decocms 4.422.2 → 4.423.0

package/dist/server/server.js

@@ -1339,7 +1339,7 @@ Use git CLI for local working tree, branch, history, rebase, commit, and push op
 Use the tools for the checkout's actual git provider for pull or merge requests, reviews, comments, issues, and remote repository operations. Inspect \`git remote get-url origin\` before choosing a provider CLI; GitHub uses \`gh\`, GitLab uses \`glab\`, and Bitbucket uses its API.${X}${$?.isDecoSite?`
 
 ${La4}`:""}
-</coding-workspace>`}var La4="This is a Deco CMS site (its repository contains a `.deco/` directory). These rules apply to content changes (page copy, section props, loader config, site settings):\n\n- CMS content lives in `.deco/blocks/<encoded-key>.json` \u2014 one JSON file per block, filename is the URI-encoded block key. Edit ONLY the matching `.deco/blocks/*.json` file(s).\n- NEVER edit generated artifacts: `blocks.gen.json`, `blocks.gen.ts`, `meta.gen.json`, or any other `*.gen.*` file. They are regenerated from `.deco/blocks/` by the dev server and by every production build \u2014 an edit there looks correct in the preview but is silently discarded on deploy.\n- Do not touch any other file to make a content change visible: the dev server watches `.deco/blocks/` and hot-reloads the preview, and production builds/content syncs read `.deco/blocks/` directly. Committing the `.deco/blocks/*.json` change is all that is needed.\n- After making a CMS content change, check the repo's AGENTS.md: if it is missing or does not document these `.deco/` content rules, add a short \"Deco CMS content\" section (creating AGENTS.md if needed) so other tools working in this repo follow the same rules. If AGENTS.md already documents them, leave it untouched.";function wa4($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function ja4($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((Q,Y)=>{let X=()=>{Z.catch(()=>{}),Y($.reason??Error("aborted"))};$.addEventListener("abort",X,{once:!0}),Z.then(Q,Y).finally(()=>{$.removeEventListener("abort",X)})})}async function Ea4($,Z,Q,Y,X){let J=X?.timeoutMs??wa4(Y),G=AbortSignal.timeout(J),W=X?.signal?AbortSignal.any([X.signal,G]):G,K,H;try{let U=new Headers({"content-type":"application/json"});if(X?.threadId)U.set("x-thread-id",X.threadId);let N={method:"POST",headers:U,body:JSON.stringify(Y),signal:W};({res:K,rawText:H}=await ja4(W,(async()=>{let B=await $.proxyDaemonRequest(Z,Q,N);return{res:B,rawText:await B.text()}})()))}catch(U){if(X?.signal?.aborted)throw U;if(G.aborted)throw Error(`Sandbox POST ${Q} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Y$0(U)}let F;try{F=JSON.parse(H)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response provider=agent-sandbox path=%s status=%d rawText=%s",Q,K.status,H.slice(0,2000));let U=K.status>=500?" (server error)":K.status===0?" (no response)":"";throw Error(`Daemon ${Q} returned invalid JSON (HTTP ${K.status}${U}): ${H.slice(0,800)}`)}if(!K.ok){console.error("[sandbox-fs-hooks] Non-OK response provider=agent-sandbox path=%s status=%d body=%s",Q,K.status,H.slice(0,2000));let U=F.error??`Daemon ${Q} failed (${K.status})`;if(K.status===404&&U==="sandbox not found")throw new Y$0(Error(U),!0);throw Error(U)}return F}function sZ1($,Z){let{ensureHandle:Q,invalidateHandle:Y,canAutoRestart:X}=Z,J=0,G=(H)=>{let F=Date.now();if(F-J<300000)return;J=F,$.renewTtl(H).catch((U)=>{console.warn(`[sandbox-fs-hooks] TTL renew failed for ${H}: ${U instanceof Error?U.message:String(U)}`)})},W=(H)=>{let F=H instanceof Error?H.message:String(H);return X?`Sandbox is unreachable and auto-restart did not recover it: ${F}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},K=async(H,F,U)=>{let N=async(O)=>Ea4($,O,H,F,{signal:U,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),B=await Q();G(B);try{return await N(B)}catch(O){if(!(O instanceof Y$0))throw O;if(!X&&!O.gone)throw Error(W(O.cause??O));console.warn(`[sandbox-fs-hooks] daemon ${H} unreachable \u2014 reaping sandbox and retrying once`,O.cause??O);try{await Y({force:O.gone})}catch(w){console.warn("[sandbox-fs-hooks] invalidateHandle failed",w)}let L;try{L=await Q()}catch(w){throw Error(`Failed to restart sandbox: ${w instanceof Error?w.message:String(w)}`)}try{return await N(L)}catch(w){if(w instanceof Y$0)throw Error(W(w.cause??w));throw w}}};return{onProxy:(H,F,U)=>K(H,F,U),onBash:async(H,F)=>{return await K("/_sandbox/bash",{command:H,...F?.cwd!==void 0?{cwd:F.cwd}:{},...F?.timeoutMs!==void 0?{timeout:F.timeoutMs}:{}})}}}var Y$0;var yS$=D(()=>{Y$0=class Y$0 extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});var Zd=D(()=>{Im();KT0();yS$()});function za4($){let{publicUrl:Z,agentId:Q,organization:Y,target:X,threadId:J}=$;if(X==="agent-tools")return`${Z}/mcp/virtual-mcp/${encodeURIComponent(Q)}`;if(!Y.slug)throw new hS$(Y.id,X);if(X==="task-run"){if(!J)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Y.slug}/mcp/task-run/${encodeURIComponent(J)}`}return`${Z}/api/${Y.slug}/mcp/self`}async function DR0($,Z,Q,Y,X="agent-tools",J,G={"*":["*"]}){let W=za4({publicUrl:l5(),agentId:Z,organization:Q,target:X,...J?{threadId:J}:{}}),K=await $.boundAuth.apiKey.create({name:Y,permissions:G,expiresIn:gS$,metadata:{organization:{id:Q.id,slug:Q.slug,name:Q.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":Q.id},expiresAt:Date.now()+gS$*1000}}function uS$($){let{publicUrl:Z,organizationSlug:Q,headers:Y,connections:X}=$,J=new Set;return X.map((G)=>{let W=Pa4(G.slug??G.title??"")||"mcp",K=W;for(let H=2;J.has(K);H++)K=`${W}-${H}`;return J.add(K),{name:K,url:`${Z}/api/${Q}/mcp/${encodeURIComponent(G.id)}`,headers:Y}})}function Pa4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function lS$($){return{self:[...$.toolNames],...$.grants}}var gS$=3600,hS$;var aZ1=D(()=>{M9();hS$=class hS$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});var X$0;var eZ1=D(()=>{X$0={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function Qd($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let Q=Z.env;if(!Array.isArray(Q))return null;let Y=[];for(let X of Q){if(!X||typeof X!=="object")continue;let J=X;if(typeof J.key!=="string"||!CQ0.test(J.key))continue;if(J.kind==="literal"&&typeof J.value==="string"){Y.push({key:J.key,kind:"literal",value:J.value});continue}if(J.kind==="secret"&&typeof J.secretId==="string"&&J.secretId.length>0)Y.push({key:J.key,kind:"secret",secretId:J.secretId})}return Y.length===0?null:Y}async function cS$($,Z){t(Z);let Q=G0(Z);await Z.access.check();let Y=d0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=s9(J),W=await Uf(Z,$.branch,Y),K=PH(G,W,$.branch);return{virtualMcp:X,metadata:J,userId:Y,sandboxUserId:W,entry:K,organization:Q}}function Aa4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function mS$($){let Z=$.runtime??null,Y=Z?.selected??null,X=Aa4(Z?.port??null),J=Z?.path??null;if(!Y||!(Y in X$0))return{packageManager:null,runtime:null,port:X,packageManagerPath:J,runtimeBinPath:null};let G=X$0[Y].runtime;return{packageManager:Y,runtime:G,port:X,packageManagerPath:J,runtimeBinPath:G==="deno"?"/opt/deno/bin":G==="bun"?"/opt/bun/bin":null}}var J$0=D(()=>{p8();eZ1();uJ();xW()});async function ZE($,Z){let Q=$.body?.getReader();if(!Q)return $.text();let Y=new TextDecoder,X="",J=0;for(;;){let{done:G,value:W}=await Q.read();if(G)break;if(J+=W.byteLength,J>Z)throw await Q.cancel().catch(()=>{}),new dS$(`Upstream response exceeded ${Z} bytes`);X+=Y.decode(W,{stream:!0})}return X+=Y.decode(),X}var dS$;var G$0=D(()=>{dS$=class dS$ extends Error{}});async function OR0({ctx:$,runner:Z,handle:Q,orgId:Y,userId:X,entries:J}){if(!J||J.length===0)return;let G={};for(let K of J){if(K.kind==="literal"){G[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Y,X);G[K.key]=H}catch(H){if(H instanceof bW||H instanceof ij){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(G).length===0)return;let W=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:G})});if(!W.ok){let K=await ZE(W,Ta4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var Ta4=10485760;var $71=D(()=>{R10();G$0()});async function nS$($,Z,Q,Y,X){let J=await J3({connectionId:$,tokenStorage:new L9(Y,X)});if(!J.accessToken)return null;return oS$(Z,Q,J.accessToken)}function tS$($,Z){return oS$($,Z,null)}async function oS$($,Z,Q){let Y=new Map,X=new Set(iS$.map((K)=>K.path));for(let K of Object.values(pS$))for(let H of K??[])X.add(H);await Promise.all(Array.from(X).map(async(K)=>{Y.set(K,await qa4($,Z,K,Q))}));let J=iS$.find(({path:K})=>Y.get(K)!==null);if(!J)return null;let G=pS$[J.pm]??[],W=null;for(let K of G)if(W=Ma4(Y.get(K)??null),W)break;return{packageManager:J.pm,devPort:W}}async function qa4($,Z,Q,Y){let X=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(Q)}`;try{let J={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Y)J.Authorization=`token ${Y}`;let G=await fetch(X,{headers:J,signal:AbortSignal.timeout(5000)});if(!G.ok)return null;let W=await G.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function Ma4($){if(!$)return null;try{let Z=JSON.parse($),Q=Z.tasks??Z.scripts??{},X=(Q.dev??Q.start??"").match(Ra4)?.[1]??null;if(!X)return null;let J=Number(X);return J>=1&&J<=65535?X:null}catch{return null}}var iS$,pS$,Ra4;var rS$=D(()=>{TW();HH();iS$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],pS$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Ra4=/(?:--port|PORT=|:)(\d{4,5})/});function Ia4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function LR0($){return $?.name||$?.email?.split("@")[0]||void 0}function wR0($){let Z=Ia4($),Q=Date.now().toString(36).split("").reverse().join("");return`${Z}-${Q}`}async function eS$($,Z){sS$??=e1.createHistogram("studio.sandbox.provision.duration_ms",{description:"Wall-clock time of one sandbox ensure, by provider (runner_kind), outcome, the provider a fallback left (fallback_from), and whether a sandbox was already recorded (start=resume) or not (start=fresh).",unit:"ms",advice:{explicitBucketBoundaries:[500,1000,2000,5000,1e4,20000,30000,60000,120000,300000,600000]}}),aS$??=e1.createCounter("studio.sandbox.placement",{description:"Sandbox ensures by the provider that served them (runner_kind) and why it was chosen (reason)."});let Q=performance.now(),Y=(X,J,G)=>sS$?.record(performance.now()-Q,{...$,runner_kind:X?jD[X]:"unknown",outcome:J,...G&&{fallback_from:jD[G]}});try{let X=await Z();if(Y(X.provider,"ok",X.placement?.fallbackFrom),X.placement)aS$.add(1,{runner_kind:jD[X.provider],reason:X.placement.reason});return X}catch(X){throw Y(F91(X),"error"),X}}var sS$,aS$;var $C$=D(()=>{Zd();k6()});async function W$0($,Z,Q){try{await $.storage.threads.stampRuntimeIfAbsent(Z,Q)}catch(Y){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Y instanceof Error?Y.message:String(Y)}`)}}function ZC$($){let Z=$?.trim();if(!Z)return null;try{let Q=new URL(Z);if(Q.protocol!=="http:"&&Q.protocol!=="https:")return null;return Q.href}catch{return null}}function Yd($){return ZC$($?.previewServerUrl)??ZC$($?.productionUrl)}var jR0=()=>{};function Ef($){return $==="cms"||$==="sandbox"?$:null}function Va4($){return!!Yd($)&&$?.fastPreview===!0}function ER0($){return Va4($)?"cms":"sandbox"}var Z71;var Xd=D(()=>{jR0();Z71=["cms","sandbox"]});import{z as yU}from"zod";async function Jd($,Z){t(Z);let Q=G0(Z),Y=d0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=await Uf(Z,$.branch,Y),W=PH(s9(J),G,$.branch),K=await gX(Z);if(W){if(await K.alive(W.sandboxHandle).catch(()=>!0))return W;await pj(Z.storage.virtualMcps,$.virtualMcpId,Y,G,$.branch).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let H=CU($.branch)??Z.metadata?.threadId;if(H)W$0(Z,H,"sandbox");let U=await _U(Z,H)??J.repository??null;await $.onColdStart?.().catch(()=>{});let{entry:N,warmPoolAdopted:B}=await XC$({ctx:Z,userId:Y,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:J,repository:U,threadRepos:await M91(Z,H),existing:null,runner:K,...$.purpose?{purpose:$.purpose}:{}});return $.onBound?.({warmPoolAdopted:B}),N}async function YC$($,Z,Q){if(!Z)return null;if(Z.accountId===null&&!Q&&!Z.legacyConnectionId)return Z;return await HD($.storage,Z)?Z:null}async function ka4($){let Z=$.repos.filter((X)=>!$.primary||!FB(X,$.primary)),Q=I10(Z),Y=[];for(let[X,J]of Z.entries())try{let G=await kj($.ctx.storage,$.orgId,J),W=await YC$($.ctx,G,J.connectionId),K=J.connectionId??G?.legacyConnectionId;if(!W&&!K)continue;let{cloneUrl:H,expiresAt:F}=W?await zU($.ctx,W,{forceRefresh:!0}):await AU(K,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:H,credentialExpiresAt:I51(F),...W?{repositoryId:W.id}:{connectionId:K},userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:W?W.path:`${J.owner}/${J.name}`,directoryName:Q[X],submoduleCredentials:$.submoduleCredentials})}catch(G){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,G instanceof Error?G.message:G)}return Y}async function XC$($){let{ctx:Z,userId:Q,sandboxUserId:Y,orgId:X,virtualMcpId:J,branch:G,metadata:W,threadRepos:K,existing:H,runner:F,purpose:U,provider:N}=$,B=U==="harness-run",O="default",L=$.repository?await Sa4({ctx:Z,orgId:X,virtualMcpId:J,userId:Q,repository:$.repository}):null,{runtime:w,packageManager:j,port:E,packageManagerPath:z}=mS$(W),T=await Z.storage.organizationSettings.get(X),P=await OT0({ctx:Z,orgId:X,userId:Q,entries:T?.submodule_credentials}),A;if(L){let Z0=await kj(Z.storage,X,L);O=Z0?.sandboxImage??"default";let s=await YC$(Z,Z0,L.connectionId),Q0=L.connectionId??Z0?.legacyConnectionId??void 0;if(!s&&Q0)await Km({ctx:Z,connectionId:Q0,organizationId:X,forceRefresh:!0,onLegacyMintError:(n0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:Q0,error:n0.message})}});let{cloneUrl:u0,gitUserName:_0,gitUserEmail:D1,expiresAt:i0}=s?await xa4(Z,s):Q0?await AU(Q0,L.owner,L.name,Z.db,Z.vault):vO$(L.owner,L.name);if(!j&&!s){let n0=Q0?await nS$(Q0,L.owner,L.name,Z.db,Z.vault):await tS$(L.owner,L.name);if(n0)j=n0.packageManager,w=X$0[n0.packageManager].runtime,E=n0.devPort??E,await Ca4(Z,J,Q,n0.packageManager,n0.devPort)}let j0=E0().sandboxStickyHeadRefEnabled,z0=NH0({branch:G,derivedRef:AH(G,{flat:Ff(Z0?.provider)}),recordedHeadRef:j0?await LT0(Z,CU(G)):null,sticky:j0});A={cloneUrl:u0,credentialExpiresAt:I51(i0),...s?{repositoryId:s.id}:Q0?{connectionId:Q0}:{},userName:_0,userEmail:D1,branch:z0,displayName:s?s.path:`${L.owner}/${L.name}`,submoduleCredentials:P}}let q=await ka4({ctx:Z,orgId:X,repos:K??[],primary:L,gitUserName:A?.userName??"",gitUserEmail:A?.userEmail??"",submoduleCredentials:P}),x=w&&j&&!B?{runtime:w,packageManager:j,...E!==null?{devPort:Number(E)}:{},...z?{packageManagerPath:z}:{}}:void 0,_=H10({orgId:X,virtualMcpId:J,branch:G}),V=!E0().orgFsMountsDisabled,y;if(V){let Z0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(Z0)y=await EH0(Z,{orgSlug:Z0,orgId:X,baseUrl:l5()})}await ba4(F);let g=await eS$({start:H?"resume":"fresh",purpose:U??"interactive"},()=>va4(F,{userId:Y,projectRef:_},{branch:G,repo:A,extraRepos:q,workload:x,cloneOnly:B,...U?{purpose:U}:{},...N?{provider:N}:{},...O!=="default"?{sandboxImage:O}:{},tenant:{orgId:X,userId:Y,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...y?{orgFsConfigJson:y}:{}})),l=Qd(W);await OR0({ctx:Z,runner:F,handle:g.handle,orgId:X,userId:Q,entries:l});let i=!!H&&H.sandboxHandle===g.handle&&H?.createdAt?H.createdAt:Date.now(),K0=W.runtime?.selected??null,B0=W.runtime?.port??null,X0=W.runtime?.path??null,L0={sandboxHandle:g.handle,previewUrl:g.previewUrl,createdAt:i,startedWith:{packageManager:K0,port:B0,path:X0}};await oT$(Z.storage.virtualMcps,J,Q,Y,G,L0);let J0=CU(G)??Z.metadata?.threadId;if(J0)await sT$(Z,J0,Y,G,L0);let $0=!H||H.sandboxHandle!==g.handle;return{entry:L0,isNewVm:$0,warmPoolAdopted:g.warmPoolAdopted}}async function Sa4($){let{ctx:Z,orgId:Q,virtualMcpId:Y,userId:X,repository:J}=$;if(!J.connectionId)return J;if(await Z.storage.connections.findById(J.connectionId,Q))return J;let{items:W}=await Z.storage.connections.list(Q),K=CK0(W,J.owner,J.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Y,connectionId:J.connectionId}),J;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Y,staleConnectionId:J.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Y))?.metadata??{},U=F.repository;if(U?.connectionId===J.connectionId){let N=n9(K);await Z.storage.virtualMcps.update(Y,X,{metadata:{...F,repository:{...U,connectionId:K.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Y,error:H.message})}return{...J,connectionId:K.id}}async function Ca4($,Z,Q,Y,X){let J=await $.storage.virtualMcps.findById(Z);if(!J)return;let G=J.metadata??{};await $.storage.virtualMcps.update(Z,Q,{metadata:{...G,runtime:{selected:Y,port:X}}})}async function va4($,...Z){try{return await $.ensure(...Z)}catch(Q){if(!(Q instanceof EH))throw Q;throw Error(`sandbox provisioning failed: the sandbox pod rejected the bootstrap handshake (HTTP ${Q.status}). The claim was released; retrying gets a different pod.`,{cause:Q})}}async function ba4($){let Z=Date.now()+QC$,Q=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(QC$/1000)}s`);if(!Q)Q=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await z$(_a4)}}async function xa4($,Z){try{return await zU($,Z,{forceRefresh:!0})}catch(Q){if(Q instanceof f0){let Y=Q.status===404?VA.githubConnectionMissing:VA.githubNotAuthenticated;throw Error(v00(Y,Q.message))}throw Q}}var Q71,QC$=150000,_a4=5000;var K$0=D(()=>{Zd();Yf();S91();Y8();C0();J$0();$71();P91();uJ();CJ();b00();rS$();eZ1();vW();$C$();Xd();xW();BH0();X$();M9();Cj();uJ();Z7();A5();QT0();zH0();Q71=d({name:"SANDBOX_START",description:"Start a sandbox with the connected repository and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:yU.object({virtualMcpId:yU.string().describe("Virtual MCP ID"),branch:yU.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:yU.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread."),provider:yU.enum(["kubernetes","freestyle"]).optional().describe("Where to run a NEW sandbox, when that provider is configured and can run it; otherwise the other one is used. An existing sandbox stays where it is. Omitted: Kubernetes while it has room, else Freestyle.")}),outputSchema:yU.object({previewUrl:yU.string().nullable(),sandboxHandle:yU.string(),branch:yU.string(),isNewVm:yU.boolean()}),handler:async($,Z)=>{t(Z);let Q=G0(Z);await Z.access.check();let Y=$.branch??wR0(LR0(Z.auth.user)),X=CU(Y)??$.threadId??Z.metadata?.threadId;if(X){let L=await Z.storage.threads.get(X).catch(()=>null);if(Ef(L?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let J=d0(Z);if(!J)throw Error("User ID required");let G=await Uf(Z,Y,J),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==Q.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=await gX(Z),F=PH(s9(K),G,Y),N=await _U(Z,X)??K.repository??null,{entry:B,isNewVm:O}=await XC$({ctx:Z,userId:J,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:K,repository:N,threadRepos:await M91(Z,X),existing:F,runner:H,...$.provider?{provider:$.provider}:{}});if(X)W$0(Z,X,"sandbox");return{...B,branch:Y,isNewVm:O}}})});async function fa4($,Z,Q,Y){try{let X=$.organization;if(!X)return;let J=await DR0($,Y.virtualMcpId,X,"tool-scripting"),G=await Z.proxyDaemonRequest(Q,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(J)});if(!G.ok)console.warn("[agent-sandbox-fs] tools/sync failed",G.status,await G.text().catch(()=>""))}catch(X){console.warn("[agent-sandbox-fs] tools/sync failed",X)}}async function Gd($,Z){let Q=await gX($),Y=null,X=()=>{if(!Y){if(Y=Jd({virtualMcpId:Z.virtualMcpId,branch:Z.branch},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>fa4($,Q,W,{virtualMcpId:Z.virtualMcpId})).catch(()=>{})}return Y},J=Z.branch==="ephemeral";return sZ1(Q,{ensureHandle:X,invalidateHandle:async(W)=>{if(Y=null,!J&&!W?.force)return;try{await pj($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch)}catch(K){console.warn("[agent-sandbox-fs] failed to reap vmMap entry",K)}},canAutoRestart:J,threadId:Z.threadId})}async function JC$($,Z){try{let Q=await Gd($,Z),{stdout:Y}=await Q.onBash("test -d .deco && echo __DECO_SITE__");return Y.includes("__DECO_SITE__")}catch(Q){return console.warn("[agent-sandbox-fs] .deco probe failed; assuming deco site",Q),!0}}var zR0=D(()=>{Zd();aZ1();vW();K$0();uJ()});function Y71($){let Z=$.toISOString();return`<current-context>
