decocms 4.429.14 → 4.429.16

package/dist/server/cli.js

@@ -2178,7 +2178,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var AZ$=L(()=>{cu()});f
       `.execute($);if(Number(K.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${G}/${W}, keeping in old table`);continue}}await Dc`
       DELETE FROM kysely_migration WHERE name = ${Q}
     `.execute($)}}async function UG$($){await BO4($),await LO4($);let Z=new HG$({db:$,provider:{getMigrations:()=>Promise.resolve(n81)}}),{error:Q,results:Y}=await Z.migrateToLatest(),X=0;if(Y?.forEach((J)=>{if(J.status==="Success")X++;else if(J.status==="Error")console.error(`Failed to execute migration "${J.migrationName}"`)}),Q)throw console.error("Failed to migrate"),console.error(Q),Q;return X}async function DO4($){let{keepOpen:Z=!1,database:Q,skipBetterAuth:Y=!1}=$??{},X="skipped";if(!Y&&!Q)X=await os0();let J=Q??Z8(),G=async()=>{if(!Z&&!Q)await yj(J).catch((W)=>{console.warn("Warning: Error closing database:",W)})};try{let W=await UG$(J.db);return await G(),{betterAuth:X,kysely:W}}catch(W){throw await G(),W}}async function OO4(){let $=Z8(),Z=new HG$({db:$.db,provider:{getMigrations:()=>Promise.resolve(n81)}}),{error:Q,results:Y}=await Z.migrateDown();if(Y?.forEach((X)=>{if(X.status==="Success")console.log(`\u2705 Migration "${X.migrationName}" rolled back successfully`);else if(X.status==="Error")console.error(`\u274C Failed to rollback migration "${X.migrationName}"`)}),Q)throw console.error("Failed to rollback migration"),console.error(Q),Q}var BG$=L(()=>{KG$();as0();bQ()});async function NK0($){let Z={...process.env},Q=$Y0($,Z);console.log(q_1(Q.settings.encryptionKey));let Y=Q.settings.betterAuthSecret||(Q.settings.localMode?QQ$(Q.settings.dataDir):""),{ensureServices:X}=await Promise.resolve().then(() => (NW0(),UW0)),{outputs:J,services:G}=await X({home:Q.settings.dataDir,externalDatabaseUrl:Q.externalDatabaseUrl,externalNatsUrl:Q.externalNatsUrl});if(!Q.skipMigrations){let{migrateBetterAuth:K}=await Promise.resolve().then(() => (as0(),XQ$));await K(J.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (bQ(),z7$)),{migrateToLatest:F}=await Promise.resolve().then(() => (BG$(),NG$)),U=H(J.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let W={...Q.settings,betterAuthSecret:Y,databaseUrl:J.databaseUrl,natsUrls:J.natsUrls,...J.s3?{s3Endpoint:J.s3.endpoint,s3Bucket:J.s3.bucket,s3AccessKeyId:J.s3.accessKeyId,s3SecretAccessKey:J.s3.secretAccessKey,s3ForcePathStyle:J.s3.forcePathStyle}:{}};return RZ$(W),{settings:W,services:G.map((K)=>({name:K.name==="PostgreSQL"?"Postgres":K.name,port:K.port})),managedServiceNames:G.filter((K)=>K.owner==="managed").map((K)=>K.name)}}var t81=L(()=>{cu();YQ$();Y$()});var jG$={};J0(jG$,{updateService:()=>GT,subscribeCliState:()=>r81,setTuiConsoleIntercepted:()=>BK0,setServerUrl:()=>Vs,setMigrationsDone:()=>Is,setDevMode:()=>wO4,resetCliStateForTests:()=>jO4,isTuiConsoleIntercepted:()=>LK0,getCliState:()=>a81,addLogEntry:()=>mj});function LG$(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function DG$(){return{services:LG$(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function jO4(){CJ=DG$()}function Ms(){for(let $ of o81)$()}function a81(){return CJ}function r81($){return o81.add($),()=>o81.delete($)}function GT($){CJ={...CJ,services:CJ.services.map((Z)=>Z.name===$.name?$:Z)},Ms()}function Is(){CJ={...CJ,migrationsStatus:"done"},Ms()}function Vs($){CJ={...CJ,serverUrl:$},Ms()}function mj($){let Z=[...CJ.logs,$];CJ={...CJ,logs:Z.length>500?Z.slice(-500):Z},Ms()}function wO4(){CJ={...CJ,services:[...LG$(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},Ms()}function BK0($){OG$=$}function LK0(){return OG$}var CJ,o81,OG$=!1;var WT=L(()=>{CJ=DG$();o81=new Set});import{createServer as wG$}from"net";function EO4($){return new Promise((Z)=>{let Q=wG$();Q.once("error",()=>Z(!1)),Q.listen($,"0.0.0.0",()=>{Q.close(()=>Z(!0))})})}async function ks($){if(await EO4($))return $;let Z=await new Promise((Q,Y)=>{let X=wG$();X.once("error",Y),X.listen(0,"0.0.0.0",()=>{let J=X.address(),G=typeof J==="object"&&J?J.port:0;X.close(()=>Q(G))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var s81=()=>{};var $41={};J0($41,{startDevServer:()=>PO4,pipeToLogStore:()=>e81});import{join as zO4}from"path";function e81($){let Z=$.getReader(),Q=new TextDecoder,Y="";function X(){let J=Y.split(`
