)};function DB($,Z,Q){let Y=Number($);if(Y<Z||Y>Q)throw Error(`Value ${Y} out of range [${Z}, ${Q}]`)}function ww6($,Z,Q){if(Q<=0||!Number.isInteger(Q))throw Error("Invalid number of delimiters ("+Q+") for splitEvery.");let Y=$.split(Z);if(Q===1)return Y;let X=[],J="";for(let G=0;G<Y.length;G++){if(J==="")J=Y[G];else J+=Z+Y[G];if((G+1)%Q===0)X.push(J),J=""}if(J!=="")X.push(J);return X}var jw6=($)=>{let Z=$.length,Q=[],Y=!1,X=void 0,J=0;for(let G=0;G<Z;++G){let W=$[G];switch(W){case'"':if(X!=="\\")Y=!Y;break;case",":if(!Y)Q.push($.slice(J,G)),J=G+1;break}X=W}return Q.push($.slice(J)),Q.map((G)=>{G=G.trim();let W=G.length;if(W<2)return G;if(G[0]==='"'&&G[W-1]==='"')G=G.slice(1,W-1);return G.replace(/\\"/g,'"')})},xt$=/^-?\d*(\.\d+)?$/;class jM0{string;type;constructor($,Z){if(this.string=$,this.type=Z,!xt$.test($))throw Error('@smithy/core/serde - NumericValue must only contain [0-9], at most one decimal point ".", and an optional negation prefix "-".')}toString(){return this.string}static[Symbol.hasInstance]($){if(!$||typeof $!=="object")return!1;let Z=$;return jM0.prototype.isPrototypeOf($)||Z.type==="bigDecimal"&&xt$.test(Z.string)}}function Ew6($){return new jM0(String($),"bigDecimal")}var at$={},bG1={};for(let $=0;$<256;$++){let Z=$.toString(16).toLowerCase();if(Z.length===1)Z=`0${Z}`;at$[$]=Z,bG1[Z]=$}function zw6($){if($.length%2!==0)throw Error("Hex encoded strings must have an even number length");let Z=new Uint8Array($.length/2);for(let Q=0;Q<$.length;Q+=2){let Y=$.slice(Q,Q+2).toLowerCase();if(Y in bG1)Z[Q/2]=bG1[Y];else throw Error(`Cannot decode unrecognized sequence ${Y} as hexadecimal`)}return Z}function et$($){let Z="";for(let Q=0;Q<$.byteLength;Q++)Z+=at$[$[Q]];return Z}var Pw6=($)=>{if(!$)return 0;if(typeof $==="string")return Buffer.byteLength($);else if(typeof $.byteLength==="number")return $.byteLength;else if(typeof $.size==="number")return $.size;else if(typeof $.start==="number"&&typeof $.end==="number")return $.end+1-$.start;else if($ instanceof VG1.ReadStream){if($.path!=null)return VG1.lstatSync($.path).size;else if(typeof $.fd==="number")return VG1.fstatSync($.fd).size}throw Error(`Body Length computation failed for ${$}`)},$o$=($)=>{if(typeof $==="string")return wM0($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength/Uint8Array.BYTES_PER_ELEMENT);return new Uint8Array($)},Zo$=($,Z)=>(Q,Y)=>async(X)=>{let{response:J}=await Q(X);try{let G=await Z(J,$);return{response:J,output:G}}catch(G){if(Object.defineProperty(G,"$response",{value:J,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in G)){try{G.message+=`
   Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.`}catch(K){if(!Y.logger||Y.logger?.constructor?.name==="NoOpLogger")console.warn("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.");else Y.logger?.warn?.("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.")}if(typeof G.$responseBodyText<"u"){if(G.$response)G.$response.body=G.$responseBodyText}try{if(AL6.HttpResponse.isInstance(J)){let{headers:K={}}=J,H=Object.entries(K);G.$metadata={httpStatusCode:J.statusCode,requestId:SG1(/^x-[\w-]+-request-?id$/,H),extendedRequestId:SG1(/^x-[\w-]+-id-2$/,H),cfId:SG1(/^x-[\w-]+-cf-id$/,H)}}}catch(K){}}throw G}},SG1=($,Z)=>{return(Z.find(([Q])=>{return Q.match($)})||[void 0,void 0])[1]},Qo$=($,Z)=>(Q,Y)=>async(X)=>{let J=$,G=Y.endpointV2?async()=>TL6.toEndpointV1(Y.endpointV2):J.endpoint;if(!G)throw Error("No valid endpoint provider available.");let W=await Z(X.input,{...$,endpoint:G});return Q({...X,request:W})},Yo$={name:"deserializerMiddleware",step:"deserialize",tags:["DESERIALIZER"],override:!0},Xo$={name:"serializerMiddleware",step:"serialize",tags:["SERIALIZER"],override:!0};function Aw6($,Z,Q){return{applyToStack:(Y)=>{Y.add(Zo$($,Q),Yo$),Y.add(Qo$($,Z),Xo$)}}}class Jo${algorithmIdentifier;secret;hash;constructor($,Z){this.algorithmIdentifier=$,this.secret=Z,this.reset()}update($,Z){this.hash.update($o$(yt$($,Z)))}digest(){return Promise.resolve(this.hash.digest())}reset(){this.hash=this.secret?CG1.createHmac(this.algorithmIdentifier,yt$(this.secret)):CG1.createHash(this.algorithmIdentifier)}}function yt$($,Z){if(Buffer.isBuffer($))return $;if(typeof $==="string")return LM0($,Z);if(ArrayBuffer.isView($))return Td($.buffer,$.byteOffset,$.byteLength);return Td($)}var Go$=class extends lF.Duplex{expectedChecksum;checksumSourceLocation;checksum;source;base64Encoder;pendingCallback=null;constructor({expectedChecksum:Z,checksum:Q,source:Y,checksumSourceLocation:X,base64Encoder:J}){super();if(typeof Y.pipe==="function")this.source=Y;else throw Error(`@smithy/util-stream: unsupported source type ${Y?.constructor?.name??Y} in ChecksumStream.`);this.base64Encoder=J??xG1,this.expectedChecksum=Z,this.checksum=Q,this.checksumSourceLocation=X,this.source.pipe(this)}_read(Z){if(this.pendingCallback){let Q=this.pendingCallback;this.pendingCallback=null,Q()}}_write(Z,Q,Y){try{if(this.checksum.update(Z),!this.push(Z)){this.pendingCallback=Y;return}}catch(X){return Y(X)}return Y()}async _final(Z){try{let Q=await this.checksum.digest(),Y=this.base64Encoder(Q);if(this.expectedChecksum!==Y)return Z(Error(`Checksum mismatch: expected "${this.expectedChecksum}" but received "${Y}" in response header "${this.checksumSourceLocation}".`))}catch(Q){return Z(Q)}return this.push(null),Z()}},OB=($)=>typeof ReadableStream==="function"&&($?.constructor?.name===ReadableStream.name||$ instanceof ReadableStream),Wo$=($)=>{return typeof Blob==="function"&&($?.constructor?.name===Blob.name||$ instanceof Blob)},Tw6=($)=>new TextEncoder().encode($),Ko$="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",gt$=Object.entries(Ko$).reduce(($,[Z,Q])=>{return $[Q]=Number(Z),$},{}),Rw6=Ko$.split(""),Pd=6,T10=8,qw6=63;function Ho$($){let Z;if(typeof $==="string")Z=Tw6($);else Z=$;let Q=typeof Z==="object"&&typeof Z.length==="number",Y=typeof Z==="object"&&typeof Z.byteOffset==="number"&&typeof Z.byteLength==="number";if(!Q&&!Y)throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");let X="";for(let J=0;J<Z.length;J+=3){let G=0,W=0;for(let H=J,F=Math.min(J+3,Z.length);H<F;H++)G|=Z[H]<<(F-H-1)*T10,W+=T10;let K=Math.ceil(W/Pd);G<<=K*Pd-W;for(let H=1;H<=K;H++){let F=(K-H)*Pd;X+=Rw6[(G&qw6<<F)>>F]}X+="==".slice(0,4-K)}return X}var Mw6=typeof ReadableStream==="function"?ReadableStream:function(){};class Fo$ extends Mw6{}var Iw6=({expectedChecksum:$,checksum:Z,source:Q,checksumSourceLocation:Y,base64Encoder:X})=>{if(!OB(Q))throw Error(`@smithy/util-stream: unsupported source type ${Q?.constructor?.name??Q} in ChecksumStream.`);let J=X??Ho$;if(typeof TransformStream!=="function")throw Error("@smithy/util-stream: unable to instantiate ChecksumStream because API unavailable: ReadableStream/TransformStream.");let G=new TransformStream({start(){},async transform(K,H){Z.update(K),H.enqueue(K)},async flush(K){let H=await Z.digest(),F=J(H);if($!==F){let U=Error(`Checksum mismatch: expected "${$}" but received "${F}" in response header "${Y}".`);K.error(U)}else K.terminate()}});Q.pipeThrough(G);let W=G.readable;return Object.setPrototypeOf(W,Fo$.prototype),W};function Vw6($){if(typeof ReadableStream==="function"&&OB($.source))return Iw6($);return new Go$($)}class OM0{allocByteArray;byteLength=0;byteArrays=[];constructor($){this.allocByteArray=$}push($){this.byteArrays.push($),this.byteLength+=$.byteLength}flush(){if(this.byteArrays.length===1){let Q=this.byteArrays[0];return this.reset(),Q}let $=this.allocByteArray(this.byteLength),Z=0;for(let Q=0;Q<this.byteArrays.length;++Q){let Y=this.byteArrays[Q];$.set(Y,Z),Z+=Y.byteLength}return this.reset(),$}reset(){this.byteArrays=[],this.byteLength=0}}function kw6($,Z,Q){let Y=$.getReader(),X=!1,J=0,G=["",new OM0((H)=>new Uint8Array(H))],W=-1,K=async(H)=>{let{value:F,done:U}=await Y.read(),N=F;if(U){if(W!==-1){let B=Ad(G,W);if(uw(B)>0)H.enqueue(B)}H.close()}else{let B=No$(N,!1);if(W!==B){if(W>=0)H.enqueue(Ad(G,W));W=B}if(W===-1){H.enqueue(N);return}let D=uw(N);J+=D;let L=uw(G[W]);if(D>=Z&&L===0)H.enqueue(N);else{let w=Uo$(G,W,N);if(!X&&J>Z*2)X=!0,Q?.warn(`@smithy/util-stream - stream chunk size ${D} is below threshold of ${Z}, automatically buffering.`);if(w>=Z)H.enqueue(Ad(G,W));else await K(H)}}};return new ReadableStream({pull:K})}function Uo$($,Z,Q){switch(Z){case 0:return $[0]+=Q,uw($[0]);case 1:case 2:return $[Z].push(Q),uw($[Z])}}function Ad($,Z){switch(Z){case 0:let Q=$[0];return $[0]="",Q;case 1:case 2:return $[Z].flush()}throw Error(`@smithy/util-stream - invalid index ${Z} given to flush()`)}function uw($){return $?.byteLength??$?.length??0}function No$($,Z=!0){if(Z&&typeof Buffer<"u"&&$ instanceof Buffer)return 2;if($ instanceof Uint8Array)return 1;if(typeof $==="string")return 0;return-1}function Sw6($,Z,Q){if(OB($))return kw6($,Z,Q);let Y=new lF.Readable({read(){}}),X=!1,J=0,G=["",new OM0((K)=>new Uint8Array(K)),new OM0((K)=>Buffer.from(new Uint8Array(K)))],W=-1;return $.on("data",(K)=>{let H=No$(K,!0);if(W!==H){if(W>=0)Y.push(Ad(G,W));W=H}if(W===-1){Y.push(K);return}let F=uw(K);J+=F;let U=uw(G[W]);if(F>=Z&&U===0)Y.push(K);else{let N=Uo$(G,W,K);if(!X&&J>Z*2)X=!0,Q?.warn(`@smithy/util-stream - stream chunk size ${F} is below threshold of ${Z}, automatically buffering.`);if(N>=Z)Y.push(Ad(G,W))}}),$.on("end",()=>{if(W!==-1){let K=Ad(G,W);if(uw(K)>0)Y.push(K)}Y.push(null)}),Y}var Cw6=($,Z)=>{let{base64Encoder:Q,bodyLengthChecker:Y,checksumAlgorithmFn:X,checksumLocationName:J,streamHasher:G}=Z,W=Q!==void 0&&Y!==void 0&&X!==void 0&&J!==void 0&&G!==void 0,K=W?G(X,$):void 0,H=$.getReader();return new ReadableStream({async pull(F){let{value:U,done:N}=await H.read();if(N){if(F.enqueue(`0\r
@@ -3375,7 +3375,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${J.join(`