+</coding-workspace>`}var La4="This is a Deco CMS site (its repository contains a `.deco/` directory). These rules apply to content changes (page copy, section props, loader config, site settings):\n\n- CMS content lives in `.deco/blocks/<encoded-key>.json` \u2014 one JSON file per block, filename is the URI-encoded block key. Edit ONLY the matching `.deco/blocks/*.json` file(s).\n- NEVER edit generated artifacts: `blocks.gen.json`, `blocks.gen.ts`, `meta.gen.json`, or any other `*.gen.*` file. They are regenerated from `.deco/blocks/` by the dev server and by every production build \u2014 an edit there looks correct in the preview but is silently discarded on deploy.\n- Do not touch any other file to make a content change visible: the dev server watches `.deco/blocks/` and hot-reloads the preview, and production builds/content syncs read `.deco/blocks/` directly. Committing the `.deco/blocks/*.json` change is all that is needed.\n- After making a CMS content change, check the repo's AGENTS.md: if it is missing or does not document these `.deco/` content rules, add a short \"Deco CMS content\" section (creating AGENTS.md if needed) so other tools working in this repo follow the same rules. If AGENTS.md already documents them, leave it untouched.";function wa4($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function ja4($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((Q,Y)=>{let X=()=>{Z.catch(()=>{}),Y($.reason??Error("aborted"))};$.addEventListener("abort",X,{once:!0}),Z.then(Q,Y).finally(()=>{$.removeEventListener("abort",X)})})}async function Ea4($,Z,Q,Y,X){let J=X?.timeoutMs??wa4(Y),G=AbortSignal.timeout(J),W=X?.signal?AbortSignal.any([X.signal,G]):G,K,H;try{let U=new Headers({"content-type":"application/json"});if(X?.threadId)U.set("x-thread-id",X.threadId);let N={method:"POST",headers:U,body:JSON.stringify(Y),signal:W};({res:K,rawText:H}=await ja4(W,(async()=>{let B=await $.proxyDaemonRequest(Z,Q,N);return{res:B,rawText:await B.text()}})()))}catch(U){if(X?.signal?.aborted)throw U;if(G.aborted)throw Error(`Sandbox POST ${Q} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Y$0(U)}let F;try{F=JSON.parse(H)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response provider=agent-sandbox path=%s status=%d rawText=%s",Q,K.status,H.slice(0,2000));let U=K.status>=500?" (server error)":K.status===0?" (no response)":"";throw Error(`Daemon ${Q} returned invalid JSON (HTTP ${K.status}${U}): ${H.slice(0,800)}`)}if(!K.ok){console.error("[sandbox-fs-hooks] Non-OK response provider=agent-sandbox path=%s status=%d body=%s",Q,K.status,H.slice(0,2000));let U=F.error??`Daemon ${Q} failed (${K.status})`;if(K.status===404&&U==="sandbox not found")throw new Y$0(Error(U),!0);throw Error(U)}return F}function sZ1($,Z){let{ensureHandle:Q,invalidateHandle:Y,canAutoRestart:X}=Z,J=0,G=(H)=>{let F=Date.now();if(F-J<300000)return;J=F,$.renewTtl(H).catch((U)=>{console.warn(`[sandbox-fs-hooks] TTL renew failed for ${H}: ${U instanceof Error?U.message:String(U)}`)})},W=(H)=>{let F=H instanceof Error?H.message:String(H);return X?`Sandbox is unreachable and auto-restart did not recover it: ${F}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},K=async(H,F,U)=>{let N=async(O)=>Ea4($,O,H,F,{signal:U,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),B=await Q();G(B);try{return await N(B)}catch(O){if(!(O instanceof Y$0))throw O;if(!X&&!O.gone)throw Error(W(O.cause??O));console.warn(`[sandbox-fs-hooks] daemon ${H} unreachable \u2014 reaping sandbox and retrying once`,O.cause??O);try{await Y({force:O.gone})}catch(w){console.warn("[sandbox-fs-hooks] invalidateHandle failed",w)}let L;try{L=await Q()}catch(w){throw Error(`Failed to restart sandbox: ${w instanceof Error?w.message:String(w)}`)}try{return await N(L)}catch(w){if(w instanceof Y$0)throw Error(W(w.cause??w));throw w}}};return{onProxy:(H,F,U)=>K(H,F,U),onBash:async(H,F)=>{return await K("/_sandbox/bash",{command:H,...F?.cwd!==void 0?{cwd:F.cwd}:{},...F?.timeoutMs!==void 0?{timeout:F.timeoutMs}:{}})}}}var Y$0;var yS$=D(()=>{Y$0=class Y$0 extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});var Zd=D(()=>{Im();KT0();yS$()});function za4($){let{publicUrl:Z,agentId:Q,organization:Y,target:X,threadId:J}=$;if(X==="agent-tools")return`${Z}/mcp/virtual-mcp/${encodeURIComponent(Q)}`;if(!Y.slug)throw new hS$(Y.id,X);if(X==="task-run"){if(!J)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Y.slug}/mcp/task-run/${encodeURIComponent(J)}`}return`${Z}/api/${Y.slug}/mcp/self`}async function DR0($,Z,Q,Y,X="agent-tools",J,G={"*":["*"]}){let W=za4({publicUrl:l5(),agentId:Z,organization:Q,target:X,...J?{threadId:J}:{}}),K=await $.boundAuth.apiKey.create({name:Y,permissions:G,expiresIn:gS$,metadata:{organization:{id:Q.id,slug:Q.slug,name:Q.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":Q.id},expiresAt:Date.now()+gS$*1000}}function uS$($){let{publicUrl:Z,organizationSlug:Q,headers:Y,connections:X}=$,J=new Set;return X.map((G)=>{let W=Pa4(G.slug??G.title??"")||"mcp",K=W;for(let H=2;J.has(K);H++)K=`${W}-${H}`;return J.add(K),{name:K,url:`${Z}/api/${Q}/mcp/${encodeURIComponent(G.id)}`,headers:Y}})}function Pa4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function lS$($){return{self:[...$.toolNames],...$.grants}}var gS$=3600,hS$;var aZ1=D(()=>{M9();hS$=class hS$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});var X$0;var eZ1=D(()=>{X$0={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function Qd($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let Q=Z.env;if(!Array.isArray(Q))return null;let Y=[];for(let X of Q){if(!X||typeof X!=="object")continue;let J=X;if(typeof J.key!=="string"||!CQ0.test(J.key))continue;if(J.kind==="literal"&&typeof J.value==="string"){Y.push({key:J.key,kind:"literal",value:J.value});continue}if(J.kind==="secret"&&typeof J.secretId==="string"&&J.secretId.length>0)Y.push({key:J.key,kind:"secret",secretId:J.secretId})}return Y.length===0?null:Y}async function cS$($,Z){t(Z);let Q=G0(Z);await Z.access.check();let Y=d0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=s9(J),W=await Uf(Z,$.branch,Y),K=PH(G,W,$.branch);return{virtualMcp:X,metadata:J,userId:Y,sandboxUserId:W,entry:K,organization:Q}}function Aa4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function mS$($){let Z=$.runtime??null,Y=Z?.selected??null,X=Aa4(Z?.port??null),J=Z?.path??null;if(!Y||!(Y in X$0))return{packageManager:null,runtime:null,port:X,packageManagerPath:J,runtimeBinPath:null};let G=X$0[Y].runtime;return{packageManager:Y,runtime:G,port:X,packageManagerPath:J,runtimeBinPath:G==="deno"?"/opt/deno/bin":G==="bun"?"/opt/bun/bin":null}}var J$0=D(()=>{p8();eZ1();uJ();xW()});async function ZE($,Z){let Q=$.body?.getReader();if(!Q)return $.text();let Y=new TextDecoder,X="",J=0;for(;;){let{done:G,value:W}=await Q.read();if(G)break;if(J+=W.byteLength,J>Z)throw await Q.cancel().catch(()=>{}),new dS$(`Upstream response exceeded ${Z} bytes`);X+=Y.decode(W,{stream:!0})}return X+=Y.decode(),X}var dS$;var G$0=D(()=>{dS$=class dS$ extends Error{}});async function OR0({ctx:$,runner:Z,handle:Q,orgId:Y,userId:X,entries:J}){if(!J||J.length===0)return;let G={};for(let K of J){if(K.kind==="literal"){G[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Y,X);G[K.key]=H}catch(H){if(H instanceof bW||H instanceof ij){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(G).length===0)return;let W=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:G})});if(!W.ok){let K=await ZE(W,Ta4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var Ta4=10485760;var $71=D(()=>{R10();G$0()});async function nS$($,Z,Q,Y,X){let J=await J3({connectionId:$,tokenStorage:new L9(Y,X)});if(!J.accessToken)return null;return oS$(Z,Q,J.accessToken)}function tS$($,Z){return oS$($,Z,null)}async function oS$($,Z,Q){let Y=new Map,X=new Set(iS$.map((K)=>K.path));for(let K of Object.values(pS$))for(let H of K??[])X.add(H);await Promise.all(Array.from(X).map(async(K)=>{Y.set(K,await qa4($,Z,K,Q))}));let J=iS$.find(({path:K})=>Y.get(K)!==null);if(!J)return null;let G=pS$[J.pm]??[],W=null;for(let K of G)if(W=Ma4(Y.get(K)??null),W)break;return{packageManager:J.pm,devPort:W}}async function qa4($,Z,Q,Y){let X=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(Q)}`;try{let J={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Y)J.Authorization=`token ${Y}`;let G=await fetch(X,{headers:J,signal:AbortSignal.timeout(5000)});if(!G.ok)return null;let W=await G.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function Ma4($){if(!$)return null;try{let Z=JSON.parse($),Q=Z.tasks??Z.scripts??{},X=(Q.dev??Q.start??"").match(Ra4)?.[1]??null;if(!X)return null;let J=Number(X);return J>=1&&J<=65535?X:null}catch{return null}}var iS$,pS$,Ra4;var rS$=D(()=>{TW();HH();iS$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],pS$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Ra4=/(?:--port|PORT=|:)(\d{4,5})/});function Ia4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function LR0($){return $?.name||$?.email?.split("@")[0]||void 0}function wR0($){let Z=Ia4($),Q=Date.now().toString(36).split("").reverse().join("");return`${Z}-${Q}`}async function eS$($,Z){sS$??=e1.createHistogram("studio.sandbox.provision.duration_ms",{description:"Wall-clock time of one sandbox ensure, by provider (runner_kind), outcome, the provider a fallback left (fallback_from), whether a warm-pool pod was claimed (warm_pool), and whether a sandbox was already recorded (start=resume) or not (start=fresh).",unit:"ms",advice:{explicitBucketBoundaries:[500,1000,2000,5000,1e4,20000,30000,60000,120000,300000,600000]}}),aS$??=e1.createCounter("studio.sandbox.placement",{description:"Sandbox ensures by the provider that served them (runner_kind) and why it was chosen (reason)."});let Q=performance.now(),Y=(X,J,G={})=>sS$?.record(performance.now()-Q,{...$,runner_kind:X?jD[X]:"unknown",outcome:J,...G});try{let X=await Z(),J=X.placement?.fallbackFrom;if(Y(X.provider,"ok",{warm_pool:String(X.warmPoolAdopted),...J&&{fallback_from:jD[J]}}),X.placement)aS$.add(1,{runner_kind:jD[X.provider],reason:X.placement.reason});return X}catch(X){throw Y(F91(X),"error"),X}}var sS$,aS$;var $C$=D(()=>{Zd();k6()});async function W$0($,Z,Q){try{await $.storage.threads.stampRuntimeIfAbsent(Z,Q)}catch(Y){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Y instanceof Error?Y.message:String(Y)}`)}}function ZC$($){let Z=$?.trim();if(!Z)return null;try{let Q=new URL(Z);if(Q.protocol!=="http:"&&Q.protocol!=="https:")return null;return Q.href}catch{return null}}function Yd($){return ZC$($?.previewServerUrl)??ZC$($?.productionUrl)}var jR0=()=>{};function Ef($){return $==="cms"||$==="sandbox"?$:null}function Va4($){return!!Yd($)&&$?.fastPreview===!0}function ER0($){return Va4($)?"cms":"sandbox"}var Z71;var Xd=D(()=>{jR0();Z71=["cms","sandbox"]});import{z as yU}from"zod";async function Jd($,Z){t(Z);let Q=G0(Z),Y=d0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=await Uf(Z,$.branch,Y),W=PH(s9(J),G,$.branch),K=await gX(Z);if(W){if(await K.alive(W.sandboxHandle).catch(()=>!0))return W;await pj(Z.storage.virtualMcps,$.virtualMcpId,Y,G,$.branch).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let H=CU($.branch)??Z.metadata?.threadId;if(H)W$0(Z,H,"sandbox");let U=await _U(Z,H)??J.repository??null;await $.onColdStart?.().catch(()=>{});let{entry:N,warmPoolAdopted:B}=await XC$({ctx:Z,userId:Y,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:J,repository:U,threadRepos:await M91(Z,H),existing:null,runner:K,...$.purpose?{purpose:$.purpose}:{}});return $.onBound?.({warmPoolAdopted:B}),N}async function YC$($,Z,Q){if(!Z)return null;if(Z.accountId===null&&!Q&&!Z.legacyConnectionId)return Z;return await HD($.storage,Z)?Z:null}async function ka4($){let Z=$.repos.filter((X)=>!$.primary||!FB(X,$.primary)),Q=I10(Z),Y=[];for(let[X,J]of Z.entries())try{let G=await kj($.ctx.storage,$.orgId,J),W=await YC$($.ctx,G,J.connectionId),K=J.connectionId??G?.legacyConnectionId;if(!W&&!K)continue;let{cloneUrl:H,expiresAt:F}=W?await zU($.ctx,W,{forceRefresh:!0}):await AU(K,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:H,credentialExpiresAt:I51(F),...W?{repositoryId:W.id}:{connectionId:K},userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:W?W.path:`${J.owner}/${J.name}`,directoryName:Q[X],submoduleCredentials:$.submoduleCredentials})}catch(G){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,G instanceof Error?G.message:G)}return Y}async function XC$($){let{ctx:Z,userId:Q,sandboxUserId:Y,orgId:X,virtualMcpId:J,branch:G,metadata:W,threadRepos:K,existing:H,runner:F,purpose:U,provider:N}=$,B=U==="harness-run",O="default",L=$.repository?await Sa4({ctx:Z,orgId:X,virtualMcpId:J,userId:Q,repository:$.repository}):null,{runtime:w,packageManager:j,port:E,packageManagerPath:z}=mS$(W),T=await Z.storage.organizationSettings.get(X),P=await OT0({ctx:Z,orgId:X,userId:Q,entries:T?.submodule_credentials}),A;if(L){let Z0=await kj(Z.storage,X,L);O=Z0?.sandboxImage??"default";let s=await YC$(Z,Z0,L.connectionId),Q0=L.connectionId??Z0?.legacyConnectionId??void 0;if(!s&&Q0)await Km({ctx:Z,connectionId:Q0,organizationId:X,forceRefresh:!0,onLegacyMintError:(n0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:Q0,error:n0.message})}});let{cloneUrl:u0,gitUserName:_0,gitUserEmail:D1,expiresAt:i0}=s?await xa4(Z,s):Q0?await AU(Q0,L.owner,L.name,Z.db,Z.vault):vO$(L.owner,L.name);if(!j&&!s){let n0=Q0?await nS$(Q0,L.owner,L.name,Z.db,Z.vault):await tS$(L.owner,L.name);if(n0)j=n0.packageManager,w=X$0[n0.packageManager].runtime,E=n0.devPort??E,await Ca4(Z,J,Q,n0.packageManager,n0.devPort)}let j0=E0().sandboxStickyHeadRefEnabled,z0=NH0({branch:G,derivedRef:AH(G,{flat:Ff(Z0?.provider)}),recordedHeadRef:j0?await LT0(Z,CU(G)):null,sticky:j0});A={cloneUrl:u0,credentialExpiresAt:I51(i0),...s?{repositoryId:s.id}:Q0?{connectionId:Q0}:{},userName:_0,userEmail:D1,branch:z0,displayName:s?s.path:`${L.owner}/${L.name}`,submoduleCredentials:P}}let q=await ka4({ctx:Z,orgId:X,repos:K??[],primary:L,gitUserName:A?.userName??"",gitUserEmail:A?.userEmail??"",submoduleCredentials:P}),x=w&&j&&!B?{runtime:w,packageManager:j,...E!==null?{devPort:Number(E)}:{},...z?{packageManagerPath:z}:{}}:void 0,_=H10({orgId:X,virtualMcpId:J,branch:G}),V=!E0().orgFsMountsDisabled,y;if(V){let Z0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(Z0)y=await EH0(Z,{orgSlug:Z0,orgId:X,baseUrl:l5()})}let g=await eS$({start:H?"resume":"fresh",purpose:U??"interactive"},async()=>{return await ba4(F),va4(F,{userId:Y,projectRef:_},{branch:G,repo:A,extraRepos:q,workload:x,cloneOnly:B,...U?{purpose:U}:{},...N?{provider:N}:{},...O!=="default"?{sandboxImage:O}:{},tenant:{orgId:X,userId:Y,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...y?{orgFsConfigJson:y}:{}})}),l=Qd(W);await OR0({ctx:Z,runner:F,handle:g.handle,orgId:X,userId:Q,entries:l});let i=!!H&&H.sandboxHandle===g.handle&&H?.createdAt?H.createdAt:Date.now(),K0=W.runtime?.selected??null,B0=W.runtime?.port??null,X0=W.runtime?.path??null,L0={sandboxHandle:g.handle,previewUrl:g.previewUrl,createdAt:i,startedWith:{packageManager:K0,port:B0,path:X0}};await oT$(Z.storage.virtualMcps,J,Q,Y,G,L0);let J0=CU(G)??Z.metadata?.threadId;if(J0)await sT$(Z,J0,Y,G,L0);let $0=!H||H.sandboxHandle!==g.handle;return{entry:L0,isNewVm:$0,warmPoolAdopted:g.warmPoolAdopted}}async function Sa4($){let{ctx:Z,orgId:Q,virtualMcpId:Y,userId:X,repository:J}=$;if(!J.connectionId)return J;if(await Z.storage.connections.findById(J.connectionId,Q))return J;let{items:W}=await Z.storage.connections.list(Q),K=CK0(W,J.owner,J.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Y,connectionId:J.connectionId}),J;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Y,staleConnectionId:J.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Y))?.metadata??{},U=F.repository;if(U?.connectionId===J.connectionId){let N=n9(K);await Z.storage.virtualMcps.update(Y,X,{metadata:{...F,repository:{...U,connectionId:K.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Y,error:H.message})}return{...J,connectionId:K.id}}async function Ca4($,Z,Q,Y,X){let J=await $.storage.virtualMcps.findById(Z);if(!J)return;let G=J.metadata??{};await $.storage.virtualMcps.update(Z,Q,{metadata:{...G,runtime:{selected:Y,port:X}}})}async function va4($,...Z){try{return await $.ensure(...Z)}catch(Q){if(!(Q instanceof EH))throw Q;throw Error(`sandbox provisioning failed: the sandbox pod rejected the bootstrap handshake (HTTP ${Q.status}). The claim was released; retrying gets a different pod.`,{cause:Q})}}async function ba4($){let Z=Date.now()+QC$,Q=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(QC$/1000)}s`);if(!Q)Q=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await z$(_a4)}}async function xa4($,Z){try{return await zU($,Z,{forceRefresh:!0})}catch(Q){if(Q instanceof f0){let Y=Q.status===404?VA.githubConnectionMissing:VA.githubNotAuthenticated;throw Error(v00(Y,Q.message))}throw Q}}var Q71,QC$=150000,_a4=5000;var K$0=D(()=>{Zd();Yf();S91();Y8();C0();J$0();$71();P91();uJ();CJ();b00();rS$();eZ1();vW();$C$();Xd();xW();BH0();X$();M9();Cj();uJ();Z7();A5();QT0();zH0();Q71=d({name:"SANDBOX_START",description:"Start a sandbox with the connected repository and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:yU.object({virtualMcpId:yU.string().describe("Virtual MCP ID"),branch:yU.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:yU.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread."),provider:yU.enum(["kubernetes","freestyle"]).optional().describe("Where to run a NEW sandbox, when that provider is configured and can run it; otherwise the other one is used. An existing sandbox stays where it is. Omitted: Kubernetes while it has room, else Freestyle.")}),outputSchema:yU.object({previewUrl:yU.string().nullable(),sandboxHandle:yU.string(),branch:yU.string(),isNewVm:yU.boolean()}),handler:async($,Z)=>{t(Z);let Q=G0(Z);await Z.access.check();let Y=$.branch??wR0(LR0(Z.auth.user)),X=CU(Y)??$.threadId??Z.metadata?.threadId;if(X){let L=await Z.storage.threads.get(X).catch(()=>null);if(Ef(L?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let J=d0(Z);if(!J)throw Error("User ID required");let G=await Uf(Z,Y,J),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==Q.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=await gX(Z),F=PH(s9(K),G,Y),N=await _U(Z,X)??K.repository??null,{entry:B,isNewVm:O}=await XC$({ctx:Z,userId:J,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:K,repository:N,threadRepos:await M91(Z,X),existing:F,runner:H,...$.provider?{provider:$.provider}:{}});if(X)W$0(Z,X,"sandbox");return{...B,branch:Y,isNewVm:O}}})});async function fa4($,Z,Q,Y){try{let X=$.organization;if(!X)return;let J=await DR0($,Y.virtualMcpId,X,"tool-scripting"),G=await Z.proxyDaemonRequest(Q,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(J)});if(!G.ok)console.warn("[agent-sandbox-fs] tools/sync failed",G.status,await G.text().catch(()=>""))}catch(X){console.warn("[agent-sandbox-fs] tools/sync failed",X)}}async function Gd($,Z){let Q=await gX($),Y=null,X=()=>{if(!Y){if(Y=Jd({virtualMcpId:Z.virtualMcpId,branch:Z.branch},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>fa4($,Q,W,{virtualMcpId:Z.virtualMcpId})).catch(()=>{})}return Y},J=Z.branch==="ephemeral";return sZ1(Q,{ensureHandle:X,invalidateHandle:async(W)=>{if(Y=null,!J&&!W?.force)return;try{await pj($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch)}catch(K){console.warn("[agent-sandbox-fs] failed to reap vmMap entry",K)}},canAutoRestart:J,threadId:Z.threadId})}async function JC$($,Z){try{let Q=await Gd($,Z),{stdout:Y}=await Q.onBash("test -d .deco && echo __DECO_SITE__");return Y.includes("__DECO_SITE__")}catch(Q){return console.warn("[agent-sandbox-fs] .deco probe failed; assuming deco site",Q),!0}}var zR0=D(()=>{Zd();aZ1();vW();K$0();uJ()});function Y71($){let Z=$.toISOString();return`<current-context>
 Current date: ${Z.slice(0,10)}
 Current time: ${Z.slice(11,16)} UTC
 </current-context>`}var GC$,WC$;var X71=D(()=>{GC$={type:"ephemeral",ttl:"5m"},WC$={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function KC$($,Z){let Q=[],Y=$.length-1,X=$.length-2;for(let J=0;J<$.length;J++){let G=J===X||J===Y;Q.push({role:"system",content:$[J],...G?{providerOptions:ya4}:{}})}return Q.push({role:"system",content:Y71(Z)}),Q}var ya4;var HC$=D(()=>{X71();ya4={anthropic:{cacheControl:GC$}}});function FC$($){if($.length===0)return null;return`
@@ -1574,7 +1574,7 @@ ${X}`:X}case"media":return"";case"mediaSingle":case"mediaGroup":return Fd(hU(Q),
 