-`);Y=J.pop()??"";for(let G of J){let W=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!W)continue;mj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:W})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;Y+=Q.decode(G,{stream:!0}),X()}}catch{}if(Y.trim()){let J=Bun.stripANSI(Y).replace(/^\[\d+\]\s*/,"").trim();if(J)mj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function PO4($){let{baseUrl:Z,noTui:Q}=$,Y=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),X=Y?process.env.PORT:$.vitePort,J=Z||`http://localhost:${X}`,G=Y?await ks(Number(X)+1):await ks(Number($.port)),{settings:W,services:K,managedServiceNames:H}=await NK0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of K)GT({name:O.name,status:"ready",port:O.port});Is();let F=zO4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(W.port),VITE_PORT:String(X),DATABASE_URL:W.databaseUrl,NATS_URL:W.natsUrls.join(","),NODE_ENV:W.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(W.localMode),DECOCMS_HOME:W.dataDir,DATA_DIR:W.dataDir,DECO_CLI:"1",...W.betterAuthSecret?{BETTER_AUTH_SECRET:W.betterAuthSecret}:{},...W.s3Endpoint?{S3_ENDPOINT:W.s3Endpoint,S3_BUCKET:W.s3Bucket??"",S3_ACCESS_KEY_ID:W.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:W.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(W.s3ForcePathStyle)}:{},...W.natsCredsPath?{NATS_CREDS:W.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)e81(N.stdout),e81(N.stderr);Vs(J),GT({name:"Vite",status:"ready",port:Number(X)}),GT({name:"API",status:"ready",port:Number(W.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (NW0(),UW0));await j(W.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(X),process:N}}var Z41=L(()=>{t81();WT();s81()});var DK0;var Q41=L(()=>{DK0={name:"decocms",version:"4.429.14",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as AO4,Text as EG$}from"ink";import{jsx as RO4,jsxs as zG$}from"react/jsx-runtime";function PG$({version:$}){return zG$(AO4,{flexDirection:"column",marginTop:1,children:[fW0.map((Z,Q)=>RO4(EG$,{color:bW0[Q],children:Z},Q)),zG$(EG$,{dimColor:!0,children:[" v",$]})]})}var TG$=L(()=>{Fs()});import{Box as KT,Text as dj}from"ink";import{Spinner as qO4}from"@inkjs/ui";import{jsx as rG,jsxs as Oc}from"react/jsx-runtime";function AG$({status:$}){if($==="pending")return rG(qO4,{label:""});return rG(dj,{color:"green",children:"\u2713"})}function MO4($){return`${$.name}: ${$.port||"...."}`}function RG$({services:$,migrationsStatus:Z,home:Q,serverUrl:Y}){return Oc(KT,{flexDirection:"column",paddingBottom:1,children:[rG(PG$,{version:DK0.version}),rG(KT,{marginBottom:1,children:rG(dj,{dimColor:!0,children:"\u2500".repeat(80)})}),rG(KT,{children:Oc(dj,{dimColor:!0,children:["Home: ",Q]})}),Oc(KT,{gap:2,children:[$.map((X)=>Oc(KT,{gap:1,children:[rG(dj,{children:MO4(X)}),rG(AG$,{status:X.status})]},X.name)),Oc(KT,{gap:1,children:[rG(dj,{children:"Migrations"}),rG(AG$,{status:Z})]})]}),rG(KT,{children:Y?Oc(dj,{children:["Open in browser: ",rG(dj,{color:"cyan",children:Y})]}):rG(dj,{dimColor:!0,children:"Starting..."})})]})}var qG$=L(()=>{Q41();TG$()});import{Box as IO4,Text as Cs}from"ink";import{jsx as Y41,jsxs as X41}from"react/jsx-runtime";function VO4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function MG$({logs:$}){return Y41(IO4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return Y41(Cs,{dimColor:!0,children:Z.rawLine},Q);let Y=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return X41(Cs,{children:[X41(Cs,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Y41(Cs,{color:VO4(Z.status),children:Z.status}),X41(Cs,{dimColor:!0,children:[" ",Y.padStart(8)]})]},Q)})})}var IG$=()=>{};var J41={};J0(J41,{App:()=>SO4});import{Box as kO4}from"ink";import{useSyncExternalStore as CO4}from"react";import{jsx as VG$,jsxs as _O4}from"react/jsx-runtime";function