 `)}`:X}function dM6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var sa$=200,vM6=12,bM6,yM6=300,XI0=3;var LW1=O(()=>{pZ();l$();YI0();bM6={aheadBy:0,behindBy:0,files:[]}});function iM6($){if(!$||$.includes(".."))return!1;return mM6.test($)}function ea$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!iM6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function $e$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var mM6;var Ze$=O(()=>{mM6=/^[\w./@-]+$/});function a10($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function Ye$($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new iw(iZ);let J=await kL($.storage,X,Y);if(J&&await AN($.storage,J)){let F=await sH($,J,{forceRefresh:!0}).catch((U)=>{throw new iw(U instanceof Error?U.message:iZ)});await Qe$($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new iw("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await nu({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:iZ;throw new iw(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await aH(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=H3$(F instanceof Error?F.message:String(F));throw U?new iw(N):F});await Qe$($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function Qe$($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=yd($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await eL(K,pM6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var pM6=10485760,iw;var wW1=O(()=>{O3();tM0();fa();KG0();Ss();pZ();iw=class iw extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function tM6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!nM6.test(Z))throw Error(`Invalid branch name: ${$}`)}function sb($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(rM6)])}async function aM6($,Z){let Q=$.var.studioContext,Y=GF(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Bf(G?.metadata?.runtime);if(W)return W;let K=iz0(Z.virtualMcpMetadata),H=K==="cms"?await r31(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)ba(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function eM6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await iY($.var.studioContext)}catch{return null}}function ab($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function cd($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=a10(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no GitHub repository"});let J=i(Y);return iu(Y,J.id,X)}function jW1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=yJ$(Z);if(Y!==void 0)return $.json({error:Q},429,{...R5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof z6)return $.json({error:Q},409,R5);let X=E3(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,R5)}return $.json({error:Q},502,R5)}async function Ge$($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function We$($){try{let Z=await cd($),Q=await JI0(Z,$.get("vmClaim").branch);return $.json(Q,200,R5)}catch(Z){return jW1($,Z)}}function e10($,Z){let Y=(KI0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return KI0.set($,X),X.finally(()=>{if(KI0.get($)===X)KI0.delete($)}),Y}async function I7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,R5);let Y=Q?.runner??ab($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...R5}})}}let D=await B.text(),L=Q?.redactRepoDir?$I6(D):D,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...R5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let D=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${D}`},502)}}function $I6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function HI0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function ZI6($){return Ke$.includes($)}var nM6,Xe$=524288,oM6=65536,rM6=1e4,Je$=2000,sM6,KI0,R5,Ke$,He$=()=>{let $=new e0;$.use("/:virtualMcpId/:branch/*",sM6),$.post("/:virtualMcpId/:branch/write",(Q)=>I7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>I7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>I7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>I7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>I7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>I7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>I7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:sb(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return I7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return I7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>I7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>I7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!ZI6(Y))return Q.json({error:`step must be one of: ${Ke$.join(", ")}`},400);let X=Q.get("vmClaim"),J=await r31(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await eM6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,R5);if(Y==="start"){let G=i(Q.var.studioContext),W=ql(X.virtualMcpMetadata);try{await lz0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return I7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return PB(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Ka$(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return We$(Q);return Z(Q)});let Z=(Q)=>I7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Je$)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return We$(Q);return I7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(Je$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await cd(Q),G=await GI0(J,Y.branch,X.base);return Q.json(G,200,R5)}catch(X){return jW1(Q,X)}return I7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,R5);let Y=ab(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return e10(X,async()=>{try{await s31(W,Y,X);let K=a10(J,G);if(K)await Ye$(W,Y,X,K)}catch(K){if(K instanceof iw)return Q.json({error:K.message},403,R5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,R5)}return I7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return e10(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,R5);try{let G=await cd(Q);return await aa$(G,Y.branch,J),Q.json({ok:!0},200,R5)}catch(G){let W=E3(G)===409||G instanceof z6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,R5)}});return e10(Y.claimName,()=>I7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return e10(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await cd(Q),H=W.base??await K.getDefaultBranch();return await WI0(K,Y.branch,H),Q.json({ok:!0},200,R5)}catch(W){return jW1(Q,W)}});let X=ab(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return e10(J,async()=>{try{await s31(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,R5)}return I7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",l5({maxSize:Xe$,onError:(Q)=>Q.json({error:"Payload too large"},413,R5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ab(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,D]=$W1(F)&&N?[F,U]:X?await Promise.all([HI0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),HI0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await cd(Q);return Promise.all([JI0(w,Y.branch),GI0(w,Y.branch)])})();await kW(K,i(K).id,"suggesting a commit message");let L=await Ba$(K,B,D);return Q.json(L,200,R5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,R5);return Q.json({error:F},502,R5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",l5({maxSize:Xe$,onError:(Q)=>Q.json({error:"Payload too large"},413,R5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ab(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,D]=$W1(F)&&N?[F,U]:X?await Promise.all([HI0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),HI0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await cd(Q);return Promise.all([JI0(w,Y.branch),GI0(w,Y.branch)])})();await kW(K,i(K).id,"judging whether a change needs review");let L=await Oa$(K,B,D,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,R5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,R5);return Q.json({error:F},502,R5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=ab(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return Ge$(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",l5({maxSize:oM6,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=ab(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=ea$(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=$e$(J,W.resolveType);return Ge$(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var Fe$=O(()=>{y$();_K();xd();o31();Sa();Ja$();R3();Ml();Ga$();WK();jH();Wa$();Ha$();v$1();_a();YW1();La$();pZ();d6();LW1();Ze$();wW1();nM6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;sM6=nM0(async($,Z)=>{let Q=$.var.studioContext;try{p(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=c0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=i(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{tM6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=Za({orgId:X.id,virtualMcpId:J,branch:G}),H=await U11(Q,G),F=N11(H,Y),U=Xa$({userId:F,projectRef:K}),N=W.metadata??null,B=await aM6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let D;try{D=await iY(Q)}catch{D=null}if(!D)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:D,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});KI0=new Map;R5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Ke$=["clone","install","start"]});function Ue$($,Z,Q){let Y=EW1.get($);if(!Y)Y={pending:null,running:!1},EW1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)YI6($,Y);return J}async function YI6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await XI6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)EW1.delete($)}}async function XI6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await ld(Z,Q),W=await Z.listDecofileEntries(G,Y),K=BW1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let D=DW1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await na$(Z.repo,L);let w=D[0]??`${QI0(Y)}/${GW1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of D.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of DW1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await ta$(Z,F.values(),X),{decofile:B,skipped:D}=n10(N);if(D.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:nW(Z.repo),branch:Q,packagePath:Y,blocks:D.