 `);default:return gR0(Q,Z)}}function i71($,Z=new Map){if(typeof $==="string")return e_$($,Z);if(!$||typeof $!=="object")return"";return Kv$($,Z)}class p71{client;names=new Map;lookupsDisabled=!1;constructor($){this.client=$}async resolve($){let Z=this.lookupsDisabled?[]:[...new Set($.filter((Y)=>!this.names.has(Y)))];for(let Y=0;Y<Z.length;Y+=Xv$){let X=Z.slice(Y,Y+Xv$);for(let J of X)this.names.set(J,null);try{for(let J of await this.client.listUsersByAccountId(X))if(J.displayName)this.names.set(J.accountId,J.displayName)}catch(J){this.lookupsDisabled=!0,console.warn("[jira] user lookup failed, mentions render as @unknown for this run:",J instanceof Error?J.message:J);break}}let Q=new Map;for(let Y of $){let X=this.names.get(Y);if(X)Q.set(Y,X)}return Q}}function o06($){if(!$)return null;return/\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[/?]|$)/i.exec($)?.[1]??null}var Yv$=15000,k06=60000,Xv$=50,S06="com.pyxis.greenhopper.jira:jsw-story-points",C06,_06="com.pyxis.greenhopper.jira:gh-sprint",v06="summary,status,priority,issuetype,updated,description,comment",b06=100,x06=1000,f06=5,Hd,u06,l06;var GE=D(()=>{Y8();X$();f71();u71();C06=/^story points?( estimate)?$/i;Hd=class Hd extends Error{status;constructor($,Z){super($);this.status=Z;this.name="JiraRequestError"}};u06=/^[a-z0-9][a-z0-9-]*\.atlassian\.net$/,l06=new Set(["localhost","127.0.0.1"])});function a06($){let Z=$.split(".").pop()?.toLowerCase()??"";return s06[Z]??"application/octet-stream"}function e06($){if(!$.startsWith(Hv$))return null;let Z=$.slice(Hv$.length).trim();if(Z===""||Z.includes(".."))return null;return Z}function $16($){return $.replace(/[^\w.-]+/g,"-").replace(/^-+|-+$/g,"")||"image"}async function Fv$($){let Z=new Map,{orgFs:Q,threadId:Y}=$;if(!Q||!Y)return Z;let X=[...new Set(g_$($.markdown))];for(let J of X){let G=e06(J);if(!G)continue;try{let W=await Q.read(r06,`${Y}/${G}`),K=await $.client.uploadAttachment($.issueIdOrKey,$16(G),W,a06(G)),H=await $.client.attachmentMediaUuid(K.id);if(H)Z.set(J,{id:H})}catch(W){console.warn(`[jira] could not embed ${J} in the comment: ${W instanceof Error?W.message:String(W)}`)}}return Z}var r06="outputs",Hv$="org/output/",s06;var Uv$=D(()=>{f71();s06={png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp"}});function Ud($,Z){return`${$.replace(/\/+$/,"")}/browse/${encodeURIComponent(Z)}`}async function Nd($,Z,Q){let[Y,X,J]=await Promise.all([$.getIssue(Q),$.listComments(Q),$.listRemoteLinks(Q).catch(()=>[])]),W=await new p71($).resolve([...d71(Y.fields.description),...X.flatMap((K)=>d71(K.body))]);return{id:Y.id,key:Y.key,url:Ud(Z,Y.key),summary:Y.fields.summary,status:Y.fields.status.name,reporter:hR0(Y.fields.reporter),assignee:hR0(Y.fields.assignee),description:i71(Y.fields.description,W).trim(),comments:X.map((K)=>({author:hR0(K.author)??"Unknown",created:K.created,body:i71(K.body,W).trim()})),attachments:(Y.fields.attachment??[]).map((K)=>({id:K.id,filename:K.filename,size:K.size})),links:J}}function hR0($){return $?z$0($.accountId,$.displayName):null}function Nv$($,Z){return $.length>Z?`${$.slice(0,Z)}
 
-[\u2026 truncated]`:$}function Y16($){if($<1024)return`${$} B`;if($<1048576)return`${Math.round($/1024)} KB`;return`${($/1048576).toFixed(1)} MB`}function X16($){let Z=[`Moved into ${$.toStatus}`];if($.fromStatus)Z.push(`from ${$.fromStatus}`);let Q=hR0($.movedBy);if(Q)Z.push(`by ${Q}`);if($.movedAt)Z.push(`at ${$.movedAt}`);return`${Z.join(" ")} \u2014 the move that started this run.`}function uR0($,Z){let Q=[`# ${$.key}: ${$.summary}`,`Status: ${$.status}`,...Z?[X16(Z)]:[],...$.reporter?[`Reporter: ${$.reporter}`]:[],...$.assignee?[`Assignee: ${$.assignee}`]:[],`Link: ${$.url}`,"","## Description",$.description?Nv$($.description,Z16):"_(empty)_"];if($.links.length>0){Q.push("","## Web links");for(let Y of $.links)Q.push(`- [${Y.title}](${Y.url})`)}if($.attachments.length>0){Q.push("","## Attachments");for(let Y of $.attachments)Q.push(`- ${Y.filename} (${Y16(Y.size)}) \u2014 attachment id \`${Y.id}\``);Q.push("","Fetch one with `JIRA_ATTACHMENT_DOWNLOAD` and the attachment id; it returns a short-lived URL to `curl` into the sandbox.")}if($.comments.length>0){Q.push("","## Comments");let Y=Q16;for(let[X,J]of $.comments.entries()){let G=Nv$(J.body,Math.max(0,Y));Q.push(`**${J.author}** (${J.created}):`,G,""),Y-=G.length;let W=X===$.comments.length-1;if(Y<=0&&!W){Q.push("[\u2026 older comments omitted]");break}}}return Q.join(`
+[\u2026 truncated]`:$}function Y16($){if($<1024)return`${$} B`;if($<1048576)return`${Math.round($/1024)} KB`;return`${($/1048576).toFixed(1)} MB`}function X16($){let Z=[`Moved into ${$.toStatus}`];if($.fromStatus)Z.push(`from ${$.fromStatus}`);let Q=hR0($.movedBy);if(Q)Z.push(`by ${Q}`);if($.movedAt)Z.push(`at ${$.movedAt}`);return`${Z.join(" ")} \u2014 the move that started this run.`}function uR0($,Z){let Q=[`# ${$.key}: ${$.summary}`,`Status: ${$.status}`,...Z?[X16(Z)]:[],...$.reporter?[`Reporter: ${$.reporter}`]:[],...$.assignee?[`Assignee: ${$.assignee}`]:[],`Link: ${$.url}`,"","## Description",$.description?Nv$($.description,Z16):"_(empty)_"];if($.links.length>0){Q.push("","## Web links");for(let Y of $.links)Q.push(`- [${Y.title}](${Y.url})`)}if($.attachments.length>0){Q.push("","## Attachments");for(let Y of $.attachments)Q.push(`- ${Y.filename} (${Y16(Y.size)}) \u2014 attachment id \`${Y.id}\``);Q.push("","Fetch one with `JIRA_ATTACHMENT_DOWNLOAD` and the attachment id; it returns a short-lived URL to `curl` into the sandbox.")}if($.comments.length>0){Q.push("","## Comments");let Y=[],X=Q16;for(let G=$.comments.length-1;G>=0&&X>0;G--){let W=$.comments[G];if(!W)continue;let K=Nv$(W.body,X);Y.unshift({...W,body:K}),X-=K.length}let J=$.comments.length-Y.length;if(J>0)Q.push(`[\u2026 ${J} older comment${J===1?"":"s"} omitted]`,"");for(let G of Y)Q.push(`**${G.author}** (${G.created}):`,G.body,"")}return Q.join(`
 `).trim()}function Bv$($){let Z=[`# ${$.length} Jira issues`,"This run works on every issue below. Each Jira tool takes `issueKey` to say which one it is about; `JIRA_ISSUE_GET` with a key returns that issue in "+"full \u2014 description, comments, attachments."];for(let Q of $)if(Z.push("",`## ${Q.key}: ${Q.summary}`,`Status: ${Q.status}`,...Q.reporter?[`Reporter: ${Q.reporter}`]:[],...Q.assignee?[`Assignee: ${Q.assignee}`]:[],`Link: ${Q.url}`),Q.links.length>0){Z.push("Web links:");for(let Y of Q.links)Z.push(`- [${Y.title}](${Y.url})`)}return Z.join(`
 `).trim()}var Z16=12000,Q16=12000;var n71=D(()=>{GE();u71()});function t71($){if($?.source!=="jira")return[];let Z=$.jira_issue_keys;if(Array.isArray(Z)){let Y=Z.filter((X)=>typeof X==="string");if(Y.length>0)return Y}let Q=$.jira_issue_key;return typeof Q==="string"&&Q!==""?[Q]:[]}function Dv$($){if($?.source!=="jira")return[];let Z=$.jira_created_issue_keys;return Array.isArray(Z)?Z.filter((Q)=>typeof Q==="string"):[]}function o71($,Z){if($.length===0)throw Error("This run is not working on a Jira issue");let Q=Z?.trim().toUpperCase();if(!Q){let X=$[0];if($.length===1&&X!==void 0)return{key:X,inRun:!0};throw Error(`This run works on ${$.length} issues (${$.join(", ")}) \u2014 pass \`issueKey\` to say which one`)}let Y=$.find((X)=>X.toUpperCase()===Q);if(Y)return{key:Y,inRun:!0};if(!J16.test(Q))throw Error(`"${Z}" is not a Jira issue key, e.g. EX-12`);return{key:Q,inRun:!1}}var J16;var Ov$=D(()=>{J16=/^[A-Z][A-Z0-9_]*-\d+$/});import{z as b$}from"zod";async function T$0($,Z,Q=V10().threadId){let Y=G0($),X=await $.storage.jiraIntegrations.getByOrg(Y.id);if(!X)throw Error("Jira is not connected for this org");let J=await $.storage.threads.get(Q),G=new lQ(X.siteUrl,X.email,X.apiToken),W=o71(t71(J?.metadata),Z);if(!W.inRun)await Ev$(G,X,W.key);return{integration:X,client:G,issueKey:W.key}}async function Ev$($,Z,Q){if(!Z.boardId)throw Error(`Jira has no board connected, so ${Q} cannot be checked \u2014 only this run's issues are reachable`);if(!await $.isOnBoard(Z.boardId,Q))throw Error(`${Q} is not on the connected Jira board`)}function F16($){return $.slice(0,$.lastIndexOf("-"))}function wv$($,Z){return $.trim().toLowerCase()===Z.trim().toLowerCase()}async function U16($,Z,Q,Y){for(let J of Y){let G=await $.getIssue(J).catch(()=>null);if(G&&wv$(G.fields.summary,Q))return G.key}let{issues:X}=await $.searchIssues({jql:`project = "${Z}" AND reporter = currentUser() AND statusCategory != Done AND created >= ${K16} ORDER BY created DESC`});return X.find((J)=>wv$(J.fields.summary,Q))?.key??null}var jv$=50000,A$0,If,Vf,r71,kf,G16=100,s71,W16=5,K16="-14d",Lv$="Relates",H16,a71,Sf;var e71=D(()=>{C0();M9();M71();GE();Uv$();n71();Ov$();zD();A$0=b$.string().optional().describe("Which issue: any on the board, e.g. one this run's issue links to or one you created. Leave out for this run's issue, when it has one.");If=d({name:"JIRA_ISSUE_GET",description:"Read a Jira issue \u2014 this run's, or another on the board: summary, "+"status, description, comments, and attachments with the ids JIRA_ATTACHMENT_DOWNLOAD takes.",inputSchema:b$.object({issueKey:A$0}),outputSchema:b$.object({key:b$.string(),url:b$.string(),status:b$.string(),markdown:b$.string()}),handler:async($,Z)=>{await Z.access.check();let{integration:Q,client:Y,issueKey:X}=await T$0(Z,$.issueKey),J=await Nd(Y,Q.siteUrl,X);return{key:J.key,url:J.url,status:J.status,markdown:uR0(J)}}}),Vf=d({name:"JIRA_COMMENT_ADD",description:"Post a comment on a Jira issue on the board. Markdown is rendered as Jira rich text, tables included. Leave one when you finish: what you did, and any pull request link. To mention someone so they are "+"notified, write `@[Name](accountid:<id>)` \u2014 the form people appear in "+"when you read an issue (reporter, assignee, comment authors, mentions); a plain `@name` is only text. To show evidence, write the image to `org/output/<name>.png` in your working pod and reference it as "+"`![what it shows](org/output/<name>.png)` \u2014 it is uploaded to the issue "+"and rendered inline. Any other URL stays a plain link.",inputSchema:b$.object({issueKey:A$0,body:b$.string().min(1).max(jv$)}),outputSchema:b$.object({commentId:b$.string(),embeddedImages:b$.array(b$.string())}),handler:async($,Z)=>{await Z.access.check();let{client:Q,issueKey:Y}=await T$0(Z,$.issueKey),X=await Fv$({client:Q,orgFs:Z.orgFs,issueIdOrKey:Y,threadId:U3.getStore()?.threadId??null,markdown:$.body}),{id:J}=await Q.addComment(Y,$.body,{media:X});return{commentId:J,embeddedImages:[...X.keys()]}}}),r71=d({name:"JIRA_REMOTE_LINK_ADD",description:"Put a link on a Jira issue on the board \u2014 its pull request, "+"its deploy preview. A link on the card is what a person clicks; the same URL inside a comment is not. Posting the same `key` again updates that link instead of adding a second.",inputSchema:b$.object({issueKey:A$0,url:b$.string().min(1),title:b$.string().min(1).max(255),summary:b$.string().max(1000).optional(),key:b$.string().max(255).optional().describe("Stable id for this link, e.g. `pull-request` or `preview`.")}),outputSchema:b$.object({linkId:b$.number()}),handler:async($,Z)=>{await Z.access.check();let{client:Q,issueKey:Y}=await T$0(Z,$.issueKey),X;try{X=new URL($.url)}catch{throw Error(`"${$.url}" is not an absolute URL`)}if(X.protocol!=="https:"&&X.protocol!=="http:")throw Error(`${X.protocol} is not a linkable scheme`);let{id:J}=await Q.addRemoteLink(Y,{url:X.toString(),title:$.title,...$.summary?{summary:$.summary}:{},...$.key?{globalId:`studio-${Y}-${$.key}`}:{}});return{linkId:J}}}),kf=d({name:"JIRA_ISSUE_TRANSITION",description:"Move a Jira issue on the board to another status, by the status name (case-insensitive). Only a status the issue's workflow can reach from where it is; the error names the reachable ones.",inputSchema:b$.object({issueKey:A$0,toStatus:b$.string().min(1)}),outputSchema:b$.object({status:b$.string()}),handler:async($,Z)=>{await Z.access.check();let{client:Q,issueKey:Y}=await T$0(Z,$.issueKey),X=await Q.listTransitions(Y),J=$.toStatus.trim().toLowerCase(),G=X.find((W)=>W.to.name.toLowerCase()===J||W.name.toLowerCase()===J);if(!G)throw Error(`The issue cannot move to "${$.toStatus}" from here \u2014 reachable: ${X.map((W)=>W.to.name).join(", ")||"none"}`);return await Q.transitionIssue(Y,G.id),{status:G.to.name}}}),s71=d({name:"JIRA_ISSUE_SEARCH",description:'Find issues on the board with JQL, e.g. `status = "Code Review"` or `text ~ "checkout" ORDER BY updated DESC`. The query is narrowed to the board, so name only the condition. Returns keys to read in full with JIRA_ISSUE_GET.',inputSchema:b$.object({jql:b$.string().max(2000),limit:b$.number().int().min(1).max(G16).default(20)}),outputSchema:b$.object({issues:b$.array(b$.object({key:b$.string(),url:b$.string(),summary:b$.string(),status:b$.string(),type:b$.string().nullable(),updated:b$.string()})),truncated:b$.boolean()}),handler:async($,Z)=>{await Z.access.check();let Q=G0(Z),Y=await Z.storage.jiraIntegrations.getByOrg(Q.id);if(!Y)throw Error("Jira is not connected for this org");if(!Y.boardId)throw Error("Jira has no board connected to search");let X=new lQ(Y.siteUrl,Y.email,Y.apiToken),J=await X.getBoardScopeJql(Y.boardId),G=await X.searchIssues({jql:m71(J,$.jql)});return{issues:G.issues.slice(0,$.limit).map((W)=>({key:W.key,url:Ud(Y.siteUrl,W.key),summary:W.fields.summary,status:W.fields.status.name,type:W.fields.issuetype?.name??null,updated:W.fields.updated})),truncated:G.issues.length>$.limit||G.nextPageToken!==null}}}),H16=/^[A-Z][A-Z0-9_]*$/;a71=d({name:"JIRA_ISSUE_CREATE",description:"Create a Jira issue in the project this run works in \u2014 a release card, "+"a follow-up found along the way \u2014 then comment on it, link it and move "+"it with the other Jira tools by its key. If an open issue this integration created in the last two weeks already has this exact summary, that one is returned instead (`created: false`) and still linked, so calling again after a restart does not duplicate it. Write the full description now; there is no tool to edit it later.",inputSchema:b$.object({summary:b$.string().trim().min(1).max(255),issueType:b$.string().min(1).describe("The issue type's name as the Jira API names it (often English, e.g. Story or Task, even when the UI shows a translation). The error lists the project's types."),description:b$.string().max(jv$).optional().describe("Markdown, rendered as Jira rich text, tables included; `@[Name](accountid:<id>)` mentions someone."),relatesTo:b$.array(b$.string().min(1)).max(100).default([]).describe("Issues on the board to link to the new one as `Relates`, e.g. the cards a release ships."),sprint:b$.enum(["active","none"]).default("none").describe("`active` puts it in the board's running sprint, which is what a sprint board shows; `none` leaves it in the backlog."),storyPoints:b$.number().min(0).max(1000).optional()}),outputSchema:b$.object({key:b$.string(),url:b$.string(),created:b$.boolean(),linked:b$.array(b$.string()),notLinked:b$.array(b$.object({key:b$.string(),reason:b$.string()}))}),handler:async($,Z)=>{await Z.access.check();let Q=G0(Z),{threadId:Y}=V10(),X=await Z.storage.jiraIntegrations.getByOrg(Q.id);if(!X)throw Error("Jira is not connected for this org");let J=await Z.storage.threads.get(Y),G=t71(J?.metadata);if(G.length===0)throw Error("This run is not working on a Jira issue");let W=[...new Set(G.map(F16))],K=W[0];if(W.length!==1||!K||!H16.test(K))throw Error(`This run works in ${W.join(", ")}; it can only create in a single project`);let H=new lQ(X.siteUrl,X.email,X.apiToken),F=[];for(let j of $.relatesTo){let E=o71(G,j);if(F.includes(E.key))continue;if(!E.inRun)await Ev$(H,X,E.key);F.push(E.key)}let U=Dv$(J?.metadata),N=await U16(H,K,$.summary,U),B=N===null;if(N===null){if(U.length>=W16)throw Error(`This run already created ${U.length} issues (${U.join(", ")}), the most one run may`);let j=await H.getCreateMeta(K,$.issueType),E={};if($.storyPoints!==void 0){if(!j.storyPointsFieldId)throw Error(`${j.issueTypeName} in ${K} has no story points field to set`);E[j.storyPointsFieldId]=$.storyPoints}if($.sprint==="active"){if(!X.boardId||!j.sprintFieldId)throw Error(`${j.issueTypeName} in ${K} cannot go in a sprint \u2014 pass sprint: "none"`);let z=await H.getActiveSprint(X.boardId);if(!z)throw Error('The board has no active sprint \u2014 pass sprint: "none"');E[j.sprintFieldId]=z.id}({key:N}=await H.createIssue({projectKey:K,issueTypeId:j.issueTypeId,summary:$.summary,description:$.description,fields:E})),await Z.storage.threads.recordJiraIssueCreated(Y,N)}let O=B?new Set:new Set(await H.listLinkedIssueKeys(N,Lv$)),L=[],w=[];for(let j of F){if(O.has(j)){L.push(j);continue}try{await H.linkIssues(Lv$,j,N),L.push(j)}catch(E){w.push({key:j,reason:E instanceof Error?E.message:String(E)})}}return{key:N,url:Ud(X.siteUrl,N),created:B,linked:L,notLinked:w}}});Sf=d({name:"JIRA_ATTACHMENT_DOWNLOAD",description:"Get a short-lived URL for one attachment of a Jira issue on the board, to `curl -L -o <path>` into the sandbox. Attachment ids are listed by JIRA_ISSUE_GET. The URL needs no credential and expires.",inputSchema:b$.object({issueKey:A$0,attachmentId:b$.string().min(1)}),outputSchema:b$.object({url:b$.string(),filename:b$.string(),expiresAt:b$.string(),command:b$.string()}),handler:async($,Z)=>{await Z.access.check();let{integration:Q,client:Y,issueKey:X}=await T$0(Z,$.issueKey),J=(await Y.listAttachments(X)).find((F)=>F.id===$.attachmentId);if(!J)throw Error(`${X} has no attachment "${$.attachmentId}" \u2014 JIRA_ISSUE_GET lists the ids`);let G=Date.now()+R_$,W=M_$({organizationId:Q.organizationId,attachmentId:J.id,expiresAt:G}),K=`${l5()}/api/_jira/attachments/${W}`,H=J.filename.replace(/[^\w.-]+/g,"_");return{url:K,filename:J.filename,expiresAt:new Date(G).toISOString(),command:`curl -fsSL -o ${JSON.stringify(H)} ${JSON.stringify(K)}`}}})});function zv$($,Z){let Q=(Y)=>U3.run({threadId:Z},Y);return{JIRA_ISSUE_GET:n$({description:If.description,inputSchema:o(If.inputSchema),execute:(Y)=>Q(()=>If.execute(Y,$))}),JIRA_COMMENT_ADD:n$({description:Vf.description,inputSchema:o(Vf.inputSchema),execute:(Y)=>Q(()=>Vf.execute(Y,$))}),JIRA_ISSUE_TRANSITION:n$({description:kf.description,inputSchema:o(kf.inputSchema),execute:(Y)=>Q(()=>kf.execute(Y,$))}),JIRA_ATTACHMENT_DOWNLOAD:n$({description:Sf.description,inputSchema:o(Sf.inputSchema),execute:(Y)=>Q(()=>Sf.execute(Y,$))})}}var Pv$=D(()=>{y4();e71();zD()});function QQ1($){let Z=$.type;if(typeof Z!=="string")return!1;if(Z==="text"||Z==="reasoning")return $.state!=="streaming";if(Z==="step-start")return!1;if(Z.startsWith("tool-")||Z==="dynamic-tool")return $.state==="approval-requested"||Z==="tool-user_ask"&&$.state==="input-available"||$.state==="output-available"||$.state==="output-error"||$.state==="output-denied";return!0}function $Q1($){let Z=$.type??"";if(Z==="reasoning")return"reasoning";if(Z==="file")return"file";if(Z.startsWith("tool-")||Z==="dynamic-tool")return $.state==="output-available"||$.state==="output-error"||$.state==="output-denied"?"tool_result":"tool_call";return"text"}class YQ1{ctx;base;seqByPart=new Map;emitted=new Set;finished=new Set;partKeyByRowId=new Map;finishMessageIdByRowId=new Map;nextSeq=0;constructor($){this.ctx=$;this.base=$.baseTimeMs??Date.now()}hasEmittedContentFor($){let Z=`${$}#`;for(let Q of this.emitted)if(Q.startsWith(Z))return!0;return!1}seqFor($){let Z=this.seqByPart.get($);if(Z!==void 0)return Z;let Q=this.nextSeq++;return this.seqByPart.set($,Q),Q}row($,Z,Q,Y,X,J=null){return{id:`${this.ctx.runId}:${$}:${Q}`,seq:Q,org_id:this.ctx.orgId,thread_id:this.ctx.threadId,run_id:this.ctx.runId,message_id:$,role:Z,kind:Y,payload:X,payload_ref:null,metadata:J,created_at:new Date(this.base+Q).toISOString()}}emitMessageParts($){let Z=$.parts??[],Q=[];for(let Y=0;Y<Z.length;Y++){let X=Z[Y];if(!QQ1(X))continue;let J=`${$.id}#${Y}`;if(this.emitted.has(J))continue;let G=this.seqFor(J),W=this.row($.id,$.role,G,$Q1(X),ZQ1(X));this.partKeyByRowId.set(W.id,J),Q.push(W)}return Q}emitRequestMessageParts($){let Z=$.parts??[],Q=[];for(let Y=0;Y<Z.length;Y++){let X=Z[Y],J=`${$.id}#${Y}`,G=this.seqFor(J),W=this.row($.id,$.role,G,$Q1(X),ZQ1(X));this.partKeyByRowId.set(W.id,J),Q.push(W)}return Q}markFinished($,Z,Q=null){if(this.finished.has($))return[];let Y=this.seqFor(`${$}#finish`),X=this.row($,Z,Y,"finish",{},Q);return this.finishMessageIdByRowId.set(X.id,$),[X]}markRequestFinished($,Z,Q=null){let Y=this.seqFor(`${$}#finish`),X=this.row($,Z,Y,"finish",{},Q);return this.finishMessageIdByRowId.set(X.id,$),[X]}acknowledge($){for(let Z of $){let Q=this.partKeyByRowId.get(Z.id);if(Q!==void 0)this.emitted.add(Q);let Y=this.finishMessageIdByRowId.get(Z.id);if(Y!==void 0)this.finished.add(Y)}}emitUserMessage($){return[...this.emitMessageParts($),...this.markFinished($.id,$.role,$.metadata??null)]}emitRequestMessage($){return[...this.emitRequestMessageParts($),...this.markRequestFinished($.id,$.role,$.metadata??null)]}emitStepParts($){return this.emitMessageParts($)}emitFinal($){let Z=this.emitMessageParts($);if(Z.length===0&&!this.hasEmittedContentFor($.id))return Z;return[...Z,...this.markFinished($.id,$.role,$.metadata??null)]}emitFinalSnapshot($){let Z=$.parts??