SO4({home:$}){let Z=CO4(r81,a81);return _O4(kO4,{flexDirection:"column",children:[VG$(RG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),VG$(MG$,{logs:Z.logs})]})}var G41=L(()=>{qG$();IG$();WT()});var CW="thread-gate",jL="decopilot-hosted-harness",wL="decopilot-hosted-harness-sandboxed",SW="automations",ij="background-tools",HT="task-board-github-reads";var kG$="13";function CG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:kG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var SG$=()=>{};import vO4 from"pg";async function vG$($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=xO4}=$,X=$.log??((K)=>console.log(K)),J=new vO4.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[_G$.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(fO4)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[_G$.toString()])}catch{}await J.end().catch(()=>{})}}var _G$=8314027461559302n,xO4=600000,fO4=500;var xG$=L(()=>{$8()});function bO4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function W41($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function fG$(){let $=bO4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:W41($,"--cpu-prof-dir")??process.cwd(),name:W41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(W41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function bG$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=QT();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),OK0=setInterval(()=>void Z().catch(()=>{}),$),OK0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(OK0)clearInterval(OK0)}}var OK0;var yG$=()=>{};import*as yO4 from"bun:jsc";function gG$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{gO4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=hO4()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var gO4,hO4;var hG$=L(()=>{({startSamplingProfiler:gO4,samplingProfilerStackTraces:hO4}=yO4)});function uG$(){fG$();let $=[bG$(),U7$(),gG$()];return()=>{for(let Z of $)Z()}}var lG$=L(()=>{ls0();yG$();hG$()});var FT=b((cG$)=>{Object.defineProperty(cG$,"__esModule",{value:!0});cG$.RepublishHeaders=cG$.DirectMsgHeaders=cG$.JsHeaders=cG$.AdvisoryKind=void 0;cG$.isOrderedPushConsumerOptions=uO4;cG$.isPullConsumer=lO4;cG$.isPushConsumer=cO4;cG$.isBoundPushConsumerOptions=mO4;function uO4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function lO4($){return $.isPullConsumer()}function cO4($){return $.isPushConsumer()}function mO4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}cG$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};cG$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};cG$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};cG$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((dG$)=>{Object.defineProperty(dG$,"__esModule",{value:!0});dG$.TD=dG$.TE=dG$.Empty=void 0;dG$.encode=sO4;dG$.decode=eO4;dG$.Empty=new Uint8Array(0);dG$.TE=new TextEncoder;dG$.TD=new TextDecoder;function rO4(...$){let Z=0;for(let X=0;X<$.length;X++)Z+=$[X].length;let Q=new Uint8Array(Z),Y=0;for(let X=0;X<$.length;X++)Q.set($[X],Y),Y+=$[X].length;return Q}function sO4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(dG$.TE.encode($[Q]));if(Z.length===0)return dG$.Empty;if(Z.length===1)return Z[0];return rO4(...Z)}function eO4($){if(!$||$.length===0)return"";return dG$.TD.decode($)}});var eG=b((nG$)=>{Object.defineProperty(nG$,"__esModule",{value:!0});nG$.errors=nG$.PermissionViolationError=nG$.NoRespondersError=nG$.TimeoutError=nG$.RequestError=nG$.ProtocolError=nG$.ConnectionError=nG$.DrainingConnectionError=nG$.ClosedConnectionError=nG$.AuthorizationError=nG$.UserAuthenticationExpiredError=nG$.InvalidOperationError=nG$.InvalidArgumentError=nG$.InvalidSubjectError=void 0;class H41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}nG$.InvalidSubjectError=H41;class jK0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Y)=>`'${Y}'`),$=$.join(",");else $=`'${$}'`;return new jK0(`${$} ${Z}`,Q)}}nG$.InvalidArgumentError=jK0;class F41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}nG$.InvalidOperationError=F41;class wK0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new wK0($);return null}}nG$.UserAuthenticationExpiredError=wK0;class EK0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let Y=0;Y<Z.length;Y++)if(Q.indexOf(Z[Y])!