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:JI6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof z6)||J>=QI6-1)throw N;await P$(S7(2000,200,J,2,0.5))}}}function JI6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return g01(Y,$.deps.coAuthor)}var QI6=3,EW1;var Ne$=O(()=>{bE0();rM0();X6();l$();pZ();YI0();EW1=new Map});import{createHmac as Be$,randomBytes as GI6,timingSafeEqual as WI6}from"crypto";function De$(){if(FI0)return FI0;let $;try{let Z=O0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return FI0=$?Buffer.from($):GI6(32),FI0}function zW1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+KI6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=Be$("sha256",De$()).update(Y).digest("base64url");return`${Y}.${X}`}function Oe$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(Be$("sha256",De$()).update(Y).digest("base64url"));if(X.length!==J.length||!WI6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var KI6=21600000,FI0=null;var Le$=O(()=>{t1()});import{z as dd}from"zod";function FI6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&HI6.test($)}function Pe$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function $$0($){let Z=$.get("decofileScope");return iu($.var.studioContext,Z.organizationId,Z.githubRepo)}function Z$0($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof z6)return $.json({error:Q},409);let Y=E3(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function Ae$(){let $=new e0;return $.use("/:virtualMcpId/:branch",ze$),$.use("/:virtualMcpId/:branch/*",ze$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await oa$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=zW1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(Pe$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return Z$0(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await $$0(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return Z$0(Z,X)}}),$.patch("/:virtualMcpId/:branch",NI6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=BI6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{oM0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(JW1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await $$0(Z),W=await Ue$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:yd(Y)},J),K=zW1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:Pe$(Z)})}catch(G){return Z$0(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(E3(W)!==409)throw W;await WI0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(E3(G)===409)return Z.json({error:"merge-conflict"},409);if(E3(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return Z$0(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(E3(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return Z$0(Z,Y)}}),$}var HI6,we$=500,je$=1048576,Ee$=1024,UI6=8388608,NI6,BI6,ze$;var Te$=O(()=>{f$1();rM0();y$();_K();o31();tM0();wW1();pZ();Ne$();Le$();LW1();YI0();jH();HI6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;NI6=l5({maxSize:UI6,onError:($)=>$.json({error:"Payload too large"},413)}),BI6=dd.object({set:dd.record(dd.string(),dd.unknown()).optional(),delete:dd.array(dd.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=we$,{message:`Patch cannot touch more than ${we$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=je$),{message:`Each block must be at most ${je$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=Ee$),{message:`Each block key must be at most ${Ee$} characters`}),ze$=nM0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!FI6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Oe$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await sG(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!mz0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=a10(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var Re$=($)=>{let Z=new e0;if(Z.use("*",Dd),Z.use("*",en$),Z.route("/",YM0()),Z.route("/",bt$()),Z.route("/",Pt$()),Z.route("/",is$()),Z.route("/",xs$()),Z.route("/",cs$()),Z.route("/",gs$()),Z.route("/",mM0()),Z.route("/tools",as$()),Z.route("/",os$()),Z.route("/",Ds$({kvStorage:$.kvStorage})),Z.route("/",Ns$()),Z.route("/fs",Is$({getConnection:$.getNatsConnection})),Z.route("/sandbox",He$()),Z.route("/decofile",Ae$()),Z.route("/",vs$()),Z.route("/",ks$()),Z.route("/deco-sites",JM0()),Z.route("/hosting",Ft$()),Z.route("/monitor",wt$()),Z.route("/sso",aq0()),Z.route("/",iM0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Jt$()),$.mountDevAssets)Z.route("/dev-assets",HM0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Wi$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Cs$()),Z.route("/mcp",pA0()),Z.route("/mcp/self",lM0()),Z.route("/mcp",oA0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var qe$=O(()=>{y$();$t$();lq0();Gt$();LG1();Ut$();jt$();FM0();hb();UG1();PG1();Bs$();Os$();Vs$();Ss$();Ce();JG1();rA0();u31();_s$();fs$();ys$();hs$();d31();ps$();rs$();m31();es$();i31();nA0();Fe$();Te$()});function DI6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var OI6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Me$=()=>{let $=new e0;return $.use("*",OI6),$.get("/",async(Z)=>{let Q=O0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await GJ(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:DI6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var Ie$=O(()=>{y$();t1();cR0()});import{z as V1}from"zod";function iF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function qI6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function MI6($,Z,Q){try{return JSON.parse($)}catch{throw new Se$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function II6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:MI6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function VI6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?SJ(Q.function.parameters):SJ({type:"object",properties:{}});return[Q.function.name,X$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function kI6($){if(!$)return;return{openai:{response_format:$}}}function SI6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Ve$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function ke$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var LI6=256,wI6,jI6,EI6,zI6,PI6,AI6,TI6,RI6,Se$,Ce$,_e$;var ve$=O(()=>{b4();y$();xd();EK();wI6=V1.object({type:V1.literal("function"),function:V1.object({name:V1.string(),description:V1.string().optional(),parameters:V1.record(V1.string(),V1.unknown()).optional()})}),jI6=V1.object({id:V1.string(),type:V1.literal("function"),function:V1.object({name:V1.string(),arguments:V1.string()})}),EI6=V1.discriminatedUnion("role",[V1.object({role:V1.literal("system"),content:V1.string(),name:V1.string().optional()}),V1.object({role:V1.literal("user"),content:V1.union([V1.string(),V1.array(V1.union([V1.object({type:V1.literal("text"),text:V1.string()}),V1.object({type:V1.literal("image_url"),image_url:V1.object({url:V1.string(),detail:V1.string().optional()})})]))]),name:V1.string().optional()}),V1.object({role:V1.literal("assistant"),content:V1.string().nullable().optional(),name:V1.string().optional(),tool_calls:V1.array(jI6).optional()}),V1.object({role:V1.literal("tool"),content:V1.string(),tool_call_id:V1.string()})]),zI6=V1.object({type:V1.literal("text")}),PI6=V1.object({type:V1.literal("json_object")}),AI6=V1.object({type:V1.literal("json_schema"),json_schema:V1.object({name:V1.string(),description:V1.string().optional(),schema:V1.record(V1.string(),V1.unknown()),strict:V1.boolean().optional()})}),TI6=V1.union([zI6,PI6,AI6]),RI6=V1.object({model:V1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:V1.array(EI6),stream:V1.boolean().optional().default(!1),temperature:V1.number().min(0).max(2).optional(),max_tokens:V1.number().positive().optional(),top_p:V1.number().min(0).max(1).optional(),frequency_penalty:V1.number().min(-2).max(2).optional(),presence_penalty:V1.number().min(-2).max(2).optional(),stop:V1.union([V1.string(),V1.array(V1.string())]).optional(),tools:V1.array(wI6).optional(),tool_choice:V1.union([V1.literal("auto"),V1.literal("none"),V1.literal("required"),V1.object({type:V1.literal("function"),function:V1.object({name:V1.string()})})]).optional(),response_format:TI6.optional(),user:V1.string().optional()});Se$=class Se$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Ce$=new e0;Ce$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(iF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(iF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(iF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=RI6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(iF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=qI6(J.model);if(!G)return $.json(iF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>ZE(E.providerId));if(!j)return $.json(iF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(iF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=II6(J.messages),N=J.tools?VI6(J.tools):void 0,B=kI6(J.response_format),D=SI6(),L=Math.floor(Date.now()/1000);if(J.stream)return PB($,async(w)=>{let j=Ve$(F,U,N,J,B,$.req.raw.signal);try{let E=rL(j),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of E.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=LI6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:ke$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Ve$(F,U,N,J,B,$.req.raw.signal),j=await tL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:ke$(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(iF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(iF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(iF(X.message,"server_error"),500)}});_e$=Ce$});function CI6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function fe$(){let $=new e0;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=c0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!mZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||r5(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(EJ0(U)!==J)continue;if(!CI6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var be$=O(()=>{y$();L3()});var ye$;var xe$=O(()=>{ye$={name:"decocms",version:"4.371.