[],Q=[];for(let J=0;J<Z.length;J++){let G=Z[J];if(!QQ1(G))continue;let W=`${$.id}#${J}`,K=this.seqFor(W),H=this.row($.id,$.role,K,$Q1(G),ZQ1(G));this.partKeyByRowId.set(H.id,W),Q.push(H)}if(Q.length===0&&!this.hasEmittedContentFor($.id))return Q;let Y=this.seqFor(`${$.id}#finish`),X=this.row($.id,$.role,Y,"finish",{},$.metadata??null);return this.finishMessageIdByRowId.set(X.id,$.id),[...Q,X]}emitError($,Z){let Q=`${$}#error`,Y=[];if(!this.emitted.has(Q)){let X=this.seqFor(Q),J=this.row($,"assistant",X,"error",{type:"text",text:`Error: ${Av$(Z)}`});this.partKeyByRowId.set(J.id,Q),Y.push(J)}return[...Y,...this.markFinished($,"assistant")]}}function Av$($){if($.length<=lR0)return $;let Z=$.length-lR0;return`${$.slice(0,lR0)}\u2026 [truncated ${Z} characters]`}function ZQ1($){let Z=$.errorText;if(typeof Z!=="string"||Z.length<=lR0)return $;return{...$,errorText:Av$(Z)}}var lR0=8000;class lY{ctx;builder;constructor($){this.ctx=$;this.builder=new YQ1($)}async appendBuiltRows($){await this.ctx.storage.appendParts($),this.builder.acknowledge($)}async emitUserMessage($){await this.appendBuiltRows(this.builder.emitUserMessage($))}async emitRequestMessage($){let Z=this.builder.emitRequestMessage($);await this.ctx.storage.replaceMessageParts(this.ctx.threadId,$.id,Z),this.builder.acknowledge(Z)}async emitStepParts($){await this.appendBuiltRows(this.builder.emitStepParts($))}async emitFinal($){await this.appendBuiltRows(this.builder.emitFinal($))}async replaceFinal($){let Z=this.builder.emitFinalSnapshot($);await this.ctx.storage.replaceMessageParts(this.ctx.threadId,$.id,Z),this.builder.acknowledge(Z)}async emitError($,Z){await this.appendBuiltRows(this.builder.emitError($,Z))}}var WE=()=>{};async function Bd($,Z,Q,Y){let X=Z.organizationId;if(!await MJ($,X,"kanban"))throw new XU("Continuing a task agent needs the kanban feature, which this plan does not include.","kanban");await oG($,X,"continuing a task agent");let J=await I6($,"smart"),G=Q.virtual_mcp_id??EP(X),W={id:Y.messageId,role:"user",parts:[{type:"text",text:Y.prompt}],metadata:{created_at:new Date().toISOString()}};await new lY({storage:$.storage.threads.messageParts(),orgId:X,threadId:Q.id,runId:Q.id}).emitRequestMessage(W),await ID({threadId:Q.id,source:"background-tool",request:{messages:[W],models:{credentialId:J.credentialId,thinking:{id:J.modelId,title:J.modelMeta.title}},agent:{id:G,...Y.agent??{}},temperature:0.5,toolApprovalLevel:"auto",mode:"default",organizationId:X,userId:Z.assignedBy??Z.createdBy,harnessId:Q.harness_id==="claude-code"?"claude-code":"decopilot",...Q.branch?{branch:Q.branch}:{},taskId:Q.id,runMetadata:{...AT0(Z),...Y.runClass?{[mm]:Y.runClass}:{}}}},{workflowID:Y.workflowID})}var cR0=D(()=>{S10();WE();JH();gY();VD();dm();p8()});var mR0,Tv$="notification.created";var dR0=D(()=>{mR0=["created","commented","mentioned","status_changed","assignee_changed","review_requested","review_approved","review_changes_requested","merge_failed"]});class Mv${listeners=new Map;totalCount=0;strategy=null;started=!1;async start($){if(this.started){if(!$)return;await this.stop()}this.strategy=$,await this.strategy.start((Z,Q)=>this.localEmit(Z,Q)),this.started=!0}async stop(){if(!this.started||!this.strategy)return;await this.strategy.stop(),this.started=!1}add($){if(this.totalCount>=qv$)return console.warn(`[SSEHub] Total connection limit reached (${qv$})`),null;let Z=this.listeners.get($.organizationId);if(!Z)Z=new Map,this.listeners.set($.organizationId,Z);if(Z.size>=Rv$)return console.warn(`[SSEHub] Per-org connection limit reached for ${$.organizationId} (${Rv$})`),null;return Z.set($.id,$),this.totalCount++,$.id}remove($,Z){let Q=this.listeners.get($);if(!Q)return;if(Q.delete(Z)){if(this.totalCount--,Q.size===0)this.listeners.delete($)}}emit($,Z){if(this.strategy)this.strategy.broadcast($,Z);else this.localEmit($,Z)}countForOrg($){return this.listeners.get($)?.size??0}get count(){return this.totalCount}localEmit($,Z){this.deliver($,$,Z),this.deliver(iR0,$,Z)}deliver($,Z,Q){let Y=this.listeners.get($);if(!Y||Y.size===0)return;for(let X of Y.values()){if(X.typePatterns&&!N16(Q.type,X.typePatterns))continue;try{X.push(Q,Z)}catch{this.remove($,X.id)}}}}function N16($,Z){for(let Q of Z){if(Q===$)return!0;if(Q.endsWith(".*")){let Y=Q.slice(0,-1);if($.startsWith(Y))return!0}}return!1}var iR0="*",Rv$=50,qv$=500,J9;var R$0=D(()=>{k6();J9=new Mv$;e1.createObservableGauge("sse_hub.connections",{description:"Active SSE listeners held by this pod",unit:"{connections}"}).addCallback(($)=>$.observe(J9.count))});function B16($){return $.replace(/[^a-zA-Z]/g,"").toUpperCase().slice(0,4)||"TASK"}function Dd($,Z){if(Z==null)return null;return`${B16($)}-${String(Z).padStart(2,"0")}`}var pR0=()=>{};function XQ1($){return $.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function O16($,Z){let Q=$.taskKeySeq===null?null:Dd($.orgSlug,$.taskKeySeq),Y=XQ1($.actorName??"The agent"),X=XQ1($.taskTitle),J=Q?`${XQ1(Q)} \xB7 ${X}`:X,G=Q?`<a href="${Z}/${encodeURIComponent($.orgSlug)}/t/${encodeURIComponent(Q)}" style="color:#141413;">${J}</a>`:J;return`<p style="margin:0 0 12px 0;font-size:14px;color:#141413;line-height:1.6;font-family:Inter,system-ui,sans-serif;">${Y} ${D16[$.type]} ${G}</p>`}function Iv$($,Z){let Q=$.length===1?"1 update on your tasks":`${$.length} updates on your tasks`;return{subject:Q,html:vG({preheader:Q,heading:Q,body:$.map((Y)=>O16(Y,Z)).join(`
 `),footnote:"You received this because you follow these tasks. Open a task and use Unfollow to stop."})}}var D16;var Vv$=D(()=>{pR0();D16={created:"created",commented:"commented on",mentioned:"mentioned you on",status_changed:"moved",assignee_changed:"reassigned",review_requested:"requested review on",review_approved:"approved",review_changes_requested:"requested changes on",merge_failed:"couldn't merge"}});import{z as q$0}from"zod";var Od;var nR0=D(()=>{Od=q$0.object({taskTitle:q$0.string(),taskKeySeq:q$0.number().int().nullable(),actorName:q$0.string().nullable(),actorImage:q$0.string().nullable()})});import{DBOS as uU,SchedulerMode as L16}from"@dbos-inc/dbos-sdk";function kv$($){WQ1=$}function HQ1(){if(!WQ1)throw Error("[notifications] runtime not initialized \u2014 setNotificationDigestRuntime() must run before the workflow fires");return WQ1}function Sv$(){return HQ1().db.selectFrom("notifications as n").innerJoin("organization as o","o.id","n.organization_id").innerJoin("user as u","u.id","n.user_id").innerJoin("member as m",($)=>$.onRef("m.userId","=","n.user_id").onRef("m.organizationId","=","n.organization_id")).select(["n.id as id","n.user_id as userId","n.type as type","n.data as data","o.slug as orgSlug","u.email as email"]).where("n.emailed_at","is",null).where("n.read_at","is",null).orderBy("n.created_at","asc").limit(E16)}function Cv$($){return $.map((Z)=>{let Q=Od.parse(Z.data);return{id:Z.id,userId:Z.userId,email:Z.email,type:Z.type,orgSlug:Z.orgSlug,taskTitle:Q.taskTitle,taskKeySeq:Q.taskKeySeq,actorName:Q.actorName}})}async function P16($){return Cv$(await Sv$().where("n.user_id","=",$).execute())}async function A16($){return Cv$(await Sv$().where("n.created_at","<",$).execute())}async function T16($){if($.length===0)return new Set;let Z=await HQ1().db.updateTable("notifications").set({emailed_at:new Date}).where("id","in",$).where("emailed_at","is",null).returning("id").execute();return new Set(Z.map((Q)=>Q.id))}function R16($){let Z=new Map;for(let Q of $){let Y=Z.get(Q.userId);if(Y)Y.push(Q);else Z.set(Q.userId,[Q])}return[...Z.values()]}function FQ1(){let $=dK().auth,Z=$.emailProviders??[],Q=$.inviteEmailProviderId?_G(Z,$.inviteEmailProviderId):Z[0];return Q?CG(Q):null}function q16($){if($.length>254)return!1;if($.length<3)return!1;if($.includes(" "))return!1;let Z=$.lastIndexOf("@");if(Z<=0||Z===$.length-1)return!1;if(!$.substring(Z+1).includes("."))return!1;return!0}async function M16($){let Z=FQ1();if(!Z)throw Error("no email provider configured");let Q=$[0].email;if(!q16(Q))throw Error(`invalid recipient email: ${Q.substring(0,50)}`);let{subject:Y,html:X}=Iv$($,WZ());if(Y.length>1000)throw Error(`digest subject too long: ${Y.length} chars (max 1000)`);if(X.length>1e6)throw Error(`digest html too long: ${X.length} bytes (max 1MB)`);await Z({to:Q,subject:Y,html:X})}async function I16($){await HQ1().db.deleteFrom("notifications").where("created_at","<",$).execute()}async function _v$($,Z){if($.length===0)return;let Q=await uU.runStep(()=>T16($.map((X)=>X.id)),{name:`claimForEmail:${Z}`}),Y=$.filter((X)=>Q.has(X.id));if(Y.length===0)return;await uU.runStep(()=>M16(Y),{name:`sendDigest:${Z}`,retriesAllowed:!0,maxAttempts:3})}async function V16($,Z){let Q=Z-Date.now();if(Q>0)await uU.sleep(Q);if(!FQ1())return;let Y=await uU.runStep(()=>P16($),{name:"loadPendingForUser"});try{await _v$(Y,$)}catch(X){console.warn(`[notifications] digest for ${$} failed:`,X instanceof Error?X.message:X)}}async function k16($,Z){let Q=new Date($.getTime()-GQ1-j16),Y=FQ1()?await uU.runStep(()=>A16(Q),{name:"loadOrphanedNotifications"}):[];for(let X of R16(Y)){let J=X[0].userId;try{await _v$(X,J)}catch(G){console.warn(`[notifications] sweep digest for ${J} failed:`,G instanceof Error?G.message:G)}}if($.getUTCMinutes()<2)await uU.runStep(()=>I16(new Date($.getTime()-z16)),{name:"pruneOldNotifications"})}function vv$($){if(!KQ1)return;let Z=Math.floor(Date.now()/GQ1),Q=(Z+1)*GQ1;uU.startWorkflow(KQ1,{workflowID:`notif-digest:${$}:${Z}`})($,Q).catch((Y)=>{console.debug("[notifications] digest enqueue skipped:",Y instanceof Error?Y.message:Y)})}function bv$(){if(JQ1)return;KQ1=uU.registerWorkflow(V16,{name:"notificationUserDigestWorkflow"}),JQ1=uU.registerWorkflow(k16,{name:"notificationDigestWorkflow"}),uU.registerScheduled(JQ1,{name:"notificationDigestWorkflow",crontab:w16,mode:L16.ExactlyOncePerIntervalWhenActive})}var w16="*/2 * * * *",GQ1=30000,j16=60000,E16=500,z16=2592000000,WQ1=null,JQ1=null,KQ1=null;var UQ1=D(()=>{ws();M9();B2();Vv$();nR0()});async function S16($,Z){return await $.selectFrom("task_board_items").select(["organization_id","title","key_seq"]).where("id","=",Z).executeTakeFirst()}async function C16($,Z){if(!Z)return{name:null,image:null};let Q=await $.selectFrom("user").select(["name","image"]).where("id","=",Z).executeTakeFirst();return{name:Q?.name??null,image:Q?.image??null}}async function Ld($){let{db:Z,taskBoardItemId:Q,type:Y,actorId:X}=$;try{let J=[],G=await S16(Z,Q);if(!G)return;let W=async(K)=>{let H=[...new Set($.alsoSubscribe?.filter((L)=>!!L))];if(H.length>0)await K.insertInto("notification_subscriptions").values(H.map((L)=>({id:i8("nsub"),user_id:L,task_board_item_id:Q}))).onConflict((L)=>L.columns(["user_id","task_board_item_id"]).doNothing()).execute();let F=$.recipients,N=(F?[...new Set(F.filter((L)=>!!L))]:(await K.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",Q).where("subscribed","=",!0).execute()).map((L)=>L.user_id)).filter((L)=>L!==X);if(N.length===0)return;J=N;let B=await C16(K,X),O=Od.parse({taskTitle:G.title,taskKeySeq:G.key_seq??null,actorName:B.name,actorImage:B.image});await K.insertInto("notifications").values(N.map((L)=>({id:i8("notif"),user_id:L,organization_id:G.organization_id,task_board_item_id:Q,type:Y,actor_id:X,data:JSON.stringify(O)}))).execute()};await(Z.isTransaction?W(Z):Z.transaction().execute(W));for(let K of J)vv$(K),J9.emit(G.organization_id,{id:crypto.randomUUID(),type:Tv$,source:"notifications",subject:K,time:new Date().toISOString()})}catch(J){console.error("[notifications] fan-out failed",J)}}var tR0=D(()=>{FY();dR0();R$0();UQ1();nR0()});import{sql as iJ}from"kysely";function v16($){return _16.has($)?$:null}function oR0($){let Z=(Q)=>Q instanceof Date?Q.toISOString():Q;return{id:$.id,taskBoardItemId:$.task_board_item_id,parentId:$.parent_id,authorId:$.author_id,threadId:$.thread_id,body:$.body,resolved:$.resolved,createdAt:Z($.created_at),updatedAt:Z($.updated_at)}}function xv$($){if($&&typeof $==="object"&&!Array.isArray($)){let Z=$.text;if(typeof Z==="string"&&Z.trim())return Z.trim()}return null}function NQ1($,Z=!1){if($.status!=="in_progress")return!1;let Q=$.threads.filter((Y)=>Y.hasMessages);if(Q.length===0)return!1;if($.repo!=null&&!Z)return!1;if(!Q.every((Y)=>Y.status!==null&&M$0.has(Y.status)))return!1;return Q.some((Y)=>Y.status==="completed")}function f16($){let Z=typeof $==="string"?(()=>{try{return JSON.parse($)}catch{return null}})():$;if(!Z||typeof Z!=="object")return!1;let Q=IK(Z)?.repository?.url;return typeof Q==="string"&&Q.length>0}function y16($){if($===null||$===void 0)return null;let Z=typeof $==="number"?$:Number($);return Number.isFinite(Z)?Z:null}function g16($,Z){let Q=(J)=>J instanceof Date?J.getTime():new Date(J).getTime(),Y=Q($),X=Z===null?Number.NEGATIVE_INFINITY:Q(Z);return new Date(Math.max(Y,X)).toISOString()}class D3{db;constructor($){this.db=$}inTransaction($){return this.db.isTransaction?$(this.db):this.db.transaction().execute($)}async list($){let Q=(await this.db.selectFrom("task_board_items").selectAll().where("organization_id","=",$).where("dismissed_at","is",null).where("source","is",null).orderBy("sort_order","asc").execute()).map((Y)=>this.itemFromDbRow(Y));return await this.attachRefs(Q,$),Q}async searchByTitle($,Z,Q){return(await this.db.selectFrom("task_board_items").selectAll().where("organization_id","=",$).where("dismissed_at","is",null).where("source","is",null).where("title","ilike",`%${dh(Z)}%`).orderBy("updated_at","desc").limit(Q).execute()).map((X)=>this.itemFromDbRow(X))}async getById($,Z){let Q=await this.db.selectFrom("task_board_items").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();if(!Q)return null;let Y=this.itemFromDbRow(Q);return await this.attachRefs([Y],Z),Y}async create($){let Z=i8("board"),Q=new Date().toISOString(),Y=$.status??"triage",X=(W)=>W.insertInto("task_board_items").values({id:Z,organization_id:$.organizationId,title:$.title,description:$.description??null,status:Y,priority:$.priority??"medium",type:$.type??H81,assignee_id:$.assigneeId??null,assigned_by:$.assignedBy??null,repo:$.repo??null,repository_id:$.repositoryId??null,due_date:$.dueDate??null,external_key:$.externalKey??null,external_url:$.externalUrl??null,source:$.source??null,sort_order:iJ`(
@@ -3724,7 +3724,7 @@ ${J.join(`
 `)}`:X}function hn6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var RQ8=200,kn6=12,Cn6,vn6=300,fC0=3;var UD1=D(()=>{Z7();Y8();xC0();Cn6={aheadBy:0,behindBy:0,files:[]}});function ln6($){if(!$||$.includes(".."))return!1;return un6.test($)}function MQ8($){return cn6.includes($)}function ND1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!ln6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function BD1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var un6,cn6;var IQ8=D(()=>{un6=/^[\w./@-]+$/;cn6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function v60($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function kQ8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new aE(k7);let J=await kj($.storage,X,Y);if(J&&await HD($.storage,J)){let F=await zU($,J,{forceRefresh:!0}).catch((U)=>{throw new aE(U instanceof Error?U.message:k7)});await VQ8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new aE("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Km({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:k7;throw new aE(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await AU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=_O$(F instanceof Error?F.message:String(F));throw U?new aE(N):F});await VQ8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function VQ8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=zp($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await ZE(K,mn6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var mn6=10485760,aE;var DD1=D(()=>{TW();MC0();G$0();zH0();b00();Z7();aE=class aE extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function in6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!dn6.test(Z))throw Error(`Invalid branch name: ${$}`)}function iy($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(pn6)])}async function tn6($,Z){let Q=$.var.studioContext,Y=CU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Ef(G?.metadata?.runtime);if(W)return W;let K=ER0(Z.virtualMcpMetadata),H=K==="cms"?await iB1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)W$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function on6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await gX($.var.studioContext)}catch{return null}}function py($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function qp($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=v60(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=G0(Y);return Jm(Y,J.id,X)}function LD1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=nB$(Z);if(Y!==void 0)return $.json({error:Q},429,{...G9,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof s6)return $.json({error:Q},409,G9);let X=IW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,G9)}return $.json({error:Q},502,G9)}async function OD1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function vQ8($){try{let Z=await qp($),Q=await yC0(Z,$.get("vmClaim").branch);return $.json(Q,200,G9)}catch(Z){return LD1($,Z)}}function b60($,Z){let Y=(uC0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return uC0.set($,X),X.finally(()=>{if(uC0.get($)===X)uC0.delete($)}),Y}async function UQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,G9);let Y=Q?.runner??py($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...G9}})}}let O=await B.text(),L=Q?.redactRepoDir?rn6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...G9}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function rn6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function lC0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function sn6($){return bQ8.includes($)}var dn6,SQ8=524288,CQ8=65536,pn6=1e4,_Q8=2000,nn6,uC0,G9,bQ8,xQ8=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",nn6),$.post("/:virtualMcpId/:branch/write",(Q)=>UQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>UQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>UQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>UQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>UQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>UQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>UQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:iy(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return UQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return UQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>UQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>UQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!sn6(Y))return Q.json({error:`step must be one of: ${bQ8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await iB1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await on6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,G9);if(Y==="start"){let G=G0(Q.var.studioContext),W=Qd(X.virtualMcpMetadata);try{await OR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return UQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return KO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return _78(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return vQ8(Q);return Z(Q)});let Z=(Q)=>UQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(_Q8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return vQ8(Q);return UQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(_Q8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await qp(Q),G=await gC0(J,Y.branch,X.base);return Q.json(G,200,G9)}catch(X){return LD1(Q,X)}return UQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,G9);let Y=py(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return b60(X,async()=>{try{await pB1(W,Y,X);let K=v60(J,G);if(K)await kQ8(W,Y,X,K)}catch(K){if(K instanceof aE)return Q.json({error:K.message},403,G9);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,G9)}return UQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return b60(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,G9);try{let G=await qp(Q);return await qQ8(G,Y.branch,J),Q.json({ok:!0},200,G9)}catch(G){let W=IW(G)===409||G instanceof s6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,G9)}});return b60(Y.claimName,()=>UQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return b60(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await qp(Q),H=W.base??await K.getDefaultBranch();return await hC0(K,Y.branch,H),Q.json({ok:!0},200,G9)}catch(W){return LD1(Q,W)}});let X=py(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return b60(J,async()=>{try{await pB1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,G9)}return UQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",v5({maxSize:SQ8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=py(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=oB1(F)&&N?[F,U]:X?await Promise.all([lC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),lC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await qp(Q);return Promise.all([yC0(w,Y.branch),gC0(w,Y.branch)])})();await oG(K,G0(K).id,"suggesting a commit message");let L=await y78(K,B,O);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",v5({maxSize:SQ8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=py(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=oB1(F)&&N?[F,U]:X?await Promise.all([lC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),lC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await qp(Q);return Promise.all([yC0(w,Y.branch),gC0(w,Y.branch)])})();await oG(K,G0(K).id,"judging whether a change needs review");let L=await h78(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=py(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return OD1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",v5({maxSize:CQ8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=py(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=ND1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=BD1(J,W.resolveType);return OD1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",v5({maxSize:CQ8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):Yd(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=ND1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!MQ8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=BD1(G,K.resolveType);return OD1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var fQ8=D(()=>{J8();eW();Ep();dB1();Zd();k78();xW();Xd();S78();vW();JH();C78();v78();$71();J$0();aB1();u78();Z7();A5();UD1();IQ8();jR0();DD1();dn6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;nn6=qC0(async($,Z)=>{let Q=$.var.studioContext;try{t(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=d0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=G0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{in6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=H10({orgId:X.id,virtualMcpId:J,branch:G}),H=await R91(Q,G),F=q91(H,Y),U=V78({userId:F,projectRef:K}),N=W.metadata??null,B=await tn6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await gX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});uC0=new Map;G9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};bQ8=["clone","install","start"]});function yQ8($,Z,Q){let Y=wD1.get($);if(!Y)Y={pending:null,running:!1},wD1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)en6($,Y);return J}async function en6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await $t6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)wD1.delete($)}}async function $t6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await Rp(Z,Q),W=await Z.listDecofileEntries(G,Y),K=KD1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=HD1(K,N),L=`${JSON.stringify(B,null,2)}