==-1)return new EK0($);return null}}nG$.AuthorizationError=EK0;class U41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}nG$.ClosedConnectionError=U41;class N41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}nG$.DrainingConnectionError=N41;class B41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}nG$.ConnectionError=B41;class L41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}nG$.ProtocolError=L41;class D41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof zK0}}nG$.RequestError=D41;class O41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}nG$.TimeoutError=O41;class zK0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}nG$.NoRespondersError=zK0;class PK0 extends Error{operation;subject;queue;constructor($,Z,Q,Y,X){super($,X);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=Y}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",Y="",X=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),Y=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)X=G[1]}}return new PK0($,Q,Y,X)}}nG$.PermissionViolationError=PK0;nG$.errors={AuthorizationError:EK0,ClosedConnectionError:U41,ConnectionError:B41,DrainingConnectionError:N41,InvalidArgumentError:jK0,InvalidOperationError:F41,InvalidSubjectError:H41,NoRespondersError:zK0,PermissionViolationError:PK0,ProtocolError:L41,RequestError:D41,TimeoutError:O41,UserAuthenticationExpiredError:wK0}});var jH=b((sG$)=>{Object.defineProperty(sG$,"__esModule",{value:!0});sG$.SimpleMutex=sG$.Perf=void 0;sG$.extend=Oj4;sG$.render=jj4;sG$.timeout=wj4;sG$.delay=Ej4;sG$.deadline=zj4;sG$.deferred=w41;sG$.debugDeferred=Pj4;sG$.shuffle=Tj4;sG$.collect=Aj4;sG$.jitter=rG$;sG$.backoff=Rj4;sG$.nanos=qj4;sG$.millis=Mj4;sG$.randomToken=kj4;var Dj4=sG(),j41=eG();function Oj4($,...Z){for(let Q=0;Q<Z.length;Q++){let Y=Z[Q];Object.keys(Y).forEach(function(X){$[X]=Y[X]})}return $}function jj4($){return Dj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function wj4($,Z=!0){let Q=Z?new j41.TimeoutError:null,Y,X,J=new Promise((G,W)=>{Y={cancel:()=>{if(X)clearTimeout(X)}},X=setTimeout(()=>{if(Q===null)W(new j41.TimeoutError);else W(Q)},$)});return Object.assign(J,Y)}function Ej4($=0){let Z,Q=new Promise((Y)=>{let X=setTimeout(()=>{Y()},$);Z={cancel:()=>{if(X)clearTimeout(X),Y()}}});return Object.assign(Q,Z)}async function zj4($,Z=1000){let Q=w41(),Y=setTimeout(()=>{Q.reject(new j41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(Y)}}function w41(){let $={},Z=new Promise((Q,Y)=>{$={resolve:Q,reject:Y}});return Object.assign(Z,$)}function Pj4(){let $={},Z=new Promise((Q,Y)=>{$={resolve:(X)=>{console.trace("resolve",X),Q(X)},reject:(X)=>{console.trace("reject"),Y(X)}}});return Object.assign(Z,$)}function Tj4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Aj4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class oG${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let Y=this.timers.get(Z);if(Y===void 0)throw Error(`${Z} is not defined`);let X=this.timers.get(Q);if(X===void 0)throw Error(`${Q} is not defined`);this.measures.set($,X-Y)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}sG$.Perf=oG$;class aG${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=w41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}sG$.SimpleMutex=aG$;function rG$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Rj4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return rG$(Q>Z?