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function fI6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??vI6}}var ge$,vI6="https://ph.studio.decocms.com",he$;var ue$=O(()=>{y$();Xr();gf();k5();t1();iJ1();xe$();ge$=new e0;ge$.get("/",($)=>{let Z={version:ye$.version,theme:L5$(),...iW().logo&&{logo:iW().logo},...pN()&&{internalUrl:sg1()},...O0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!O0().firecrawlApiKey,hostingEnabled:!!O0().controlplaneRestUrl&&!!O0().controlplaneServiceToken,hostingControlPlaneGa:O0().hostingControlPlaneGa,monitorEnabled:!!O0().clickhouseAnalyticsUrl&&!!O0().clickhouseAnalyticsPassword,monitorGa:O0().monitorGa,plansEnabled:O0().plansEnabled,auth:$n$(),posthog:fI6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:IB()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});he$=ge$});function md($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function PW1($){return(md($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ce$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(md($))}&sz=${Z}`}function le$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function de$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?le$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):le$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as m0}from"zod";var eb,bI6,xI6,yI6,gI6,me$;var ie$=O(()=>{eb=m0.enum(["good","bad","neutral"]),bI6=m0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},m0.object({kind:m0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:m0.coerce.string().optional(),tone:eb.optional(),muted:m0.boolean().optional(),delta:m0.coerce.string().optional(),deltaDir:m0.enum(["up","down","neutral"]).optional(),points:m0.array(m0.coerce.number()).optional(),label:m0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),xI6=m0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},m0.array(bI6)),yI6={key:m0.coerce.string(),title:m0.coerce.string(),eyebrow:m0.coerce.string().optional(),headline:m0.coerce.string(),annotation:m0.coerce.string().optional(),methodology:m0.coerce.string().optional(),sources:m0.array(m0.object({name:m0.coerce.string(),logoUrl:m0.coerce.string()})).optional()},gI6=m0.discriminatedUnion("template",[m0.object({template:m0.literal("cover"),score:m0.object({value:m0.coerce.number(),max:m0.coerce.number().optional(),grade:m0.coerce.string().optional(),label:m0.coerce.string().optional()}).optional(),brandImage:m0.coerce.string().optional(),screenshot:m0.coerce.string().optional(),mobileScreenshot:m0.coerce.string().optional()}),m0.object({template:m0.literal("cta"),ctaUrl:m0.coerce.string().optional(),ctaLabel:m0.coerce.string().optional(),bullets:m0.array(m0.coerce.string()).optional()}),m0.object({template:m0.literal("series"),points:m0.array(m0.coerce.number()).min(2),xLabels:m0.array(m0.coerce.string()).min(1),unit:m0.coerce.string().optional(),callout:m0.object({index:m0.coerce.number(),value:m0.coerce.string(),tone:eb.optional()})}),m0.object({template:m0.literal("threshold"),value:m0.coerce.string().default(""),metricLabel:m0.coerce.string().optional(),ratio:m0.coerce.number(),thresholdRatio:m0.coerce.number().optional(),thresholdLabel:m0.coerce.string().default(""),tone:eb.optional()}),m0.object({template:m0.literal("stats"),stats:m0.array(m0.object({value:m0.coerce.string(),label:m0.coerce.string(),tone:eb.optional()})).min(1)}),m0.object({template:m0.literal("bars"),items:m0.array(m0.object({value:m0.coerce.string(),label:m0.coerce.string(),ratio:m0.coerce.number(),tone:eb.optional()})).min(1)}),m0.object({template:m0.literal("gauges"),gauges:m0.array(m0.object({label:m0.coerce.string(),value:m0.coerce.string(),status:m0.enum(["good","warn","bad"]).catch("warn"),caption:m0.coerce.string().optional(),ratio:m0.coerce.number().optional()})).min(1)}),m0.object({template:m0.literal("checklist"),checks:m0.array(m0.object({label:m0.coerce.string(),status:m0.enum(["pass","fail","warn"]).catch("fail"),value:m0.coerce.string().optional()})).min(1)}),m0.object({template:m0.literal("table"),columns:m0.array(m0.object({label:m0.coerce.string(),align:m0.enum(["left","right"]).optional()})).min(1),rows:m0.array(xI6).min(1),highlightRow:m0.coerce.number().optional()}),m0.object({template:m0.literal("products"),products:m0.array(m0.object({name:m0.coerce.string(),price:m0.coerce.string().optional(),image:m0.coerce.string().optional(),url:m0.coerce.string().optional()})).min(1)}),m0.object({template:m0.literal("list"),entries:m0.array(m0.object({label:m0.coerce.string(),severity:m0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:m0.coerce.number().optional()}),m0.object({template:m0.literal("keywords"),volumeLabel:m0.coerce.string().optional(),keywords:m0.array(m0.object({term:m0.coerce.string(),volume:m0.coerce.string(),position:m0.coerce.number().catch(0)})).min(1)}),m0.object({template:m0.literal("competitor"),metricLabel:m0.coerce.string().optional(),competitors:m0.array(m0.object({name:m0.coerce.string(),value:m0.coerce.string(),tone:eb.optional(),isYou:m0.boolean().optional()})).min(1)}),m0.object({template:m0.literal("scorecard"),rivalLabel:m0.coerce.string().optional(),dimensions:m0.array(m0.object({label:m0.coerce.string(),you:m0.coerce.string(),rival:m0.coerce.string().optional(),rivalName:m0.coerce.string().optional(),tone:eb.optional()})).min(1)})]),me$=m0.object({...yI6,template:gI6})});function UI0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=me$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var AW1=O(()=>{ie$()});import{join as pe$}from"path";async function uI6($){try{let Z=await fetch(`${bH({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(hI6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=UI0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||PW1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function EG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function lI6($,Z){let Q=md($),Y=Z?.brand?.trim()||PW1(Q),X=ce$(Q,128),G=`${(O0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=de$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${EG(W)}</title>`,`<meta name="description" content="${EG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${EG(W)}" />`,`<meta property="og:description" content="${EG(K)}" />`,`<meta property="og:url" content="${EG(G)}" />`,`<meta property="og:image" content="${EG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${EG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${EG(W)}" />`,`<meta name="twitter:description" content="${EG(K)}" />`,`<meta name="twitter:image" content="${EG(H)}" />`,`<meta name="twitter:image:alt" content="${EG(F)}" />`,`<link rel="canonical" href="${EG(G)}" />`,`<link rel="icon" href="${EG(X)}" sizes="any" />`].join(`
+`;await na$(Z.repo,L);let w=D[0]??`${QI0(Y)}/${GW1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of D.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of DW1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await ta$(Z,F.values(),X),{decofile:B,skipped:D}=n10(N);if(D.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:nW(Z.repo),branch:Q,packagePath:Y,blocks:D.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:JI6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof z6)||J>=QI6-1)throw N;await P$(S7(2000,200,J,2,0.5))}}}function JI6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return g01(Y,$.deps.coAuthor)}var QI6=3,EW1;var Ne$=O(()=>{bE0();rM0();X6();l$();pZ();YI0();EW1=new Map});import{createHmac as Be$,randomBytes as GI6,timingSafeEqual as WI6}from"crypto";function De$(){if(FI0)return FI0;let $;try{let Z=O0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return FI0=$?Buffer.from($):GI6(32),FI0}function zW1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+KI6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=Be$("sha256",De$()).update(Y).digest("base64url");return`${Y}.${X}`}function Oe$($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(Be$("sha256",De$()).update(Y).digest("base64url"));if(X.length!==J.length||!WI6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var KI6=21600000,FI0=null;var Le$=O(()=>{t1()});import{z as dd}from"zod";function FI6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&HI6.test($)}function Pe$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function $$0($){let Z=$.get("decofileScope");return iu($.var.studioContext,Z.organizationId,Z.githubRepo)}function Z$0($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof z6)return $.json({error:Q},409);let Y=E3(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function Ae$(){let $=new e0;return $.use("/:virtualMcpId/:branch",ze$),$.use("/:virtualMcpId/:branch/*",ze$),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await oa$(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(X.decofile,200,{...J,"content-type":"application/json"});let G=zW1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(Pe$(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return Z$0(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await $$0(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return Z$0(Z,X)}}),$.patch("/:virtualMcpId/:branch",NI6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=BI6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{oM0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(JW1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await $$0(Z),W=await Ue$(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:yd(Y)},J),K=zW1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:Pe$(Z)})}catch(G){return Z$0(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(E3(W)!==409)throw W;await WI0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(E3(G)===409)return Z.json({error:"merge-conflict"},409);if(E3(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return Z$0(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $$0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(E3(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return Z$0(Z,Y)}}),$}var HI6,we$=500,je$=1048576,Ee$=1024,UI6=8388608,NI6,BI6,ze$;var Te$=O(()=>{f$1();rM0();y$();_K();o31();tM0();wW1();pZ();Ne$();Le$();LW1();YI0();jH();HI6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;NI6=l5({maxSize:UI6,onError:($)=>$.json({error:"Payload too large"},413)}),BI6=dd.object({set:dd.record(dd.string(),dd.unknown()).optional(),delete:dd.array(dd.