 `;await zQ8(Z.repo,L);let w=O[0]??`${bC0(Y)}/${ZD1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of HD1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await PQ8(Z,F.values(),X),{decofile:B,skipped:O}=M60(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:GH(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:Zt6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof s6)||J>=an6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function Zt6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return X51(Y,$.deps.coAuthor)}var an6=3,wD1;var gQ8=D(()=>{lA0();VC0();i4();Y8();Z7();xC0();wD1=new Map});import{createHmac as hQ8,randomBytes as Qt6,timingSafeEqual as Yt6}from"crypto";function uQ8(){if(cC0)return cC0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return cC0=$?Buffer.from($):Qt6(32),cC0}function jD1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+Xt6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=hQ8("sha256",uQ8()).update(Y).digest("base64url");return`${Y}.${X}`}function lQ8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(hQ8("sha256",uQ8()).update(Y).digest("base64url"));if(X.length!==J.length||!Yt6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var Xt6=21600000,cC0=null;var cQ8=D(()=>{X$()});function mC0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function Jt6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=mC0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function mQ8($){let Z;try{Z=mC0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=Jt6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=mC0(G),K=W&&mC0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as Mp}from"zod";function Wt6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&Gt6.test($)}function tQ8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function x60($){let Z=$.get("decofileScope");return Jm($.var.studioContext,Z.organizationId,Z.repository)}function f60($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof s6)return $.json({error:Q},409);let Y=IW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function oQ8(){let $=new Z1;return $.use("/:virtualMcpId/:branch",nQ8),$.use("/:virtualMcpId/:branch/*",nQ8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await x60(Z),X=await AQ8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(mQ8(X.decofile),200,{...J,"content-type":"application/json"});let G=jD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(tQ8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return f60(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await x60(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return f60(Z,X)}}),$.patch("/:virtualMcpId/:branch",Ht6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=Ft6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=I60(X.data)}catch(G){if(G instanceof V60)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{IC0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if($D1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await x60(Z),W=await yQ8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:zp(Y)},J),K=jD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:tQ8(Z)})}catch(G){return f60(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await x60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(IW(W)!==409)throw W;await hC0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(IW(G)===409)return Z.json({error:"merge-conflict"},409);if(IW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return f60(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await x60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(IW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return f60(Z,Y)}}),$}var Gt6,dQ8=500,iQ8=1048576,pQ8=1024,Kt6=8388608,Ht6,Ft6,nQ8;var rQ8=D(()=>{jR0();VC0();J8();eW();dB1();MC0();DD1();Z7();gQ8();cQ8();UD1();xC0();JH();Gt6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Ht6=v5({maxSize:Kt6,onError:($)=>$.json({error:"Payload too large"},413)}),Ft6=Mp.object({set:Mp.record(Mp.string(),Mp.unknown()).optional(),delete:Mp.array(Mp.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=dQ8,{message:`Patch cannot touch more than ${dQ8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=iQ8),{message:`Each block must be at most ${iQ8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=pQ8),{message:`Each block key must be at most ${pQ8} characters`}),nQ8=qC0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!Wt6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!lQ8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await MJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Yd(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=v60(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var sQ8=($)=>{let Z=new Z1;if(Z.use("*",si),Z.use("*",A68),Z.route("/",z68($.voiceSessions)),Z.route("/",bS0()),Z.route("/",X58()),Z.route("/",d68()),Z.route("/",B78()),Z.route("/",O78()),Z.route("/",J78()),Z.route("/",U78()),Z.route("/",W78()),Z.route("/",AC0()),Z.route("/tools",A78()),Z.route("/",E78()),Z.route("/",yZ8({kvStorage:$.kvStorage})),Z.route("/",xZ8()),Z.route("/fs",rZ8({getConnection:$.getNatsConnection})),Z.route("/sandbox",xQ8()),Z.route("/decofile",oQ8()),Z.route("/",Q78()),Z.route("/",aZ8()),Z.route("/deco-sites",fS0()),Z.route("/hosting",v68()),Z.route("/monitor",u68()),Z.route("/sso",kS0()),Z.route("/",TC0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",V68()),$.mountDevAssets)Z.route("/dev-assets",uS0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",I$8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",$78()),Z.route("/mcp",IM0()),Z.route("/mcp/self",jC0()),Z.route("/mcp",SM0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var aQ8=D(()=>{J8();P68();T68();wS0();k68();UN1();b68();l68();lS0();pE();GN1();LN1();fZ8();gZ8();sZ8();eZ8();O80();aU1();CM0();xB1();Z78();Y78();G78();K78();gB1();D78();L78();z78();hB1();T78();uB1();VM0();fQ8();rQ8()});import{z as ny}from"zod";class ED1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new ZY8.Kvm(dC0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:dC0.StorageType.Memory,ttl:QY8.nanos(AD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?$Y8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await z$(200);continue}let G=eQ8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await z$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,eQ8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?$Y8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var dC0,ZY8,QY8,eQ8,$Y8;var YY8=D(()=>{DJ();vU();Y8();dC0=C(BK(),1),ZY8=C(e2(),1),QY8=C(jz(),1),eQ8=new TextEncoder,$Y8=ny.discriminatedUnion("state",[ny.object({state:ny.literal("ready"),agentId:ny.string()}),ny.object({state:ny.literal("creating"),expiresAt:ny.number()})])});import{z as Ip}from"zod";function Ut6($){return{model:$.model,instructions:`${TR$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class zD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ut6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Ip.object({session:Ip.object({id:Ip.string().min(1)}),transport:Ip.object({type:Ip.literal("webrtc"),sdp:Ip.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var XY8=D(()=>{vU()});var JY8;var GY8=D(()=>{JY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function PD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:PR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:JY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:AD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var WY8=D(()=>{vU();GY8()});import{z as pX}from"zod";import{createHash as Nt6,createHmac as Bt6}from"crypto";class iC0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Nt6("sha256").update(JSON.stringify(PD1($))).digest("hex"),this.conversationKey=Bt6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new iC0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=pX.object({agents:pX.array(pX.object({agent_id:pX.string(),name:pX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return pX.object({platform_settings:pX.object({auth:pX.object({enable_auth:pX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...PD1(this.config)},AbortSignal.timeout(15000));return pX.object({agent_id:pX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return pX.object({token:pX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return pX.object({token:pX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var KY8=D(()=>{WY8()});import{createHmac as Dt6,timingSafeEqual as Ot6}from"crypto";import{z as Vp}from"zod";function FY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Dt6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function UY8($,Z){let Q=Buffer.from(JSON.stringify(HY8.parse($))).toString("base64url");return`${Q}.${FY8(Q,Z)}`}function NY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(FY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Ot6(W,G))return null;try{let K=HY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+AD)return null;return K.data}catch{return null}}var HY8;var BY8=D(()=>{vU();HY8=Vp.object({sessionId:Vp.string().uuid(),organizationId:Vp.string().min(1).max(256),userId:Vp.string().min(1).max(256),threadId:Vp.string().min(1).max(256),expiresAt:Vp.number().int().positive()})});import{z as AD1}from"zod";function DY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return TD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var TD1;var OY8=D(()=>{TD1=AD1.object({provider:AD1.enum(["elevenlabs","openai"]),model:AD1.string().trim().min(1).max(128)})});import{createHash as Lt6}from"crypto";import{z as kp}from"zod";function Sp($){return`user.${Lt6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class qD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new LY8.Kvm(nC0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:nC0.StorageType.Memory,ttl:wY8.nanos(AD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=DY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+AD},W=UY8(G,this.deps.secret),K=await this.kv(),H=Sp(G),F=await K.get(H),U=F?.operation==="PUT"?pC0.parse(F.json()):null,N=RD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:Sp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=NY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Sp(Q),J=await Y.get(X),G=J?.operation==="PUT"?pC0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,RD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Sp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?pC0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,RD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Sp($));if(Q?.operation==="PUT"&&pC0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Sp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var nC0,LY8,wY8,pC0,RD1;var jY8=D(()=>{DJ();vU();BY8();OY8();nC0=C(BK(),1),LY8=C(e2(),1),wY8=C(jz(),1),pC0=kp.object({sessionId:kp.string().uuid(),expiresAt:kp.number(),connected:kp.boolean().optional(),conversation:TD1.optional(),characters:kp.number().int().nonnegative(),requests:kp.number().int().nonnegative()}),RD1=new TextEncoder});function wt6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jt6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},EY8=()=>{let $=new Z1;return $.use("*",jt6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:wt6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var zY8=D(()=>{J8();X$();Tk0()});import{z as y1}from"zod";function wN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Vt6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function kt6($,Z,Q){try{return JSON.parse($)}catch{throw new TY8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function St6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:kt6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ct6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?mF(Q.function.parameters):mF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function _t6($){if(!$)return;return{openai:{response_format:$}}}function vt6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function PY8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function AY8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Et6=256,zt6,Pt6,At6,Tt6,Rt6,qt6,Mt6,It6,TY8,RY8,qY8;var MY8=D(()=>{y4();J8();Ep();CH();zt6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Pt6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),At6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Pt6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Tt6=y1.object({type:y1.literal("text")}),Rt6=y1.object({type:y1.literal("json_object")}),qt6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Mt6=y1.union([Tt6,Rt6,qt6]),It6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(At6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(zt6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Mt6.optional(),user:y1.string().optional()});TY8=class TY8 extends Error{constructor($){super($);this.name="MessageConversionError"}};RY8=new Z1;RY8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(wN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=It6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Vt6(J.model);if(!G)return $.json(wN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>DP(E.providerId));if(!j)return $.json(wN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(wN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=St6(J.messages),N=J.tools?Ct6(J.tools):void 0,B=_t6(J.response_format),O=vt6(),L=Math.floor(Date.now()/1000);if(J.stream)return KO($,async(w)=>{let j=PY8(F,U,N,J,B,$.req.raw.signal);try{let E=$d(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Et6)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:AY8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=PY8(F,U,N,J,B,$.req.raw.signal),j=await xU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:AY8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(wN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(wN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(wN(X.message,"server_error"),500)}});qY8=RY8});function bt6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function IY8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=d0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||V9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(UA(U)!==J)continue;if(!bt6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var VY8=D(()=>{J8();aG()});var SY8;var kY8=D(()=>{SY8={name:"decocms",version:"4.422.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function yt6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??ft6}}var CY8,ft6="https://ph.studio.decocms.com",_Y8;var vY8=D(()=>{J8();ws();yf();M9();X$();gU1();kY8();CY8=new Z1;CY8.get("/",($)=>{let Z={version:SY8.version,theme:_6$(),...dK().logo&&{logo:dK().logo},...vD()&&{internalUrl:Hp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:j48(),posthog:yt6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:zO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});_Y8=CY8});function ty($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function MD1($){return(ty($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function bY8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ty($))}&sz=${Z}`}function gt6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function xY8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=gt6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as E$}from"zod";var ht6,fY8;var yY8=D(()=>{ht6=E$.object({check_id:E$.string(),title:E$.string(),description:E$.string().optional(),impact:E$.string().optional(),why:E$.string().optional(),category:E$.string(),severity:E$.string(),value_band:E$.string().optional(),value_driver:E$.string().optional(),controllability:E$.string().optional(),pages:E$.array(E$.string()),tasks:E$.array(E$.string()),evidence:E$.string(),sample_scope:E$.string().optional(),sources:E$.array(E$.string())}),fY8=E$.object({domain:E$.string(),brand:E$.string(),favicon:E$.string().optional(),scanned_at:E$.string().nullable(),lang:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),totals:E$.object({measured:E$.number(),registry_total:E$.number(),passed:E$.number(),failed:E$.number(),blocked:E$.number()}),buckets:E$.array(E$.object({id:E$.enum(["critical","important","worth"]),label:E$.string(),items:E$.array(ht6)})),passing:E$.object({count:E$.number(),items:E$.array(E$.object({check_id:E$.string(),title:E$.string()}))}),not_measured:E$.object({count:E$.number(),groups:E$.array(E$.object({reason:E$.string(),label:E$.string(),count:E$.number(),checks:E$.array(E$.string())}))}),categories:E$.array(E$.object({key:E$.string(),label:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),pass:E$.number(),fail:E$.number()})),screenshots:E$.array(E$.object({url:E$.string(),page_type:E$.string().optional(),viewport:E$.enum(["desktop","mobile"]),image_url:E$.string()}))})});function gY8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function tC0($,Z={}){let Q=await fetch(gY8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return fY8.parse(await Q.json())}async function hY8($,Z={}){let Q=await fetch(gY8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var ID1=D(()=>{yY8();mB()});import{join as uY8}from"path";async function lt6($){try{let Z=await tC0($,{signal:AbortSignal.timeout(ut6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||MD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function ct6($,Z){let Q=ty($),Y=Z?.brand?.trim()||MD1(Q),X=bY8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=xY8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class zD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ut6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Ip.object({session:Ip.object({id:Ip.string().min(1)}),transport:Ip.object({type:Ip.literal("webrtc"),sdp:Ip.