$[Z]:$[Q])}}}function qj4($){return $*1e6}function Mj4($){return Math.floor($/1e6)}var Ij4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",EL=new Uint8Array(62);for(let $=0;$<62;$++)EL[$]=Ij4.charCodeAt($);var Vj4=218340105584896;function kj4(){let $=Math.floor(Math.random()*Vj4),Z=$%62,Q=EL[Z];$=($-Z)/62,Z=$%62;let Y=EL[Z];$=($-Z)/62,Z=$%62;let X=EL[Z];$=($-Z)/62,Z=$%62;let J=EL[Z];$=($-Z)/62,Z=$%62;let G=EL[Z];$=($-Z)/62,Z=$%62;let W=EL[Z];$=($-Z)/62,Z=$%62;let K=EL[Z];$=($-Z)/62;let H=EL[$];return String.fromCharCode(Q,Y,X,J,G,W,K,H)}});var G3$=b((X3$)=>{Object.defineProperty(X3$,"__esModule",{value:!0});X3$.nuid=X3$.NuidImpl=void 0;var ij4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",pj=62,AK0=12,Q3$=10,$3$=33,pj4=333,Z3$=AK0+Q3$,z41=new Uint8Array(pj);for(let $=0;$<pj;$++)z41[$]=ij4.charCodeAt($);var TK0=4294967296,Y3$=BigInt(pj)**BigInt(Q3$),Ss=Number(Y3$/(1n<<32n)),E41=Number(Y3$%(1n<<32n));function nj4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function tj4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else nj4($)}class P41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(Z3$),this.cbuf=new Uint8Array(AK0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Ss+1)),this.seqLo=Math.floor(Math.random()*TK0);while($++<8&&this.seqHi===Ss&&this.seqLo>=E41);if(this.seqHi===Ss&&this.seqLo>=E41)this.seqLo=0;this.inc=Math.random()*(pj4-$3$)+$3$|0}setPre(){tj4(this.cbuf);for(let $=0;$<AK0;$++)this.buf[$]=z41[this.cbuf[$]%pj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=Z3$-1;Q>=AK0;Q--){let Y=Math.floor($/pj),J=($-Y*pj)*TK0+Z,G=Math.floor(J/pj),W=J-G*pj;this.buf[Q]=z41[W],$=Y,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=TK0)this.seqLo-=TK0,this.seqHi+=1;if(this.seqHi>Ss||this.seqHi===Ss&&this.seqLo>=E41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}X3$.NuidImpl=P41;X3$.nuid=new P41});var F3$=b((K3$)=>{Object.defineProperty(K3$,"__esModule",{value:!0});K3$.nuid=K3$.Nuid=void 0;var W3$=G3$();K3$.Nuid=W3$.NuidImpl;K3$.nuid=W3$.nuid});var qK0=b((RK0)=>{Object.defineProperty(RK0,"__esModule",{value:!0});RK0.nuid=RK0.Nuid=void 0;var U3$=F3$();Object.defineProperty(RK0,"Nuid",{enumerable:!0,get:function(){return U3$.Nuid}});Object.defineProperty(RK0,"nuid",{enumerable:!0,get:function(){return U3$.nuid}})});var nj=b((N3$)=>{Object.defineProperty(N3$,"__esModule",{value:!0});N3$.DEFAULT_HOST=N3$.DEFAULT_PORT=N3$.Match=void 0;N3$.syncIterator=$w4;N3$.createInbox=Zw4;var sj4=qK0(),ej4=eG();N3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function $w4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function Zw4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ej4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${sj4.nuid.next()}`}N3$.DEFAULT_PORT=4222;N3$.DEFAULT_HOST="127.0.0.1"});var _s=b((O3$)=>{Object.defineProperty(O3$,"__esModule",{value:!0});O3$.DataBuffer=void 0;var L3$=sG();class D3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let X=0;X<$.length;X++)Z+=$[X].length;let Q=new Uint8Array(Z),Y=0;for(let X=0;X<$.length;X++)Q.set($[X],Y),Y+=$[X].length;return Q}static fromAscii($){if(!$)$="";return L3$.TE.encode($)}static toAscii($){return L3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let Y=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,Y}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}O3$.DataBuffer=D3$});var UT=b((E3$)=>{Object.defineProperty(E3$,"__esModule",{value:!0});E3$.LF=E3$.CR=E3$.CRLF=E3$.CR_LF_LEN=E3$.CR_LF=void 0;E3$.setTransportFactory=Hw4;E3$.defaultPort=Fw4;E3$.getUrlParseFn=Uw4;E3$.newTransport=Nw4;E3$.getResolveFn=Bw4;E3$.protoLen=w3$;E3$.extractProtocolMessage=Lw4;var Gw4=sG(),Ww4=nj(),Kw4=_s(),$3;function Hw4($){$3=$}function Fw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:Ww4.DEFAULT_PORT}function Uw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function Nw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function Bw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}E3$.CR_LF=`\r