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=we$,{message:`Patch cannot touch more than ${we$} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=je$),{message:`Each block must be at most ${je$} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=Ee$),{message:`Each block key must be at most ${Ee$} characters`}),ze$=nM0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!FI6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!Oe$(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await sG(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!mz0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=a10(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var Re$=($)=>{let Z=new e0;if(Z.use("*",Dd),Z.use("*",en$),Z.route("/",YM0()),Z.route("/",bt$()),Z.route("/",Pt$()),Z.route("/",is$()),Z.route("/",xs$()),Z.route("/",cs$()),Z.route("/",gs$()),Z.route("/",mM0()),Z.route("/tools",as$()),Z.route("/",os$()),Z.route("/",Ds$({kvStorage:$.kvStorage})),Z.route("/",Ns$()),Z.route("/fs",Is$({getConnection:$.getNatsConnection})),Z.route("/sandbox",He$()),Z.route("/decofile",Ae$()),Z.route("/",vs$()),Z.route("/",ks$()),Z.route("/deco-sites",JM0()),Z.route("/hosting",Ft$()),Z.route("/monitor",wt$()),Z.route("/sso",aq0()),Z.route("/",iM0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Jt$()),$.mountDevAssets)Z.route("/dev-assets",HM0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",Wi$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Cs$()),Z.route("/mcp",pA0()),Z.route("/mcp/self",lM0()),Z.route("/mcp",oA0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var qe$=O(()=>{y$();$t$();lq0();Gt$();LG1();Ut$();jt$();FM0();hb();UG1();PG1();Bs$();Os$();Vs$();Ss$();Ce();JG1();rA0();u31();_s$();fs$();ys$();hs$();d31();ps$();rs$();m31();es$();i31();nA0();Fe$();Te$()});function DI6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var OI6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Me$=()=>{let $=new e0;return $.use("*",OI6),$.get("/",async(Z)=>{let Q=O0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await GJ(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:DI6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var Ie$=O(()=>{y$();t1();cR0()});import{z as V1}from"zod";function iF($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function qI6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function MI6($,Z,Q){try{return JSON.parse($)}catch{throw new Se$(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function II6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:MI6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function VI6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?SJ(Q.function.parameters):SJ({type:"object",properties:{}});return[Q.function.name,X$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function kI6($){if(!$)return;return{openai:{response_format:$}}}function SI6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Ve$($,Z,Q,Y,X,J){let G={model:$,messages:Z,tools:Q,temperature:Y.temperature,maxTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function ke$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var LI6=256,wI6,jI6,EI6,zI6,PI6,AI6,TI6,RI6,Se$,Ce$,_e$;var ve$=O(()=>{b4();y$();xd();EK();wI6=V1.object({type:V1.literal("function"),function:V1.object({name:V1.string(),description:V1.string().optional(),parameters:V1.record(V1.string(),V1.unknown()).optional()})}),jI6=V1.object({id:V1.string(),type:V1.literal("function"),function:V1.object({name:V1.string(),arguments:V1.string()})}),EI6=V1.discriminatedUnion("role",[V1.object({role:V1.literal("system"),content:V1.string(),name:V1.string().optional()}),V1.object({role:V1.literal("user"),content:V1.union([V1.string(),V1.array(V1.union([V1.object({type:V1.literal("text"),text:V1.string()}),V1.object({type:V1.literal("image_url"),image_url:V1.object({url:V1.string(),detail:V1.string().optional()})})]))]),name:V1.string().optional()}),V1.object({role:V1.literal("assistant"),content:V1.string().nullable().optional(),name:V1.string().optional(),tool_calls:V1.array(jI6).optional()}),V1.object({role:V1.literal("tool"),content:V1.string(),tool_call_id:V1.string()})]),zI6=V1.object({type:V1.literal("text")}),PI6=V1.object({type:V1.literal("json_object")}),AI6=V1.object({type:V1.literal("json_schema"),json_schema:V1.object({name:V1.string(),description:V1.string().optional(),schema:V1.record(V1.string(),V1.unknown()),strict:V1.boolean().optional()})}),TI6=V1.union([zI6,PI6,AI6]),RI6=V1.object({model:V1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:V1.array(EI6),stream:V1.boolean().optional().default(!1),temperature:V1.number().min(0).max(2).optional(),max_tokens:V1.number().positive().optional(),top_p:V1.number().min(0).max(1).optional(),frequency_penalty:V1.number().min(-2).max(2).optional(),presence_penalty:V1.number().min(-2).max(2).optional(),stop:V1.union([V1.string(),V1.array(V1.string())]).optional(),tools:V1.array(wI6).optional(),tool_choice:V1.union([V1.literal("auto"),V1.literal("none"),V1.literal("required"),V1.object({type:V1.literal("function"),function:V1.object({name:V1.string()})})]).optional(),response_format:TI6.optional(),user:V1.string().optional()});Se$=class Se$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Ce$=new e0;Ce$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(iF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(iF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(iF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=RI6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(iF(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=qI6(J.model);if(!G)return $.json(iF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>ZE(E.providerId));if(!j)return $.json(iF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(iF(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=II6(J.messages),N=J.tools?VI6(J.tools):void 0,B=kI6(J.response_format),D=SI6(),L=Math.floor(Date.now()/1000);if(J.stream)return PB($,async(w)=>{let j=Ve$(F,U,N,J,B,$.req.raw.signal);try{let E=rL(j),z=!1,P=0,A="",q=async()=>{if(A.length===0)return;let k=A;A="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of E.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(A+=k.text,A.length>=LI6)await q()}else if(k.type==="tool-call"){await q();let M=P++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await q(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:ke$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await q(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=Ve$(F,U,N,J,B,$.req.raw.signal),j=await tL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:ke$(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(iF("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(iF(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(iF(X.message,"server_error"),500)}});_e$=Ce$});function CI6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function fe$(){let $=new e0;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=c0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!mZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||r5(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(EJ0(U)!==J)continue;if(!CI6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var be$=O(()=>{y$();L3()});var ye$;var xe$=O(()=>{ye$={name:"decocms",version:"4.371.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function fI6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??vI6}}var ge$,vI6="https://ph.studio.decocms.com",he$;var ue$=O(()=>{y$();Xr();gf();k5();t1();iJ1();xe$();ge$=new e0;ge$.get("/",($)=>{let Z={version:ye$.version,theme:L5$(),...iW().logo&&{logo:iW().logo},...pN()&&{internalUrl:sg1()},...O0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!O0().firecrawlApiKey,hostingEnabled:!!O0().controlplaneRestUrl&&!!O0().controlplaneServiceToken,hostingControlPlaneGa:O0().hostingControlPlaneGa,monitorEnabled:!!O0().clickhouseAnalyticsUrl&&!!O0().clickhouseAnalyticsPassword,monitorGa:O0().monitorGa,plansEnabled:O0().plansEnabled,auth:$n$(),posthog:fI6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:IB()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});he$=ge$});function md($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function PW1($){return(md($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ce$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(md($))}&sz=${Z}`}function le$($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function de$($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?le$(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):le$(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as m0}from"zod";var eb,bI6,xI6,yI6,gI6,me$;var