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var XY8=D(()=>{vU()});var JY8;var GY8=D(()=>{JY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function PD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:PR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:JY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:AD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var WY8=D(()=>{vU();GY8()});import{z as pX}from"zod";import{createHash as Nt6,createHmac as Bt6}from"crypto";class iC0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Nt6("sha256").update(JSON.stringify(PD1($))).digest("hex"),this.conversationKey=Bt6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new iC0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=pX.object({agents:pX.array(pX.object({agent_id:pX.string(),name:pX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return pX.object({platform_settings:pX.object({auth:pX.object({enable_auth:pX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...PD1(this.config)},AbortSignal.timeout(15000));return pX.object({agent_id:pX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return pX.object({token:pX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return pX.object({token:pX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var KY8=D(()=>{WY8()});import{createHmac as Dt6,timingSafeEqual as Ot6}from"crypto";import{z as Vp}from"zod";function FY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Dt6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function UY8($,Z){let Q=Buffer.from(JSON.stringify(HY8.parse($))).toString("base64url");return`${Q}.${FY8(Q,Z)}`}function NY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(FY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Ot6(W,G))return null;try{let K=HY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+AD)return null;return K.data}catch{return null}}var HY8;var BY8=D(()=>{vU();HY8=Vp.object({sessionId:Vp.string().uuid(),organizationId:Vp.string().min(1).max(256),userId:Vp.string().min(1).max(256),threadId:Vp.string().min(1).max(256),expiresAt:Vp.number().int().positive()})});import{z as AD1}from"zod";function DY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return TD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var TD1;var OY8=D(()=>{TD1=AD1.object({provider:AD1.enum(["elevenlabs","openai"]),model:AD1.string().trim().min(1).max(128)})});import{createHash as Lt6}from"crypto";import{z as kp}from"zod";function Sp($){return`user.${Lt6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class qD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new LY8.Kvm(nC0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:nC0.StorageType.Memory,ttl:wY8.nanos(AD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=DY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+AD},W=UY8(G,this.deps.secret),K=await this.kv(),H=Sp(G),F=await K.get(H),U=F?.operation==="PUT"?pC0.parse(F.json()):null,N=RD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:Sp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=NY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Sp(Q),J=await Y.get(X),G=J?.operation==="PUT"?pC0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,RD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Sp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?pC0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,RD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Sp($));if(Q?.operation==="PUT"&&pC0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Sp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var nC0,LY8,wY8,pC0,RD1;var jY8=D(()=>{DJ();vU();BY8();OY8();nC0=C(BK(),1),LY8=C(e2(),1),wY8=C(jz(),1),pC0=kp.object({sessionId:kp.string().uuid(),expiresAt:kp.number(),connected:kp.boolean().optional(),conversation:TD1.optional(),characters:kp.number().int().nonnegative(),requests:kp.number().int().nonnegative()}),RD1=new TextEncoder});function wt6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var jt6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},EY8=()=>{let $=new Z1;return $.use("*",jt6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:wt6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var zY8=D(()=>{J8();X$();Tk0()});import{z as y1}from"zod";function wN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Vt6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function kt6($,Z,Q){try{return JSON.parse($)}catch{throw new TY8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function St6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:kt6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ct6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?mF(Q.function.parameters):mF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function _t6($){if(!$)return;return{openai:{response_format:$}}}function vt6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function PY8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function AY8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Et6=256,zt6,Pt6,At6,Tt6,Rt6,qt6,Mt6,It6,TY8,RY8,qY8;var MY8=D(()=>{y4();J8();Ep();CH();zt6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Pt6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),At6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Pt6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Tt6=y1.object({type:y1.literal("text")}),Rt6=y1.object({type:y1.literal("json_object")}),qt6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Mt6=y1.union([Tt6,Rt6,qt6]),It6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(At6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(zt6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Mt6.optional(),user:y1.string().optional()});TY8=class TY8 extends Error{constructor($){super($);this.name="MessageConversionError"}};RY8=new Z1;RY8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(wN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=It6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Vt6(J.model);if(!G)return $.json(wN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>DP(E.providerId));if(!j)return $.json(wN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(wN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=St6(J.messages),N=J.tools?Ct6(J.tools):void 0,B=_t6(J.response_format),O=vt6(),L=Math.floor(Date.now()/1000);if(J.stream)return KO($,async(w)=>{let j=PY8(F,U,N,J,B,$.req.raw.signal);try{let E=$d(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Et6)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:AY8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=PY8(F,U,N,J,B,$.req.raw.signal),j=await xU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:AY8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(wN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(wN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(wN(X.message,"server_error"),500)}});qY8=RY8});function bt6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function IY8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=d0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||V9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(UA(U)!==J)continue;if(!bt6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var VY8=D(()=>{J8();aG()});var SY8;var kY8=D(()=>{SY8={name:"decocms",version:"4.423.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function yt6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??ft6}}var CY8,ft6="https://ph.studio.decocms.com",_Y8;var vY8=D(()=>{J8();ws();yf();M9();X$();gU1();kY8();CY8=new Z1;CY8.get("/",($)=>{let Z={version:SY8.version,theme:_6$(),...dK().logo&&{logo:dK().logo},...vD()&&{internalUrl:Hp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:j48(),posthog:yt6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:zO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});_Y8=CY8});function ty($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function MD1($){return(ty($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function bY8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ty($))}&sz=${Z}`}function gt6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function xY8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=gt6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as E$}from"zod";var ht6,fY8;var yY8=D(()=>{ht6=E$.object({check_id:E$.string(),title:E$.string(),description:E$.string().optional(),impact:E$.string().optional(),why:E$.string().optional(),category:E$.string(),severity:E$.string(),value_band:E$.string().optional(),value_driver:E$.string().optional(),controllability:E$.string().optional(),pages:E$.array(E$.string()),tasks:E$.array(E$.string()),evidence:E$.string(),sample_scope:E$.string().optional(),sources:E$.array(E$.string())}),fY8=E$.object({domain:E$.string(),brand:E$.string(),favicon:E$.string().optional(),scanned_at:E$.string().nullable(),lang:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),totals:E$.object({measured:E$.number(),registry_total:E$.number(),passed:E$.number(),failed:E$.number(),blocked:E$.number()}),buckets:E$.array(E$.object({id:E$.enum(["critical","important","worth"]),label:E$.string(),items:E$.array(ht6)})),passing:E$.object({count:E$.number(),items:E$.array(E$.object({check_id:E$.string(),title:E$.string()}))}),not_measured:E$.object({count:E$.number(),groups:E$.array(E$.object({reason:E$.string(),label:E$.string(),count:E$.number(),checks:E$.array(E$.string())}))}),categories:E$.array(E$.object({key:E$.string(),label:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),pass:E$.number(),fail:E$.number()})),screenshots:E$.array(E$.object({url:E$.string(),page_type:E$.string().optional(),viewport:E$.enum(["desktop","mobile"]),image_url:E$.string()}))})});function gY8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function tC0($,Z={}){let Q=await fetch(gY8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return fY8.parse(await Q.json())}async function hY8($,Z={}){let Q=await fetch(gY8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var ID1=D(()=>{yY8();mB()});import{join as uY8}from"path";async function lt6($){try{let Z=await tC0($,{signal:AbortSignal.timeout(ut6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||MD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function ct6($,Z){let Q=ty($),Y=Z?.brand?.trim()||MD1(Q),X=bY8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=xY8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
     `)}function mt6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function lY8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=ty(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(uY8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(dt6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=ty(Q.req.param("file").replace(/\.md$/,""));try{let X=await hY8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(it6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?uY8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await lt6(ty(Y)),K=ct6(Y,W);return Q.html(mt6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var ut6=2500,dt6=1e4,it6=1e4;var cY8=D(()=>{J8();mB();ID1();X$()});function oC0($,Z){return fetch(`${jW({})}${$}`,Z)}async function pt6($,Z){let Q=await tC0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function tt6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var nt6,FO,mY8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},dY8;var iY8=D(()=>{J8();Z3();mB();ID1();nt6=new Set(["complete","errored","terminated","unknown"]);FO=new Z1;FO.use("*",async($,Z)=>{let Q=await x8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});FO.use("/link-token/*",mY8);FO.use("/suggest",mY8);FO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await pt6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});FO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=tt6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await oC0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${iw({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});FO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await oC0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${iw({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:nt6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});FO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await oC0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});FO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await oC0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});dY8=FO});var ot6=1048576,VD1;var pY8=D(()=>{J8();eW();X$();TU1();VD1=new Z1;VD1.post("/webhook",v5({maxSize:ot6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=E0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!C88(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=_88(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await v88(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as rt6}from"crypto";function et6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return rt6(Buffer.from(X),Buffer.from(Y))}function $o6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function nY8($){let Z=new Z1;return Z.post("/webhook",v5({maxSize:st6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!et6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!at6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return T10().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=$o6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await Zo6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function Zo6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await Nb$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var st6=5242880,at6;var tY8=D(()=>{J8();eW();vW();C7();at6=new Set(["check_suite","issue_comment"])});import{DBOS as SD1,SchedulerMode as Qo6}from"@dbos-inc/dbos-sdk";async function Xo6(){try{return await Jo6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function Jo6(){if(!A10())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (D91(),B91)),Promise.resolve().then(() => (N91(),U91))]),Q=await T10(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=D8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=kA$({sandboxes:J,pools:G,records:await SA$(X,J,G),now:W}),{batches:H,failed:F}=await CA$(K,PH0(X,new UX(E0().encryptionKey)),{now:W,orgFsLifetimeMs:ZT0}),U=0,N=0;for(let B of H){let O=await Y.pushCredentials(B);U+=O.stored,N+=O.kept}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F}}async function Go6($,Z){let Q=await SD1.runStep(Xo6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function oY8(){if(kD1)return;if(!E0().agentSandboxEnabled||!A10())return;kD1=SD1.registerWorkflow(Go6,{name:"sandboxCredentialPushWorkflow"}),SD1.registerScheduled(kD1,{name:"sandboxCredentialPushWorkflow",crontab:Yo6,mode:Qo6.ExactlyOncePerIntervalWhenActive})}var Yo6="1-59/10 * * * *",kD1=null;var rY8=D(()=>{SG();WL();Y41();QT0();vW();X$()});function sY8($){let Z=new sD($.db,new UX($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=I_$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new lQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var aY8=D(()=>{J8();WL();M71();GE();h40()});import{DBOS as eE,SchedulerMode as Wo6}from"@dbos-inc/dbos-sdk";function eY8($){_D1=$}function bD1(){if(!_D1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return _D1}function xD1(){let $=bD1();return new sD($.db,new UX($.encryptionKey))}async function No6($){try{let Z=await xD1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await MH(bD1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new lQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${Ho6}m"`,W=0,K;for(let H=0;H<Fo6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await _H1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function Bo6($,Z){let Q=await eE.runStep(()=>xD1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>eE.runStep(()=>No6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function Do6($,Z){try{let Q=await xD1().getById($);if(!Q?.enabled)return"disabled";let Y=await MH(bD1().db,Q.organizationId);if(!Y)return"disabled";let X=await _H1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function Oo6($,Z){await eE.sleep(Mk0()+Uo6),await eE.runStep(()=>Do6($,Z),{name:"settleJiraMove"})}async function $X8($,Z){if(!vD1)throw Error("[jira-trigger] settle workflow is not registered");await eE.startWorkflow(vD1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function ZX8(){if(CD1)return;vD1=eE.registerWorkflow(Oo6,{name:"jiraSettleWorkflow"}),CD1=eE.registerWorkflow(Bo6,{name:"jiraTriggerSweepWorkflow"}),eE.registerScheduled(CD1,{name:"jiraTriggerSweepWorkflow",crontab:Ko6,mode:Wo6.ExactlyOncePerIntervalWhenActive})}var Ko6="7-59/10 * * * *",Ho6=35,Fo6=5,Uo6=5000,_D1=null,vD1=null,CD1=null;var fD1=D(()=>{WL();h40();jd();GE();SH1();Ik0()});function QX8($){let Z=new sD($.db,new UX($.encryptionKey));async function Q(X,J){let G=Qe$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await $X8(W.id,G)}let Y=new Z1;return Y.post("/webhook/:secret",v5({maxSize:Lo6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var Lo6=1048576;var YX8=D(()=>{J8();eW();WL();fD1();Ik0();h40()});function XX8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var JX8,wo6,jo6,GX8;var WX8=D(()=>{J8();DJ();Md();hc();JX8=new Z1,wo6=["range","if-none-match","if-modified-since"],jo6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];JX8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(ri($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await t$0(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&PW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return XX8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of wo6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of jo6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),XX8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});GX8=JX8});var y60=b((oy)=>{var Eo6=oy&&oy.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),zo6=oy&&oy.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Eo6(Z,$,Q)};Object.defineProperty(oy,"__esModule",{value:!0});zo6(OG(),oy)});var FX8=b((KX8)=>{Object.defineProperty(KX8,"__esModule",{value:!0});KX8.version=void 0;KX8.version="3.4.0"});var BX8=b((jN)=>{var Po6=jN&&jN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(jN,"__esModule",{value:!0});jN.NodeTransport=jN.VERSION=void 0;jN.nodeResolveHost=Io6;var o5=y60(),Ao6=I0("net"),yD1=I0("tls"),To6=I0("path"),UX8=I0("fs"),Ro6=Po6(I0("dns")),qo6=FX8();jN.VERSION=qo6.version;var Mo6="nats.js";class NX8{socket;version;lang;yields=[];signal=(0,o5.deferred)();closedNotification=(0,o5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=Mo6,this.version=jN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,o5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw o5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new o5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new o5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,o5.deferred)(),Q,Y=(0,Ao6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,o5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=o5.DataBuffer.concat(...this.yields),X=(0,o5.extractProtocolMessage)(Y);if(X!=="")try{let J=o5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,o5.deferred)();try{if($=(0,To6.resolve)($),!(0,UX8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,UX8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,o5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new o5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,o5.deferred)();try{let X=(0,yD1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new o5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,o5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new o5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,o5.deferred)();try{let Y=(0,yD1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new o5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,o5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,o5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof yD1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,o5.render)($)}`);let Z=(0,o5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,o5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,o5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}jN.NodeTransport=NX8;function Io6($){let Z=(0,o5.deferred)();return Ro6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var jX8=b((wX8)=>{Object.defineProperty(wX8,"__esModule",{value:!0});wX8.connect=Vo6;var DX8=BX8(),OX8=y60(),LX8=y60();function Vo6($={}){if((0,LX8.hasWsProtocol)($))return Promise.reject(LX8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,OX8.setTransportFactory)({factory:()=>{return new DX8.NodeTransport},dnsResolveFn:DX8.nodeResolveHost}),OX8.NatsConnectionImpl.connect($)}});var EX8=b((UO)=>{var So6=UO&&UO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Co6=UO&&UO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))So6(Z,$,Q)};Object.defineProperty(UO,"__esModule",{value:!0});UO.connect=void 0;var _o6=jX8();Object.defineProperty(UO,"connect",{enumerable:!0,get:function(){return _o6.connect}});Co6(y60(),UO)});function TX8($){let Z=$?.connectFn??fo6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:xo6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(bo6,vo6,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?zX8.