+`);Y=J.pop()??"";for(let G of J){let W=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!W)continue;mj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:W})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;Y+=Q.decode(G,{stream:!0}),X()}}catch{}if(Y.trim()){let J=Bun.stripANSI(Y).replace(/^\[\d+\]\s*/,"").trim();if(J)mj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function PO4($){let{baseUrl:Z,noTui:Q}=$,Y=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),X=Y?process.env.PORT:$.vitePort,J=Z||`http://localhost:${X}`,G=Y?await ks(Number(X)+1):await ks(Number($.port)),{settings:W,services:K,managedServiceNames:H}=await NK0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of K)GT({name:O.name,status:"ready",port:O.port});Is();let F=zO4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(W.port),VITE_PORT:String(X),DATABASE_URL:W.databaseUrl,NATS_URL:W.natsUrls.join(","),NODE_ENV:W.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(W.localMode),DECOCMS_HOME:W.dataDir,DATA_DIR:W.dataDir,DECO_CLI:"1",...W.betterAuthSecret?{BETTER_AUTH_SECRET:W.betterAuthSecret}:{},...W.s3Endpoint?{S3_ENDPOINT:W.s3Endpoint,S3_BUCKET:W.s3Bucket??"",S3_ACCESS_KEY_ID:W.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:W.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(W.s3ForcePathStyle)}:{},...W.natsCredsPath?{NATS_CREDS:W.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)e81(N.stdout),e81(N.stderr);Vs(J),GT({name:"Vite",status:"ready",port:Number(X)}),GT({name:"API",status:"ready",port:Number(W.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (NW0(),UW0));await j(W.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(X),process:N}}var Z41=L(()=>{t81();WT();s81()});var DK0;var Q41=L(()=>{DK0={name:"decocms",version:"4.429.16",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as AO4,Text as EG$}from"ink";import{jsx as RO4,jsxs as zG$}from"react/jsx-runtime";function PG$({version:$}){return zG$(AO4,{flexDirection:"column",marginTop:1,children:[fW0.map((Z,Q)=>RO4(EG$,{color:bW0[Q],children:Z},Q)),zG$(EG$,{dimColor:!0,children:[" v",$]})]})}var TG$=L(()=>{Fs()});import{Box as KT,Text as dj}from"ink";import{Spinner as qO4}from"@inkjs/ui";import{jsx as rG,jsxs as Oc}from"react/jsx-runtime";function AG$({status:$}){if($==="pending")return rG(qO4,{label:""});return rG(dj,{color:"green",children:"\u2713"})}function MO4($){return`${$.name}: ${$.port||"...."}`}function RG$({services:$,migrationsStatus:Z,home:Q,serverUrl:Y}){return Oc(KT,{flexDirection:"column",paddingBottom:1,children:[rG(PG$,{version:DK0.version}),rG(KT,{marginBottom:1,children:rG(dj,{dimColor:!0,children:"\u2500".repeat(80)})}),rG(KT,{children:Oc(dj,{dimColor:!0,children:["Home: ",Q]})}),Oc(KT,{gap:2,children:[$.map((X)=>Oc(KT,{gap:1,children:[rG(dj,{children:MO4(X)}),rG(AG$,{status:X.status})]},X.name)),Oc(KT,{gap:1,children:[rG(dj,{children:"Migrations"}),rG(AG$,{status:Z})]})]}),rG(KT,{children:Y?Oc(dj,{children:["Open in browser: ",rG(dj,{color:"cyan",children:Y})]}):rG(dj,{dimColor:!0,children:"Starting..."})})]})}var qG$=L(()=>{Q41();TG$()});import{Box as IO4,Text as Cs}from"ink";import{jsx as Y41,jsxs as X41}from"react/jsx-runtime";function VO4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function MG$({logs:$}){return Y41(IO4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return Y41(Cs,{dimColor:!0,children:Z.rawLine},Q);let Y=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return X41(Cs,{children:[X41(Cs,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Y41(Cs,{color:VO4(Z.status),children:Z.status}),X41(Cs,{dimColor:!0,children:[" ",Y.padStart(8)]})]},Q)})})}var IG$=()=>{};var J41={};J0(J41,{App:()=>SO4});import{Box as kO4}from"ink";import{useSyncExternalStore as CO4}from"react";import{jsx as VG$,jsxs as _O4}from"react/jsx-runtime";function SO4({home:$}){let Z=CO4(r81,a81);return _O4(kO4,{flexDirection:"column",children:[VG$(RG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),VG$(MG$,{logs:Z.logs})]})}var G41=L(()=>{qG$();IG$();WT()});var CW="thread-gate",jL="decopilot-hosted-harness",wL="decopilot-hosted-harness-sandboxed",SW="automations",ij="background-tools",HT="task-board-github-reads";var kG$="13";function CG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:kG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var SG$=()=>{};import vO4 from"pg";async function vG$($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=xO4}=$,X=$.log??((K)=>console.log(K)),J=new vO4.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[_G$.