ie$=O(()=>{eb=m0.enum(["good","bad","neutral"]),bI6=m0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},m0.object({kind:m0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:m0.coerce.string().optional(),tone:eb.optional(),muted:m0.boolean().optional(),delta:m0.coerce.string().optional(),deltaDir:m0.enum(["up","down","neutral"]).optional(),points:m0.array(m0.coerce.number()).optional(),label:m0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),xI6=m0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},m0.array(bI6)),yI6={key:m0.coerce.string(),title:m0.coerce.string(),eyebrow:m0.coerce.string().optional(),headline:m0.coerce.string(),annotation:m0.coerce.string().optional(),methodology:m0.coerce.string().optional(),sources:m0.array(m0.object({name:m0.coerce.string(),logoUrl:m0.coerce.string()})).optional()},gI6=m0.discriminatedUnion("template",[m0.object({template:m0.literal("cover"),score:m0.object({value:m0.coerce.number(),max:m0.coerce.number().optional(),grade:m0.coerce.string().optional(),label:m0.coerce.string().optional()}).optional(),brandImage:m0.coerce.string().optional(),screenshot:m0.coerce.string().optional(),mobileScreenshot:m0.coerce.string().optional()}),m0.object({template:m0.literal("cta"),ctaUrl:m0.coerce.string().optional(),ctaLabel:m0.coerce.string().optional(),bullets:m0.array(m0.coerce.string()).optional()}),m0.object({template:m0.literal("series"),points:m0.array(m0.coerce.number()).min(2),xLabels:m0.array(m0.coerce.string()).min(1),unit:m0.coerce.string().optional(),callout:m0.object({index:m0.coerce.number(),value:m0.coerce.string(),tone:eb.optional()})}),m0.object({template:m0.literal("threshold"),value:m0.coerce.string().default(""),metricLabel:m0.coerce.string().optional(),ratio:m0.coerce.number(),thresholdRatio:m0.coerce.number().optional(),thresholdLabel:m0.coerce.string().default(""),tone:eb.optional()}),m0.object({template:m0.literal("stats"),stats:m0.array(m0.object({value:m0.coerce.string(),label:m0.coerce.string(),tone:eb.optional()})).min(1)}),m0.object({template:m0.literal("bars"),items:m0.array(m0.object({value:m0.coerce.string(),label:m0.coerce.string(),ratio:m0.coerce.number(),tone:eb.optional()})).min(1)}),m0.object({template:m0.literal("gauges"),gauges:m0.array(m0.object({label:m0.coerce.string(),value:m0.coerce.string(),status:m0.enum(["good","warn","bad"]).catch("warn"),caption:m0.coerce.string().optional(),ratio:m0.coerce.number().optional()})).min(1)}),m0.object({template:m0.literal("checklist"),checks:m0.array(m0.object({label:m0.coerce.string(),status:m0.enum(["pass","fail","warn"]).catch("fail"),value:m0.coerce.string().optional()})).min(1)}),m0.object({template:m0.literal("table"),columns:m0.array(m0.object({label:m0.coerce.string(),align:m0.enum(["left","right"]).optional()})).min(1),rows:m0.array(xI6).min(1),highlightRow:m0.coerce.number().optional()}),m0.object({template:m0.literal("products"),products:m0.array(m0.object({name:m0.coerce.string(),price:m0.coerce.string().optional(),image:m0.coerce.string().optional(),url:m0.coerce.string().optional()})).min(1)}),m0.object({template:m0.literal("list"),entries:m0.array(m0.object({label:m0.coerce.string(),severity:m0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:m0.coerce.number().optional()}),m0.object({template:m0.literal("keywords"),volumeLabel:m0.coerce.string().optional(),keywords:m0.array(m0.object({term:m0.coerce.string(),volume:m0.coerce.string(),position:m0.coerce.number().catch(0)})).min(1)}),m0.object({template:m0.literal("competitor"),metricLabel:m0.coerce.string().optional(),competitors:m0.array(m0.object({name:m0.coerce.string(),value:m0.coerce.string(),tone:eb.optional(),isYou:m0.boolean().optional()})).min(1)}),m0.object({template:m0.literal("scorecard"),rivalLabel:m0.coerce.string().optional(),dimensions:m0.array(m0.object({label:m0.coerce.string(),you:m0.coerce.string(),rival:m0.coerce.string().optional(),rivalName:m0.coerce.string().optional(),tone:eb.optional()})).min(1)})]),me$=m0.object({...yI6,template:gI6})});function UI0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=me$.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var AW1=O(()=>{ie$()});import{join as pe$}from"path";async function uI6($){try{let Z=await fetch(`${bH({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(hI6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=UI0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||PW1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function EG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function lI6($,Z){let Q=md($),Y=Z?.brand?.trim()||PW1(Q),X=ce$(Q,128),G=`${(O0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=de$({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${EG(W)}</title>`,`<meta name="description" content="${EG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${EG(W)}" />`,`<meta property="og:description" content="${EG(K)}" />`,`<meta property="og:url" content="${EG(G)}" />`,`<meta property="og:image" content="${EG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${EG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${EG(W)}" />`,`<meta name="twitter:description" content="${EG(K)}" />`,`<meta name="twitter:image" content="${EG(H)}" />`,`<meta name="twitter:image:alt" content="${EG(F)}" />`,`<link rel="canonical" href="${EG(G)}" />`,`<link rel="icon" href="${EG(X)}" sizes="any" />`].join(`
     `)}function cI6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function ne$($){let Z=new e0;return Z.get("/:domain/og.png",async(Q)=>{let Y=md(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(pe$($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${bH({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(dI6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?pe$($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await uI6(md(Y)),K=lI6(Y,W);return Q.html(cI6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var hI6=2500,dI6=1e4;var te$=O(()=>{y$();AW1();cz();t1()});function Q$0($,Z){return fetch(`${bH({})}${$}`,Z)}async function mI6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",J=await Q$0(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(J.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!J.ok)throw Error(`report read HTTP ${J.status}`);let G=await J.json(),{deck:W,drops:K}=UI0(G);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:G.scanned_at,drops:K}}var iI6,TB,oe$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},re$;var se$=O(()=>{y$();oJ();cz();AW1();iI6=new Set(["complete","errored","terminated","unknown"]),TB=new e0;TB.use("*",async($,Z)=>{let Q=await G8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});TB.use("/link-token/*",oe$);TB.use("/suggest",oe$);TB.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let J=await mI6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!J.deck)return $.json(J);return $.json({...J,deck:{...J.deck,slides:J.deck.slides.slice(0,1)},truncated:J.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});TB.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,J=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let G=await Q$0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${lz({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:J})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});TB.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await Q$0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${lz({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:iI6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});TB.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await Q$0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});TB.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await Q$0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});re$=TB});var pI6=1048576,TW1;var ae$=O(()=>{y$();_K();t1();SJ1();TW1=new e0;TW1.post("/webhook",l5({maxSize:pI6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=O0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!Np$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=Bp$(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await Dp$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as nI6}from"crypto";function rI6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return nI6(Buffer.from(X),Buffer.from(Y))}function sI6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function ee$($){let Z=new e0;return Z.post("/webhook",l5({maxSize:tI6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!rI6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!oI6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await K11())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=sI6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await aI6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function aI6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await SA$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var tI6=5242880,oI6;var $08=O(()=>{y$();_K();WK();rZ();oI6=new Set(["check_suite","issue_comment"])});function Z08($){let Z=new UB($.db,new AY($.encryptionKey)),Q=new e0;return Q.get("/attachments/:token",async(Y)=>{let X=sz$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new KG(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var Q08=O(()=>{y$();DD();G81();Pf()});function Y08($){let Z=new UB($.db,new AY($.encryptionKey));async function Q(X,J){let G=dh$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await k3($.db,W.organizationId);if(!K)return;if(await mR0(K,W,G)==="started")console.log(`[jira-webhook] started a run for ${G.issueKey} entering "${G.toStatus}"`)}let Y=new e0;return Y.post("/webhook/:secret",l5({maxSize:eI6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var eI6=1048576;var X08=O(()=>{y$();_K();DD();iR0();kf()});import{DBOS as NI0,SchedulerMode as $V6}from"@dbos-inc/dbos-sdk";function G08($){qW1=$}function W08(){if(!qW1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return qW1}function K08(){let $=W08();return new UB($.db,new AY($.encryptionKey))}async function YV6($,Z){try{let Q=await K08().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await k3(W08().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let J=new KG(Q.siteUrl,Q.email,Q.apiToken),W=`(${await J.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${J08}m"`,K=0,H;for(let F=0;F<QV6;F++){let U=await J.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=mh$(N,N.changelog?.histories??[],Z);for(let D of B)if(await mR0(Y,Q,D)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function XV6($,Z){let Q=new Date($.getTime()-J08*60000),Y=await NI0.runStep(()=>K08().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((J)=>NI0.runStep(()=>YV6(J,Q),{name:`sweepJira:${J}`})));for(let J of X)if(J.error)console.warn(`[jira-trigger] integration ${J.integrationId} failed: ${J.error}`);else if(J.started>0)console.log(`[jira-trigger] integration ${J.integrationId} started ${J.started} run(s) the webhook missed`)}function H08(){if(RW1)return;RW1=NI0.registerWorkflow(XV6,{name:"jiraTriggerSweepWorkflow"}),NI0.registerScheduled(RW1,{name:"jiraTriggerSweepWorkflow",crontab:ZV6,mode:$V6.ExactlyOncePerIntervalWhenActive})}var ZV6="7-59/10 * * * *",J08=15,QV6=5,qW1=null,RW1=null;var F08=O(()=>{DD();kf();Pf();iR0()});function U08($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var N08,JV6,GV6,B08;var D08=O(()=>{y$();mW();ll();rz();N08=new e0,JV6=["range","if-none-match","if-modified-since"],GV6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];N08.