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=AX8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function fo6($){return PX8.connect($)}var zX8,PX8,AX8,vo6=100,bo6=3000,xo6=3000;var RX8=D(()=>{Y8();zX8=C(jz(),1),PX8=C(EX8(),1),AX8=C(BK(),1)});function rC0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function sC0($,Z){return`${$}.${Z}`}class gD1{cache;constructor($){this.cache=rC0({ttlMs:$?.ttlMs??yo6,maxSize:$?.maxSize??go6})}async get($,Z){return this.cache.get(sC0($,Z))??null}async set($,Z,Q){this.cache.set(sC0($,Z),Q)}async invalidate($,Z){this.cache.delete(sC0($,Z)),this.cache.delete(sC0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var yo6=600000,go6=5000;var qX8=()=>{};function aC0($,Z){return`${$}:${Z}`}function hD1($){let Z=rC0({ttlMs:$?.ttlMs??ho6,maxSize:$?.maxSize??uo6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(MX8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(aC0(K,H))},set(K,H,F){Z.set(aC0(K,H),F)},invalidate(K,H){Z.delete(aC0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(MX8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(aC0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var MX8="studio.ai-provider-keys.invalidate",ho6=30000,uo6=5000;var IX8=()=>{};class uD1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var VX8=($)=>{let Z;return()=>Z??=$()},lD1,cD1;var kX8=D(()=>{k6();lD1=VX8(()=>e1.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),cD1=VX8(()=>e1.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function no6($=_X8){return{name:iU,subjects:[`${_Y1}.>`],storage:iH.StorageType.File,max_age:mo6,max_bytes:io6,max_msgs_per_subject:po6,discard:iH.DiscardPolicy.Old,retention:iH.RetentionPolicy.Limits,duplicate_window:do6,num_replicas:$}}class vX8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function SX8($){let Z=CX8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function so6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,co6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function ao6($,Z){return $.info?.cluster?Z:1}function eo6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class mD1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=no6(X);try{await Y.streams.info(iU),await Y.streams.update(iU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(iU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(iU),await Y.streams.add(J);else throw G}},Q=await q8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await iH.jetstreamManager($),X=ao6($,_X8);try{await Z(Y,X)}catch(J){if(X<=1||!eo6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:xd});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=so6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=rf$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=bY1(H,{runId:Z}),N=performance.now()-F;lD1().record(N),cD1().add(1,{"org.id":Y??"unknown"}),ro6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?SX8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),oo6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await q8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:SX8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:xd}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=bY1(Z,{runId:$,dedup:Q});lD1().record(performance.now()-X),cD1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=of$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?iH.DeliverPolicy.New:iH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=DE($),W;try{W=await q8(async()=>{return(await Y.consumers.get(iU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:xd})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=oq0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(iq0()).pipeThrough(pq0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(iU,{filter:DE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var iH,CX8,lo6=($)=>{let Z;return()=>Z??=$()},co6,mo6=86400000000000,do6=120000000000,io6=4294967296,_X8,po6=500000,to6,oo6,ro6;var bX8=D(()=>{Y8();xY1();rq0();nq0();k6();kX8();iH=C(BK(),1),CX8=C(jz(),1),co6=lo6(()=>e1.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),_X8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);to6=process.env.STREAM_ENCODE_TRACE==="1",oo6=process.env.DECOPILOT_STREAM_TRACE==="1";ro6=to6?new vX8:null});function eC0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,NF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var xX8=D(()=>{p8()});class dD1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function $r6($,Z,Q={}){let Y=$.startsWith("thread:")?AH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function iD1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await _U($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await gm($,{threadId:X,runBranch:G?.branch}),K=await S00($,Q,e81(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=$r6(W,await LT0($,X),{flat:Ff(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await O3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var fX8=D(()=>{Z7();xW();C7()});async function yX8($,Z,Q){let Y=Z.organizationId;if(!hX(Z))return!1;if(!_f(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=LU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await $5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),L8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var gX8=D(()=>{x4();cY();zd();IH();z9()});function Wr6($){return $ instanceof kX}function hX8($,Z){return Z-$>=Jr6}class pD1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??Zr6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??Yr6,Q=this.options.itemIntervalMs??Qr6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-z71),lQ1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-Gr6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await gQ1(this.taskBoard,X,Y),await hQ1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==R$.progress||hX(W)||W.assigneeId!==T8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await iD1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!hX8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:R$.progress,to:R$.review,reason:H}}).catch(()=>{}),L8(J,F),await VH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==R$.progress||G.assigneeId!==T8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await kH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),Wr6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+Xr6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==R$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),L8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!hX8(QD(Q,Z.reviewCycleStartedAt),Date.now()))return;await VH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!hX(Y))return!1;let X=Y.assigneeId===T8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await iD1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Td(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await yX8(G,Y,W))return!0;if(await $g$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!bQ1(W))return!1;return await Pd(G,Y,{previewMatchesHead:xQ1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await FE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var Zr6=60000,Qr6=300000,Yr6=50,Xr6=60000,Jr6=900000,Gr6=120000;var uX8=D(()=>{x4();Wq0();fX8();mU();J80();IH();gX8();z9();MW();cQ1();C7();C$0();Ad()});import{readdir as Kr6,rm as $_0}from"fs/promises";import{join as Z_0}from"path";async function Q_0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-Hr6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await ry($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await lX8($,X,Z);else if(!X.startsWith(".")){let J=Z_0($,X),G=await ry(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await lX8(J,K,Z)}if((await ry(J)).length===0)await $_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function lX8($,Z,Q){let Y=0,X=Z_0($,Z),J=await ry(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Z_0(X,W),H=await ry(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=Z_0(K,U);await $_0(B,{recursive:!0,force:!0}),Y++}}if((await ry(K)).length===0)await $_0(K,{recursive:!0,force:!0})}if((await ry(X)).length===0)await $_0(X,{recursive:!0,force:!0});return Y}async function ry($){try{return(await Kr6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var Hr6=30;var nD1=()=>{};import{DBOS as tD1,SchedulerMode as Fr6}from"@dbos-inc/dbos-sdk";async function Nr6(){let $=[JK(),Jg(),qN()],Z=0;for(let Q of $)try{Z+=await Q_0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function Br6($,Z){await tD1.runStep(()=>Nr6(),{name:"monitoringRetention"})}function mX8(){if(cX8)return;cX8=!0;let $=tD1.registerWorkflow(Br6,{name:"monitoringRetentionWorkflow"});tD1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Ur6,mode:Fr6.ExactlyOncePerIntervalWhenActive})}var Ur6="23 4 * * *",cX8=!1;var dX8=D(()=>{_3();nD1()});function iX8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await cQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await KA($.db,Z,Y.role);return X.boundAuth=OU1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new nP(Q,void 0,X.boundAuth,Y.role,"self"),HE(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var pX8=D(()=>{bK();BU()});function Dr6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Or6(){return{services:Dr6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function wr6(){for(let $ of Lr6)$()}function nX8($){let Z=[...oD1.logs,$];oD1={...oD1,logs:Z.length>500?Z.slice(-500):Z},wr6()}function rD1(){return jr6}var oD1,Lr6,jr6=!1;var sD1=D(()=>{oD1=Or6(),Lr6=new Set});import{EventEmitter as Er6}from"events";var aD1;var tX8=D(()=>{sD1();aD1=new Er6;aD1.on("request",($)=>{nX8($)})});function oX8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Cp(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>Cp(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${Cp(N.method)}${W9.reset}`}}catch{}}let W=Cp(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${Cp(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=Pr6(Y),H=G?"\u25C0":"\u2190";if(!rD1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=zr6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!rD1())console.log(`${W9.dim}${O}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);aD1.emit("request",{method:Y,path:Cp(X),status:U,duration:F,timestamp:new Date})}}}var W9,zr6=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},Pr6=($)=>{return W9[$]||W9.reset},Cp=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var rX8=D(()=>{sD1();tX8();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as $J8}from"crypto";import{mkdir as Ar6,readdir as Tr6,rm as sX8,stat as ZJ8}from"fs/promises";import{join as $O1,relative as Rr6}from"path";import{z as Z8}from"zod";function YJ8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return $O1(qr6,Z)}function XJ8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function eD1($,Z){let Q=YJ8($),Y=XJ8(Z);return $O1(Q,Y)}function Mr6($,Z,Q,Y){let X=E0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return $J8("sha256",X).update(J).digest("hex")}function eX8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=Mr6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${XJ8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function JJ8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${$J8("md5","etag").update(Y).digest("hex")}"`}async function GJ8($,Z,Q,Y,X){try{let J=await Tr6($,{withFileTypes:!0});for(let G of J){let W=$O1($,G.name),H=Rr6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await GJ8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await ZJ8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:JJ8(W,F.mtime,F.size)})}catch{}}}}catch{}}function WJ8($,Z){let Y=G0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Z8.object({prefix:Z8.string().optional(),maxKeys:Z8.number().optional().default(1000),continuationToken:Z8.string().optional(),delimiter:Z8.string().optional()}),outputSchema:Z8.object({objects:Z8.array(Z8.object({key:Z8.string(),size:Z8.number(),lastModified:Z8.string(),etag:Z8.string()})),nextContinuationToken:Z8.string().optional(),isTruncated:Z8.boolean(),commonPrefixes:Z8.array(Z8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=YJ8(Y);await Ar6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await GJ8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Z8.object({key:Z8.string()}),outputSchema:Z8.object({contentType:Z8.string().optional(),contentLength:Z8.number(),lastModified:Z8.string(),etag:Z8.string(),metadata:Z8.record(Z8.string(),Z8.string()).optional()}),handler:async(X)=>{let J=X,G=eD1(Y,J.key),W=await ZJ8(G);return{contentType:DN1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:JJ8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Z8.object({key:Z8.string(),expiresIn:Z8.number().optional()}),outputSchema:Z8.object({url:Z8.string(),expiresIn:Z8.number()}),handler:async(X)=>{let J=X,G=pD(J.expiresIn,aX8);return{url:eX8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Z8.object({key:Z8.string(),expiresIn:Z8.number().optional(),contentType:Z8.string().optional()}),outputSchema:Z8.object({url:Z8.string(),expiresIn:Z8.number()}),handler:async(X)=>{let J=X,G=pD(J.expiresIn,aX8);return{url:eX8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Z8.object({key:Z8.string()}),outputSchema:Z8.object({success:Z8.boolean(),key:Z8.string()}),handler:async(X)=>{let J=X,G=eD1(Y,J.key);try{return await sX8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Z8.object({keys:Z8.array(Z8.string()).max(1000)}),outputSchema:Z8.object({deleted:Z8.array(Z8.string()),errors:Z8.array(Z8.object({key:Z8.string(),message:Z8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=eD1(Y,K);try{await sX8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function ZO1($,Z,Q){let Y=WJ8(Z,Q),X=new Zw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:vZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Z8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Z8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new z3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),mW(X,J,$,"mcp:dev-assets")}async function KJ8($,Z,Q,Y){let J=WJ8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var qr6="./data/assets",aX8=3600,QJ8,HJ8;var FJ8=D(()=>{X$();cd();J8();AJ0();ld();UJ();nD();lS0();QJ8=new Z1;QJ8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return ZO1($.req.raw,Z,Y)});HJ8=QJ8});var UJ8={};$6(UJ8,{mountDevRoutes:()=>Ir6});function Ir6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return ZO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await KJ8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",HJ8);let Q=new Z1;Q.use("*",mH({mountPath:"/api/dev-assets"})),Q.route("/",uS0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var NJ8=D(()=>{J8();WN1();lS0();FJ8()});var AJ8={};$6(AJ8,{watchHandler:()=>PJ8,resolveCorsOrigin:()=>EJ8,isSsoExemptPath:()=>wJ8,isAllowedOAuthRedirectUri:()=>zJ8,createApp:()=>yr6});import{readFileSync as Vr6}from"fs";import{PrometheusSerializer as kr6}from"@opentelemetry/exporter-prometheus";import{DBOS as NO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as _r6,oAuthProtectedResourceMetadata as vr6}from"better-auth/plugins";async function Sr6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,DJ8(BJ8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),DJ8(BJ8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function DJ8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function wJ8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${MS0}/`)||$.startsWith(`${zS0}/`)}function jJ8($){return $==="local.studio.decocms.com"}function EJ8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(jJ8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function zJ8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||jJ8($.hostname)}async function yr6($={}){let Z=$.database??D8(),Q=!1;J9.stop().catch((H0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H0)});let Y,X,J,G,W=new gD1,K,H,F,U=null;if($.disableNats)K=hD1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new D80,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(H0)=>{return(async()=>{let F0=H0.getReader();try{while(!0){let{done:q0}=await F0.read();if(q0)break}}catch{}finally{F0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=TX8();let H0=E0().natsCredsPath,F0;if(H0)try{F0=Vr6(H0,"utf8")}catch(w8){console.error(`[app] failed to read NATS_CREDS at ${H0}; connecting anonymously`,w8)}U.init(E0().natsUrls,F0?{creds:F0}:void 0);let q0=m11()?new M11({getJetStream:()=>U.getJetStream()}):null;q0?.init().catch(()=>{}),Y=q0;let T0=new f91({getJetStream:()=>U.getJetStream()});T0.init().catch(()=>{}),X=T0;let B1=new bf(VQ1,{getJetStream:()=>U.getJetStream()}),x$=new bf(_$0,{getJetStream:()=>U.getJetStream()});B1.init().catch(()=>{}),x$.init().catch(()=>{}),J={reads:B1,cards:x$};let i$=new LJ1({getJetStream:()=>U.getJetStream()});i$.init().catch(()=>{}),G=i$,K=hD1({getConnection:()=>U.getConnection()}),H=new uD1({getConnection:()=>U.getConnection()}),F=new mD1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),e88(U),U.onReady(()=>{q0?.init().catch((w8)=>{console.error("[McpListCache] Deferred init failed:",w8)}),T0.init().catch((w8)=>{console.error("[SkillCatalogCache] Deferred init failed:",w8)}),B1.init().catch((w8)=>{console.error("[PrReadCache] Deferred init failed:",w8)}),x$.init().catch((w8)=>{console.error("[PrCardCache] Deferred init failed:",w8)}),i$.init().catch((w8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",w8)}),K.start(),HN$(()=>U.getConnection()),F.init().catch((w8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",w8)})})}if($z)await $z();I11(Y),g91(X),kQ1(J),wJ1(G);let B={storage:new ih(Z.db),sseHub:J9,onThreadFinished:async(H0,F0)=>qd(new D3(Z.db),H0,F0,new kG(Z.db))},O=new lY1(B),L=new f40(Z.db),w=new dD1(L);w.start(),ay$(H),H.start((H0)=>{bq0(H0),O.execute({type:"CANCEL",taskId:H0}).catch((F0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",F0)})}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast start failed:",H0)}),U?.onReady(()=>{H.start().catch((H0)=>{console.error("[CancelBroadcast] Deferred start failed:",H0)})});let j=()=>U?.getConnection()??null;QN1(j),U?.onReady(()=>QN1(j)),oJ1(j),U?.onReady(()=>oJ1(j)),F.init().catch((H0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H0)}),$z=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),D68(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),FN$(),G.teardown(),I11(null),g91(null),kQ1(null),wJ1(null)};let E=new Z1;if(E.use("*",BJ1({enabled:(H0)=>oi(H0,"debug")==="1"})),E.use("*",R_0),E.use("/*",t88({origin:(H0,F0)=>EJ8(H0,{baseUrl:E0().baseUrl,requestOrigin:new URL(F0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(H0,F0)=>{if(await F0(),H0.req.path.includes("/files/"))return;if(H0.req.path.includes("/fs/")&&H0.req.path.endsWith("/read"))return;H0.header("X-Frame-Options","DENY"),H0.header("Content-Security-Policy","frame-ancestors 'none'")}),!E0().noTui)E.use("*",oX8());E.use("*",async(H0,F0)=>{if(await F0(),lp(H0.req.path))return;if(H0.res.status>=500){let T0=await H0.res.clone().text();console.error(`[5xx Response] ${H0.req.method} ${H0.req.path} - ${H0.res.status}:`,T0)}}),E.get(aY.HEALTH,(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);return H0.json({status:"ok"})}),E.get(aY.HEALTH_LIVE,(H0)=>{return H0.json({status:"ok"})}),E.get(aY.HEALTH_READY,async(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);let F0={};if(F0.postgres={status:await Sr6(Z.pool)?"up":"down"},U)F0.nats=U.isConnected()?{status:"up"}:{status:"down"};else F0.nats={status:"down"};let q0=F0.postgres.status==="up",T0=q0?200:503;return H0.json({status:q0?"ready":"not_ready",services:F0},T0)}),E.get(aY.METRICS,async(H0)=>{try{let F0=await V_0.collect(),q0=Cr6.serialize(F0.resourceMetrics);return H0.text(q0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(F0){return console.error("Failed to collect metrics:",F0),H0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${aY.