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(fO4)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[_G$.toString()])}catch{}await J.end().catch(()=>{})}}var _G$=8314027461559302n,xO4=600000,fO4=500;var xG$=L(()=>{$8()});function bO4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function W41($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function fG$(){let $=bO4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:W41($,"--cpu-prof-dir")??process.cwd(),name:W41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(W41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function bG$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=QT();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),OK0=setInterval(()=>void Z().catch(()=>{}),$),OK0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(OK0)clearInterval(OK0)}}var OK0;var yG$=()=>{};import*as yO4 from"bun:jsc";function gG$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{gO4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=hO4()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var gO4,hO4;var hG$=L(()=>{({startSamplingProfiler:gO4,samplingProfilerStackTraces:hO4}=yO4)});function uG$(){fG$();let $=[bG$(),U7$(),gG$()];return()=>{for(let Z of $)Z()}}var lG$=L(()=>{ls0();yG$();hG$()});var FT=b((cG$)=>{Object.defineProperty(cG$,"__esModule",{value:!0});cG$.RepublishHeaders=cG$.DirectMsgHeaders=cG$.JsHeaders=cG$.AdvisoryKind=void 0;cG$.isOrderedPushConsumerOptions=uO4;cG$.isPullConsumer=lO4;cG$.isPushConsumer=cO4;cG$.isBoundPushConsumerOptions=mO4;function uO4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function lO4($){return $.isPullConsumer()}function cO4($){return $.isPushConsumer()}function mO4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}cG$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};cG$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};cG$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};cG$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((dG$)=>{Object.defineProperty(dG$,"__esModule",{value:!0});dG$.TD=dG$.TE=dG$.Empty=void 0;dG$.encode=sO4;dG$.decode=eO4;dG$.Empty=new Uint8Array(0);dG$.TE=new TextEncoder;dG$.TD=new TextDecoder;function rO4(...$){let Z=0;for(let X=0;X<$.length;X++)Z+=$[X].length;let Q=new Uint8Array(Z),Y=0;for(let X=0;X<$.length;X++)Q.set($[X],Y),Y+=$[X].length;return Q}function sO4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(dG$.TE.encode($[Q]));if(Z.length===0)return dG$.Empty;if(Z.length===1)return Z[0];return rO4(...Z)}function eO4($){if(!$||$.length===0)return"";return dG$.TD.decode($)}});var eG=b((nG$)=>{Object.defineProperty(nG$,"__esModule",{value:!0});nG$.errors=nG$.PermissionViolationError=nG$.NoRespondersError=nG$.TimeoutError=nG$.RequestError=nG$.ProtocolError=nG$.ConnectionError=nG$.DrainingConnectionError=nG$.ClosedConnectionError=nG$.AuthorizationError=nG$.UserAuthenticationExpiredError=nG$.InvalidOperationError=nG$.InvalidArgumentError=nG$.InvalidSubjectError=void 0;class H41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}nG$.InvalidSubjectError=H41;class jK0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Y)=>`'${Y}'`),$=$.join(",");else $=`'${$}'`;return new jK0(`${$} ${Z}`,Q)}}nG$.InvalidArgumentError=jK0;class F41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}nG$.InvalidOperationError=F41;class wK0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new wK0($);return null}}nG$.UserAuthenticationExpiredError=wK0;class EK0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let Y=0;Y<Z.length;Y++)if(Q.indexOf(Z[Y])!==-1)return new EK0($);return null}}nG$.AuthorizationError=EK0;class U41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}nG$.ClosedConnectionError=U41;class N41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}nG$.DrainingConnectionError=N41;class B41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}nG$.ConnectionError=B41;class L41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}nG$.ProtocolError=L41;class D41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof zK0}}nG$.RequestError=D41;class O41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}nG$.TimeoutError=O41;class zK0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}nG$.NoRespondersError=zK0;class