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Bd($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new J$(401,{message:"Authentication required"})}if(!Q)throw new J$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new J$(400,{message:"Missing file key"});let X=await Ke(Y,Z);if(!X)throw new J$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&_X()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new J$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return U08(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of JV6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new J$(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new J$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of GV6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),U08(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});B08=N08});var Y$0=_(($x)=>{var WV6=$x&&$x.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),KV6=$x&&$x.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))WV6(Z,$,Q)};Object.defineProperty($x,"__esModule",{value:!0});KV6(OJ(),$x)});var w08=_((O08)=>{Object.defineProperty(O08,"__esModule",{value:!0});O08.version=void 0;O08.version="3.4.0"});var z08=_((pF)=>{var HV6=pF&&pF.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(pF,"__esModule",{value:!0});pF.NodeTransport=pF.VERSION=void 0;pF.nodeResolveHost=OV6;var L5=Y$0(),FV6=A0("net"),MW1=A0("tls"),UV6=A0("path"),j08=A0("fs"),NV6=HV6(A0("dns")),BV6=w08();pF.VERSION=BV6.version;var DV6="nats.js";class E08{socket;version;lang;yields=[];signal=(0,L5.deferred)();closedNotification=(0,L5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=DV6,this.version=pF.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,L5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw L5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new L5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new L5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,L5.deferred)(),Q,Y=(0,FV6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,L5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=L5.DataBuffer.concat(...this.yields),X=(0,L5.extractProtocolMessage)(Y);if(X!=="")try{let J=L5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,L5.deferred)();try{if($=(0,UV6.resolve)($),!(0,j08.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,j08.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,L5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new L5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,L5.deferred)();try{let X=(0,MW1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new L5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,L5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new L5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,L5.deferred)();try{let Y=(0,MW1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new L5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,L5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,L5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof MW1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,L5.render)($)}`);let Z=(0,L5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,L5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,L5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}pF.NodeTransport=E08;function OV6($){let Z=(0,L5.deferred)();return NV6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var q08=_((R08)=>{Object.defineProperty(R08,"__esModule",{value:!0});R08.connect=LV6;var P08=z08(),A08=Y$0(),T08=Y$0();function LV6($={}){if((0,T08.hasWsProtocol)($))return Promise.reject(T08.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,A08.setTransportFactory)({factory:()=>{return new P08.NodeTransport},dnsResolveFn:P08.nodeResolveHost}),A08.NatsConnectionImpl.connect($)}});var M08=_((RB)=>{var jV6=RB&&RB.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),EV6=RB&&RB.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))jV6(Z,$,Q)};Object.defineProperty(RB,"__esModule",{value:!0});RB.connect=void 0;var zV6=q08();Object.defineProperty(RB,"connect",{enumerable:!0,get:function(){return zV6.connect}});EV6(Y$0(),RB)});function S08($){let Z=$?.connectFn??RV6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:TV6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let L=S7(AV6,PV6,D-1,2,0.5);await P$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?I08.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=k08.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function RV6($){return V08.connect($)}var I08,V08,k08,PV6=100,AV6=3000,TV6=3000;var C08=O(()=>{l$();I08=V(Om(),1),V08=V(M08(),1),k08=V(QU(),1)});function IW1($,Z){return`${$}.${Z}`}class VW1{cache;constructor($){this.cache=Qd({ttlMs:$?.ttlMs??qV6,maxSize:$?.maxSize??MV6})}async get($,Z){return this.cache.get(IW1($,Z))??null}async set($,Z,Q){this.cache.set(IW1($,Z),Q)}async invalidate($,Z){this.cache.delete(IW1($,Z))}teardown(){this.cache.clear()}}var qV6=600000,MV6=5000;var _08=()=>{};function BI0($,Z){return`${$}:${Z}`}function kW1($){let Z=Qd({ttlMs:$?.ttlMs??IV6,maxSize:$?.maxSize??VV6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(v08,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(BI0(K,H))},set(K,H,F){Z.set(BI0(K,H),F)},invalidate(K,H){Z.delete(BI0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(v08),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(BI0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var v08="studio.ai-provider-keys.invalidate",IV6=30000,VV6=5000;var f08=()=>{};class SW1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var b08=($)=>{let Z;return()=>Z??=$()},CW1,_W1;var x08=O(()=>{W6();CW1=b08(()=>Q$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),_W1=b08(()=>Q$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function bV6($=h08){return{name:EF,subjects:[`${Q61}.>`],storage:bK.StorageType.File,max_age:CV6,max_bytes:vV6,max_msgs_per_subject:fV6,discard:bK.DiscardPolicy.Old,retention:bK.RetentionPolicy.Limits,duplicate_window:_V6,num_replicas:$}}class u08{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function y08($){let Z=g08.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function hV6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,SV6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function uV6($,Z){return $.info?.cluster?Z:1}function lV6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class vW1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=bV6(X);try{await Y.streams.info(EF),await Y.streams.update(EF,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(EF,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(EF),await Y.streams.add(J);else throw G}},Q=await N8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await bK.jetstreamManager($),X=uV6($,h08);try{await Z(Y,X)}catch(J){if(X<=1||!lV6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:sl});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=hV6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=NR$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=X61(H,{runId:Z}),N=performance.now()-F;CW1().record(N),_W1().add(1,{"org.id":Y??"unknown"}),gV6?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?y08(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),yV6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await N8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:y08(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:sl}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=X61(Z,{runId:$,dedup:Q});CW1().record(performance.now()-X),_W1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=UR$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?bK.DeliverPolicy.New:bK.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=Fw($),W;try{W=await N8(async()=>{return(await Y.consumers.get(EF,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:sl})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=jA0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(DA0()).pipeThrough(OA0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){D(),L.close();return}let E=j;if(E.kind==="done"){if(J){D(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(EF,{filter:Fw($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var bK,g08,kV6=($)=>{let Z;return()=>Z??=$()},SV6,CV6=86400000000000,_V6=120000000000,vV6=4294967296,h08,fV6=500000,xV6,yV6,gV6;var l08=O(()=>{l$();J61();EA0();LA0();W6();x08();bK=V(QU(),1),g08=V(Om(),1),SV6=kV6(()=>Q$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),h08=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);xV6=process.env.STREAM_ENCODE_TRACE==="1",yV6=process.env.DECOPILOT_STREAM_TRACE==="1";gV6=xV6?new u08:null});function DI0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,$H(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var c08=O(()=>{q8()});class fW1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function cV6($,Z){let Q=$.startsWith("thread:")?KK($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function d08($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await WF($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await Fl($,{threadId:X,runBranch:G?.branch}),K=cV6(W,await mE0($,X)),H=await Ms($,Q,xa0(J)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await S3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var m08=O(()=>{pZ();R3();rZ()});async function i08($,Z,Q){let Y=Z.organizationId;if(!rX(Z))return!1;if(!If(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=tH(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await y6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),F8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var p08=O(()=>{A4();$Y();xl();OK();B9()});function oV6($){return $ instanceof yY}function rV6($,Z){return Z-$>=nV6}class bW1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??dV6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??iV6,Q=this.options.itemIntervalMs??mV6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-$81),N41);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-tV6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await H41(this.taskBoard,X,Y),await F41(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==T$.progress||G.assigneeId!