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H0)=>{let F0=H0.req.param("queueName");if(!br6.has(F0))return H0.json({error:`Unknown queue: ${F0}`},404);let[q0,T0]=await Promise.all([NO.listQueuedWorkflows({queueName:F0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),NO.listQueuedWorkflows({queueName:F0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return H0.json({queue_length:q0.length,in_flight:T0.length})}),E.route("/api/config",_Y8),E.route("/api/_reports",dY8),E.route("/api/_stripe",VD1),E.route("/api/_github",nY8({taskBoard:()=>p,contextFactory:()=>g})),E.route("/api/_git",Yp);let T={db:Z.db,encryptionKey:E0().encryptionKey};E.route("/api/_jira",QX8(T)),E.route("/api/_jira",sY8(T)),E.route("/report",lY8($.clientDir)),E.route("/api/auth/custom",E48),E.route("/api/auth/desktop",T48),E.all("/api/auth/admin/*",Z68),E.all("/api/auth/*",async(H0)=>{return await x8.handler(H0.req.raw)});let P=M$8();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",o40),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",o40),E.route("/",P),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",_40),E.route("/",C$8()),E.use("/oauth-proxy/:connectionId/*",o40),E.all("/oauth-proxy/:connectionId/*",OJ8);let A=async(H0)=>{let q0=await xr6()(H0.req.raw),T0=await q0.json();return Response.json(T0,q0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",o40),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(H0)=>{let q0=await fr6()(H0.req.raw),T0=await q0.json();return Response.json(T0,q0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=r88({ttlMs:120000}),_=await P88({db:Z.db,auth:x8,encryption:{key:E0().encryptionKey},observability:{tracer:PO,meter:e1},modelListCache:W,providerKeyCache:K,memberRoleCache:x});cQ.set(_),ai1({db:Z.db,baseUrl:l5()}),A88({db:Z.db}),M88({db:Z.db}),b88({db:Z.db}),eY8({db:Z.db,encryptionKey:E0().encryptionKey}),kv$({db:Z.db}),u88({db:Z.db}),av$({db:Z.db});let V=UX0(Z.db),y=new Pr(Z.db),g=iX8({db:Z.db});HJ1({storage:V,studioContextFactory:g}),sY1({systemDatabaseUrl:tr0(E0().databaseUrl,E0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:J9}}),dY1({dispatchRunFn:cf$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:J9}});let l=new ih(Z.db),p=new D3(Z.db),i=new kG(Z.db),K0=new pD1(p,g,i);if(E0().taskBoardReviewSweeperEnabled){K0.start();let H0=$z;$z=async()=>{await H0?.(),K0.dispose()}}Hy$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let H0=U?.getConnection();return H0?await LJ8.jetstreamManager(H0):null},messageParts:l.messageParts(),resolveRun:async(H0)=>{let F0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H0).executeTakeFirst();return F0?{orgId:F0.organization_id,createdBy:F0.created_by,version:F0.message_storage_version??1,status:F0.status,runFenceToken:F0.run_fence_token,title:F0.title??null}:null},completeRunIfNotCompleted:async(H0,F0)=>{let q0=await l.completeRunIfNotCompleted(H0,F0);if(eC0(J9,F0,H0,q0),q0)await qd(p,H0,F0,i);return q0},markRunRequiresAction:async(H0,F0)=>{let q0=await l.requiresActionIfInProgress(H0,F0);return eC0(J9,F0,H0,q0),q0},markRunFailed:async(H0,F0,q0,T0)=>{let B1=await l.markRunFailed(H0,F0,q0,T0);if(eC0(J9,F0,H0,B1),B1)await qd(p,H0,F0,i);return B1},clearSynthesizedError:async(H0,F0)=>{await l.messageParts().replaceMessageParts(H0,BE(H0,F0),[])},persistTitle:(H0,F0,q0)=>l.update(H0,F0,{title:q0}),onTitleUpdated:async({runId:H0,orgId:F0,title:q0})=>{let T0=await l.get(H0,F0).catch(()=>null);J9.emit(F0,NF(H0,T0?.status??"in_progress",{title:q0,virtualMcpId:T0?.virtual_mcp_id??void 0,createdBy:T0?.created_by,triggerId:T0?.trigger_id,branch:T0?.branch??null,harnessId:T0?.harness_id??void 0,createdAt:T0?.created_at,updatedAt:T0?.updated_at}))},bumpProgress:async({runId:H0,orgId:F0})=>{await l.bumpProgress(H0,F0)},recordCompleted:async({runId:H0,orgId:F0,distinctId:q0,usage:T0})=>{f1.capture({distinctId:q0,event:"chat_message_completed",groups:{organization:F0},properties:{organization_id:F0,thread_id:H0,transport:"projector",input_tokens:T0.inputTokens,output_tokens:T0.outputTokens,total_tokens:T0.totalTokens}})},recordFailed:async({runId:H0,orgId:F0,distinctId:q0,reason:T0,kind:B1})=>{f1.capture({distinctId:q0,event:"chat_message_failed",groups:{organization:F0},properties:{organization_id:F0,thread_id:H0,transport:"projector",error_category:B1,error_message:T0}})},purgeRun:async(H0)=>{F.purge(H0)}}),Df$({studioContextFactory:g,systemDatabaseUrl:tr0(E0().databaseUrl,E0().databasePgSsl),streamBuffer:F}),mX8(),ei1(),R88(),V88(),f88(),ZX8(),bv$(),c88(),ev$(),oY8();let B0=async(H0,F0,q0)=>{let T0=await V.findById(H0,F0);if(!T0)throw Error("Automation not found");return NJ1({automationId:T0.id,organizationId:T0.organization_id,triggerId:null})},X0=new Zp(V,({automation:H0,trigger:F0,contextMessages:q0,idempotencyKey:T0})=>B80({automationId:H0.id,organizationId:H0.organization_id,triggerId:F0.id,contextMessages:q0},{idempotencyKey:T0})),L0=[JK(),Jg(),qN()];for(let H0 of L0)Q_0(H0).then(()=>{}).catch((F0)=>console.error("[monitoring] Retention cleanup failed:",F0));let J0=()=>x8.api.deleteAllExpiredApiKeys().catch((H0)=>console.error("[auth] Expired API key cleanup failed:",H0));J0(),setInterval(J0,86400000).unref(),E.use("*",async(H0,F0)=>{if(A_0(H0.req.path))return F0();let q0={measure:async(B1,x$)=>{cW(H0,B1);try{return await x$()}finally{P3(H0,B1)}}},T0=await cQ.create(H0.req.raw,{timings:q0});T0.automationRunner=B0,H0.set("studioContext",T0);try{await F0()}finally{let B1=T0.pendingRevalidations;if(B1.length>0)Promise.race([Promise.allSettled(B1),z$(30000)]).catch((i$)=>console.error("[studio] revalidation cleanup error:",i$))}}),E.use("/api/:org/decopilot/*",si),E.use("/api/:org/v1/*",si),E.use("/api/:org/files/*",si),E.use("*",async(H0,F0)=>{if(wJ8(H0.req.path))return F0();let q0=H0.get("studioContext");if(!q0?.organization?.id||!q0?.auth?.user?.id)return F0();if(!(await q0.storage.orgSsoConfig.getByOrgId(q0.organization.id))?.enforced)return F0();if(!await q0.storage.orgSsoSessions.isValid(q0.auth.user.id,q0.organization.id))return H0.json({error:"SSO authentication required for this organization"},403);return F0()});let $0=new Z1;$0.use("*",mH({mountPath:"/api/org-sso"})),$0.route("/",kS0()),E.route("/api/org-sso",$0),E.get("/api/tools/management",(H0)=>{return H0.json({tools:kn0,grouped:pP()})}),E.use("/mcp/*",async(H0,F0)=>{cW(H0,"mcp");try{return await F0()}finally{P3(H0,"mcp")}});let Z0=async(H0,F0)=>{let q0=H0.var.studioContext;if(!q0.auth.user?.id&&!q0.auth.apiKey?.id){let T0=new URL(H0.req.url),B1=H0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),x$=B1?`${B1}://${T0.host}`:T0.origin;return H0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${x$}${T0.pathname}/.well-known/oauth-protected-resource"`}})}return await F0()};if(E.use("/mcp/:connectionId?",Z0),E.use("/mcp/gateway/:virtualMcpId?",Z0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Z0),E.use("/mcp/self",Z0),PW()){let{mountDevRoutes:H0}=(NJ8(),F_0(UJ8));H0(E,Z0)}let s=new Z1;s.use("*",mH({mountPath:"/mcp"})),s.route("/",IM0()),E.route("/mcp",s);let Q0=new Z1;Q0.use("*",mH({mountPath:"/mcp/self"})),Q0.route("/",jC0()),E.route("/mcp/self",Q0);let u0=new Z1;u0.use("*",mH({mountPath:"/mcp"})),u0.route("/",SM0()),E.route("/mcp",u0),E.use("/api/:org/models/*",async(H0,F0)=>{cW(H0,"llm_models");try{return await F0()}finally{P3(H0,"llm_models")}});let _0=L68({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",_0),E.route("/api",GX8);let D1=new Z1;D1.use("*",mH({mountPath:"/api"})),D1.route("/",AC0()),E.route("/api",D1),E.route("/api",qY8);let i0=new Z1;i0.use("*",mH({mountPath:"/api"})),i0.route("/",TC0({tokenStorage:y,automationEventDispatcher:X0})),E.route("/api",i0);let j0=new Tr(Z.db),z0=new Z1;z0.use("*",mH({mountPath:"/api"})),z0.route("/",bS0()),E.route("/api",z0),E.route("/api/deco-sites",C68()),E.route("/api/deco-apps",EY8());let n0=new Z1;n0.use("*",mH({mountPath:"/api/deco-sites"})),n0.route("/",fS0()),E.route("/api/deco-sites",n0),E.route(MS0,Q68()),E.route(H78,N78()),E.route("/api/_editor-resolve",IY8()),E.route(q48,M48()),E.route(zS0,f48());let O1=E0(),G1=O1.elevenlabsApiKey?new iC0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,v0={openai:O1.openaiLiveApiKey?new zD1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:G1?new ED1(G1,()=>U?.getConnection()??null):null},c0=new qD1({adapter:G1,conversationAdapters:v0,defaults:O1,secret:O1.studioJwtSecret??O1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),m0=sQ8({voiceSessions:c0,kvStorage:j0,runRegistry:O,streamBuffer:F,sseHub:J9,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:X0,mountDevAssets:PW(),mcpAuth:Z0,oauthProxyHandler:OJ8,watchHandler:PJ8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",m0),E.notFound((H0)=>{return H0.json({error:"Not Found",path:H0.req.path},404)}),E.onError(j68),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([J9.stop(),$z?Promise.resolve($z()).finally(()=>{$z=null}):Promise.resolve()]),U)await U.drain().catch((H0)=>console.error("[shutdown] NATS drain error:",H0));console.log("[shutdown] Flushing telemetry..."),await tX().catch((H0)=>console.error("[shutdown] Telemetry flush error:",H0)),console.log("[shutdown] Closing database..."),await t9$(Z).catch((H0)=>console.error("[shutdown] Database close error:",H0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await NO.registerQueue(C3,{partitionQueue:!0,concurrency:GJ1,minPollingIntervalMs:WJ1}),await NO.registerQueue(S3,{partitionQueue:!0,concurrency:oY1,priorityEnabled:!0}),await NO.registerQueue(TN,{workerConcurrency:E0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await NO.registerQueue(RN,{workerConcurrency:E0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await NO.registerQueue(EO,{partitionQueue:!0,concurrency:Bf$}),await NO.registerQueue(Jz,sv$),await KN1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((H0)=>NO.deleteQueue(H0))),await KJ1(Z.pool),OY$().catch((H0)=>{console.error("[studio-pack-backfill] failed:",H0)}),$p1().catch((H0)=>{console.error("[org-fs] public-sets boot sync kick failed:",H0)})}})}var LJ8,BJ8=5000,$z=null,OJ8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await cQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await ii(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await v40(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=S$8(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=E0().baseUrl??j.origin;try{if(!zJ8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(d88(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let P,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let i=atob(T.slice(6).trim()),K0=i.indexOf(":");if(K0!==-1){let B0=decodeURIComponent(i.slice(0,K0)),X0=decodeURIComponent(i.slice(K0+1));A=B0||null,q=X0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)A=g;if(typeof l==="string"&&l)q=l;let p=new URLSearchParams;for(let[i,K0]of y.entries())p.append(i,K0.toString());P=p.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{P=g}let p=typeof l==="object"&&l!==null&&!Array.isArray(l);if(P===void 0&&!p)P=g;if(P===void 0){let i=l,K0=i.metadata&&typeof i.metadata==="object"?i.metadata:{};i.metadata={...K0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},P=JSON.stringify(i),E["Content-Type"]="application/json"}}else P=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:P,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,p=null;try{p=await pi(G.connection_url)??O}catch{p=O}let i={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:A,clientSecret:q,tokenEndpoint:p};await new L9(X.db,X.vault).upsert(i)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},PJ8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!lU(Y)||!await cU(Z)))return $.json({error:"forbidden"},403);let W=G?iR0:Y;if(G)SD({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return KO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!J9.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{J9.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),J9.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),J9.remove(W,K),N()})})})},Cr6,br6,xr6=()=>vr6(x8),fr6=()=>_r6(x8);var TJ8=D(()=>{Y8();X$();Zp1();q88();k88();y88();E80();UQ1();m88();C$0();M9();hc();p8();J8();OS0();o88();DJ1();Z3();BU();CU1();SG();k6();G6();gU1();R48();I48();y48();dU1();Y68();aU1();JN1();GN1();HH();ek0();WN1();E68();wS0();aQ8();YY8();XY8();KY8();jY8();UN1();zY8();VM0();O80();MY8();CM0();uB1();VY8();gB1();vY8();cY8();iY8();pY8();tY8();rY8();aY8();YX8();fD1();LN1();WX8();hB1();xB1();e60();RX8();kJ();kT0();CQ1();me();ie();EJ1();qX8();IX8();YN1();bX8();cY1();xX8();Yo();qr();kD();z9();aF1();uX8();dX8();oG0();nD1();_3();HN1();VD();hY1();oG0();dq0();wn0();jn0();pX8();iu();rX8();Ep();CU1();wd();vd();xq0();LJ8=C(BK(),1);Cr6=new kr6,br6=new Set([C3,S3,TN,RN,EO,Jz])});var IJ8={};$6(IJ8,{resolveClientDir:()=>dr6,resolveAssetPathWithTraversalCheck:()=>MJ8,isPathWithinDirectory:()=>qJ8,createAssetHandler:()=>ir6});import{resolve as g60,dirname as gr6,join as hr6,extname as ur6,basename as lr6,sep as RJ8}from"path";function cr6($,Z){if($===Z||lr6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${RJ8}assets${RJ8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function qJ8($,Z){let Q=g60(Z),Y=g60($);return Y===Q||Y.startsWith(Q+"/")}function MJ8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=g60(Z,Q);if(!qJ8(Y,Z))return null;return Y}function dr6($,Z="../client"){let Q=new URL($),Y=gr6(Q.pathname);return g60(Y,Z)}function ir6($={}){let{env:Z="production",clientDir:Q=mr6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=MJ8({requestPath:W,clientDir:Q});if(!K)return null;let H=hr6(K,"index.html"),F=g60(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(ur6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:cr6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var mr6="./dist/client";var VJ8=()=>{};var kJ8={};$6(kJ8,{tryUpgradePreviewWs:()=>ar6,tryHandlePreviewHttp:()=>sr6,previewWebSocketHandler:()=>er6,parsePreviewBaseDomain:()=>rr6,isPreviewWsData:()=>Y_0,extractHandleFromHost:()=>QO1});function tr6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function or6(){return new Response(nr6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function rr6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function QO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function sr6($,Z){let Q=QO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return u60(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Sm)&&tr6($))return or6();return X.headers.delete(Sm),X}function u60($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Y_0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function ar6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=QO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return u60(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return u60(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return u60(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return u60(426,"upgrade failed");return}function h60($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var pr6=256,nr6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',er6;var SJ8=D(()=>{D10();er6={open($){let Z=$.data;if(!Y_0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),h60($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{h60($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{h60($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!Y_0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=pr6){h60($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!Y_0(Z))return;h60($,Z,1000,"")}}});var bJ8={};$6(bJ8,{printBanner:()=>Zs6,bannerLines:()=>vJ8,BANNER_LINES:()=>CJ8,BANNER_GRADIENT:()=>_J8});function $s6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function vJ8($){let Z=CJ8.map((Q,Y)=>{let[X,J,G]=$s6(_J8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function Zs6($){console.log("");for(let Z of vJ8($))console.log(Z);console.log("")}var CJ8,_J8;var xJ8=D(()=>{CJ8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],_J8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});Y8();var OO1="13";function LO1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:OO1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}Y8();import eJ8 from"pg";var wO1=8314027461559302n,$G8=600000,ZG8=500;async function jO1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=$G8}=$,X=$.log??((K)=>console.log(K)),J=new eJ8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[wO1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await z$(ZG8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[wO1.toString()])}catch{}await J.end().catch(()=>{})}}X$();D_0();k6();function eG8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function C_0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function ZL1(){let $=eG8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:C_0($,"--cpu-prof-dir")??process.cwd(),name:C_0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(C_0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}b_0();var Q50;function FL1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Kz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),Q50=setInterval(()=>void Z().catch(()=>{}),$),Q50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(Q50)clearInterval(Q50)}}import*as Q38 from"bun:jsc";var{startSamplingProfiler:Y38,samplingProfilerStackTraces:X38}=Q38;function UL1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Y38()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=X38()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function NL1(){ZL1();let $=[FL1(),HL1(),UL1()];return()=>{for(let Z of $)Z()}}import{existsSync as Hs6}from"fs";var WG=E0();aO1();var{DBOS:l60,DBOSClient:Qs6}=await import("@dbos-inc/dbos-sdk");function KO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var Ys6=[C3,S3,TN,RN,EO,Jz],Xs6=WG.dispatchRole==="worker"?Ys6:WG.dispatchRole==="api"?[]:void 0;l60.setConfig(LO1({systemDatabaseUrl:KO1(WG.databaseUrl,WG.databasePgSsl),poolSize:WG.dbosPoolSize,executorID:WG.podName,listenQueues:Xs6}));var{createApp:Js6}=await Promise.resolve().then(() => (TJ8(),AJ8)),{isServerPath:Gs6}=await Promise.resolve().then(() => (e60(),xO1)),{createAssetHandler:Ws6,resolveClientDir:uJ8}=await Promise.resolve().then(() => (VJ8(),IJ8)),Ks6=WG.port,fJ8=uJ8(import.meta.url,"../client"),lJ8=Hs6(fJ8)?fJ8:uJ8(import.meta.url,"../dist/client"),Fs6=Ws6({clientDir:lJ8,isServerPath:Gs6}),Us6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function Ns6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(Us6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:Bs6,tryHandlePreviewHttp:Ds6,tryUpgradePreviewWs:Os6,previewWebSocketHandler:YO1,isPreviewWsData:XO1}=await Promise.resolve().then(() => (SJ8(),kJ8)),{getOrInitSharedRunner:cJ8}=await Promise.resolve().then(() => (vW(),nT$)),mJ8=Bs6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),yJ8={baseDomain:mJ8??"",getRunner:cJ8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())cJ8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var X_0=await Js6({clientDir:lJ8}),JO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),gJ8=process.env.DBOS_CONDUCTOR_URL?.trim();await jO1({databaseUrl:KO1(WG.databaseUrl,WG.databasePgSsl)},()=>l60.launch({...JO1?{conductorKey:JO1}:{},...JO1&&gJ8?{conductorURL:gJ8}:{}}));console.log(`[dbos] application version: ${l60.applicationVersion}`);var GO1=5,WO1=0;await q8(async()=>{WO1++;try{return await X_0.initDbos()}catch($){let Z=WO1>=GO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${WO1}/${GO1} failed, ${Z}`,$),$}},{maxAttempts:GO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!WG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (xJ8(),bJ8));console.log("");for(let Z of $())console.log(Z)}var Ls6=Bun.serve({idleTimeout:0,port:Ks6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(mJ8){let Y=await Os6($,Z,yJ8);if(Y===void 0)return;if(Y)return Y;let X=await Ds6($,yJ8);if(X)return X}let Q=await Fs6($);if(Q)return Ns6(Q);return X_0.fetch($,{server:Z})},websocket:{open($){if(XO1($.data))YO1.open($)},message($,Z){if(XO1($.data))YO1.message($,Z)},close($){if(XO1($.data))YO1.close($)}},development:!1}),ws6=NL1();if(WG.localMode)Promise.resolve().then(() => (yf(),Aq0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (yf(),Aq0));Z()}catch{}});var hJ8=!1;async function js6($){let Z;try{Z=await Qs6.create({systemDatabaseUrl:KO1(WG.databaseUrl,WG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:S3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:S3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function J_0($){if(hJ8)return;hJ8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{ws6(),X_0.markShuttingDown();let J=zO1(WG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await z$(J),await Ls6.stop(!0);let G=l60.executorID;await l60.shutdown(),await js6(G),await X_0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>J_0("SIGTERM"));process.on("SIGINT",()=>J_0("SIGINT"));process.on("SIGHUP",()=>J_0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),J_0("uncaughtException")});