==o$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await LK(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),oV6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+pV6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==T$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),F8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!rV6(DN(Q,Z.reviewCycleStartedAt),Date.now()))return;await LF($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!rX(Y))return!1;let X=Y.assigneeId===o$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await d08(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await gl(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await i08(G,Y,W))return!0;if(await Qq$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!J41(W))return!1;return await CP0(G,Y,{previewMatchesHead:G41(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await Jw($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var dV6=60000,mV6=300000,iV6=50,pV6=60000,nV6=900000,tV6=120000;var n08=O(()=>{A4();n81();m08();wF();Ee();OK();p08();B9();j3();B41();rZ();Xe();yl()});import{readdir as sV6,rm as OI0}from"fs/promises";import{join as LI0}from"path";async function wI0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-aV6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Zx($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await t08($,X,Z);else if(!X.startsWith(".")){let J=LI0($,X),G=await Zx(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await t08(J,K,Z)}if((await Zx(J)).length===0)await OI0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function t08($,Z,Q){let Y=0,X=LI0($,Z),J=await Zx(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=LI0(X,W),H=await Zx(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=LI0(K,U);await OI0(B,{recursive:!0,force:!0}),Y++}}if((await Zx(K)).length===0)await OI0(K,{recursive:!0,force:!0})}if((await Zx(X)).length===0)await OI0(X,{recursive:!0,force:!0});return Y}async function Zx($){try{return(await sV6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var aV6=30;var xW1=()=>{};import{DBOS as yW1,SchedulerMode as eV6}from"@dbos-inc/dbos-sdk";async function Zk6(){let $=[n3(),Qx(),oF()],Z=0;for(let Q of $)try{Z+=await wI0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function Qk6($,Z){await yW1.runStep(()=>Zk6(),{name:"monitoringRetention"})}function r08(){if(o08)return;o08=!0;let $=yW1.registerWorkflow(Qk6,{name:"monitoringRetentionWorkflow"});yW1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:$k6,mode:eV6.ExactlyOncePerIntervalWhenActive})}var $k6="23 4 * * *",o08=!1;var s08=O(()=>{RG();xW1()});function a08($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await XQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await ZP($.db,Z,Y.role);return X.boundAuth=AJ1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new YE(Q,void 0,X.boundAuth,Y.role,"self"),Gw(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var e08=O(()=>{OW();mH()});function Yk6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Xk6(){return{services:Yk6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function Gk6(){for(let $ of Jk6)$()}function $18($){let Z=[...gW1.logs,$];gW1={...gW1,logs:Z.length>500?Z.slice(-500):Z},Gk6()}function hW1(){return Wk6}var gW1,Jk6,Wk6=!1;var uW1=O(()=>{gW1=Xk6(),Jk6=new Set});import{EventEmitter as Kk6}from"events";var lW1;var Z18=O(()=>{uW1();lW1=new Kk6;lW1.on("request",($)=>{$18($)})});function Q18(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=id(N.params.name),D=N.params.arguments||{},L=Object.keys(D).map((j)=>id(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${q5.tool}${B}${q5.dim}(${w})${q5.reset}`}else if(N.method)J=`${q5.dim}${id(N.method)}${q5.reset}`}}catch{}}let W=id(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${q5.mcp}${id(F.slice(0,12))}\u2026${q5.reset}`}else if(X==="/mcp")W=`${q5.mcp}/mcp${q5.reset}`;else if(X==="/mcp/registry")W=`${q5.mcp}/mcp/registry${q5.reset}`;let K=Fk6(Y),H=G?"\u25C0":"\u2190";if(!hW1())console.log(`${q5.dim}${H}${q5.reset} ${K}${Y}${q5.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=Hk6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";if(!hW1())console.log(`${q5.dim}${D}${q5.reset} ${K}${Y}${q5.reset} ${W}${J?` ${J}`:""} ${N}${U}${q5.reset} ${q5.duration}${B}${q5.reset}`);lW1.emit("request",{method:Y,path:id(X),status:U,duration:F,timestamp:new Date})}}}var q5,Hk6=($)=>{if($>=500)return q5.serverError;if($>=400)return q5.clientError;if($>=300)return q5.redirect;return q5.ok},Fk6=($)=>{return q5[$]||q5.reset},id=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Y18=O(()=>{uW1();Z18();q5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as W18}from"crypto";import{mkdir as Uk6,readdir as Nk6,rm as X18,stat as K18}from"fs/promises";import{join as dW1,relative as Bk6}from"path";import{z as V$}from"zod";function F18($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return dW1(Dk6,Z)}function U18($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function cW1($,Z){let Q=F18($),Y=U18(Z);return dW1(Q,Y)}function Ok6($,Z,Q,Y){let X=O0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return W18("sha256",X).update(J).digest("hex")}function G18($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=Ok6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${U18(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function N18($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${W18("md5","etag").update(Y).digest("hex")}"`}async function B18($,Z,Q,Y,X){try{let J=await Nk6($,{withFileTypes:!0});for(let G of J){let W=dW1($,G.name),H=Bk6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await B18(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await K18(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:N18(W,F.mtime,F.size)})}catch{}}}}catch{}}function D18($,Z){let Y=i($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:V$.object({prefix:V$.string().optional(),maxKeys:V$.number().optional().default(1000),continuationToken:V$.string().optional(),delimiter:V$.string().optional()}),outputSchema:V$.object({objects:V$.array(V$.object({key:V$.string(),size:V$.number(),lastModified:V$.string(),etag:V$.string()})),nextContinuationToken:V$.string().optional(),isTruncated:V$.boolean(),commonPrefixes:V$.array(V$.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=F18(Y);await Uk6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await B18(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,L=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:V$.object({key:V$.string()}),outputSchema:V$.object({contentType:V$.string().optional(),contentLength:V$.number(),lastModified:V$.string(),etag:V$.string(),metadata:V$.record(V$.string(),V$.string()).optional()}),handler:async(X)=>{let J=X,G=cW1(Y,J.key),W=await K18(G);return{contentType:EG1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:N18(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:V$.object({key:V$.string(),expiresIn:V$.number().optional()}),outputSchema:V$.object({url:V$.string(),expiresIn:V$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??J18;return{url:G18(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:V$.object({key:V$.string(),expiresIn:V$.number().optional(),contentType:V$.string().optional()}),outputSchema:V$.object({url:V$.string(),expiresIn:V$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??J18;return{url:G18(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:V$.object({key:V$.string()}),outputSchema:V$.object({success:V$.boolean(),key:V$.string()}),handler:async(X)=>{let J=X,G=cW1(Y,J.key);try{return await X18(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:V$.object({keys:V$.array(V$.string()).max(1000)}),outputSchema:V$.object({deleted:V$.array(V$.string()),errors:V$.array(V$.object({key:V$.string(),message:V$.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=cW1(Y,K);try{await X18(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function mW1($,Z,Q){let Y=D18(Z,Q),X=new RH({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:f5});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:V$.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:V$.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new nY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),x3(X,J,$,"mcp:dev-assets")}async function O18($,Z,Q,Y){let J=D18(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var Dk6="./data/assets",J18=3600,H18,L18;var w18=O(()=>{t1();Xc();y$();zt();ef();hQ();FM0();H18=new e0;H18.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return mW1($.req.raw,Z,Y)});L18=H18});var j18={};q4(j18,{mountDevRoutes:()=>Lk6});function Lk6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return mW1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await O18(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",L18);let Q=new e0;Q.use("*",vK({mountPath:"/api/dev-assets"})),Q.route("/",HM0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var E18=O(()=>{y$();NG1();FM0();w18()});import{sql as wk6}from"kysely";import{randomUUID as z18}from"crypto";import{z as jk6}from"zod";async function zk6($){let Z=new Date().toISOString(),Q=z18(),Y=R8.SELF($.organizationId),X="registry.publish_request.created",J={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:Q,organization_id:$.organizationId,type:"registry.publish_request.created",source:Y,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(J),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let G=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Y)])).execute();if(G.length>0)await $.db.insertInto("event_deliveries").values(G.map((W)=>({id:z18(),event_id:Q,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await wk6`SELECT
       pg_notify('studio_events', ${Q}),