PK0 extends Error{operation;subject;queue;constructor($,Z,Q,Y,X){super($,X);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=Y}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",Y="",X=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),Y=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)X=G[1]}}return new PK0($,Q,Y,X)}}nG$.PermissionViolationError=PK0;nG$.errors={AuthorizationError:EK0,ClosedConnectionError:U41,ConnectionError:B41,DrainingConnectionError:N41,InvalidArgumentError:jK0,InvalidOperationError:F41,InvalidSubjectError:H41,NoRespondersError:zK0,PermissionViolationError:PK0,ProtocolError:L41,RequestError:D41,TimeoutError:O41,UserAuthenticationExpiredError:wK0}});var jH=b((sG$)=>{Object.defineProperty(sG$,"__esModule",{value:!0});sG$.SimpleMutex=sG$.Perf=void 0;sG$.extend=Oj4;sG$.render=jj4;sG$.timeout=wj4;sG$.delay=Ej4;sG$.deadline=zj4;sG$.deferred=w41;sG$.debugDeferred=Pj4;sG$.shuffle=Tj4;sG$.collect=Aj4;sG$.jitter=rG$;sG$.backoff=Rj4;sG$.nanos=qj4;sG$.millis=Mj4;sG$.randomToken=kj4;var Dj4=sG(),j41=eG();function Oj4($,...Z){for(let Q=0;Q<Z.length;Q++){let Y=Z[Q];Object.keys(Y).forEach(function(X){$[X]=Y[X]})}return $}function jj4($){return Dj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function wj4($,Z=!0){let Q=Z?new j41.TimeoutError:null,Y,X,J=new Promise((G,W)=>{Y={cancel:()=>{if(X)clearTimeout(X)}},X=setTimeout(()=>{if(Q===null)W(new j41.TimeoutError);else W(Q)},$)});return Object.assign(J,Y)}function Ej4($=0){let Z,Q=new Promise((Y)=>{let X=setTimeout(()=>{Y()},$);Z={cancel:()=>{if(X)clearTimeout(X),Y()}}});return Object.assign(Q,Z)}async function zj4($,Z=1000){let Q=w41(),Y=setTimeout(()=>{Q.reject(new j41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(Y)}}function w41(){let $={},Z=new Promise((Q,Y)=>{$={resolve:Q,reject:Y}});return Object.assign(Z,$)}function Pj4(){let $={},Z=new Promise((Q,Y)=>{$={resolve:(X)=>{console.trace("resolve",X),Q(X)},reject:(X)=>{console.trace("reject"),Y(X)}}});return Object.assign(Z,$)}function Tj4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Aj4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class oG${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let Y=this.timers.get(Z);if(Y===void 0)throw Error(`${Z} is not defined`);let X=this.timers.get(Q);if(X===void 0)throw Error(`${Q} is not defined`);this.measures.set($,X-Y)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}sG$.Perf=oG$;class aG${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=w41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}sG$.SimpleMutex=aG$;function rG$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Rj4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return rG$(Q>Z?$[Z]:$[Q])}}}function qj4($){return $*1e6}function Mj4($){return Math.floor($/1e6)}var Ij4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",EL=new Uint8Array(62);for(let $=0;$<62;$++)EL[$]=Ij4.charCodeAt($);var Vj4=218340105584896;function kj4(){let $=Math.floor(Math.random()*Vj4),Z=$%62,Q=EL[Z];$=($-Z)/62,Z=$%62;let Y=EL[Z];$=($-Z)/62,Z=$%62;let X=EL[Z];$=($-Z)/62,Z=$%62;let J=EL[Z];$=($-Z)/62,Z=$%62;let G=EL[Z];$=($-Z)/62,Z=$%62;let W=EL[Z];$=($-Z)/62,Z=$%62;let K=EL[Z];$=($-Z)/62;let H=EL[$];return String.fromCharCode(Q,Y,X,J,G,W,K,H)}});var G3$=b((X3$)=>{Object.defineProperty(X3$,"__esModule",{value:!0});X3$.nuid=X3$.NuidImpl=void 0;var ij4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",pj=62,AK0=12,Q3$=10,$3$=33,pj4=333,Z3$=AK0+Q3$,z41=new Uint8Array(pj);for(let $=0;$<pj;$++)z41[$]=ij4.charCodeAt($);var TK0=4294967296,Y3$=BigInt(pj)**BigInt(Q3$),Ss=Number(Y3$/(1n<<32n)),E41=Number(Y3$%(1n<<32n));function nj4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function tj4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else nj4($)}class P41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(Z3$),this.cbuf=new Uint8Array(AK0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Ss+1)),this.seqLo=Math.floor(Math.random()*TK0);while($++<8&&this.seqHi===Ss&&this.seqLo>=E41);if(this.seqHi===Ss&&this.seqLo>=E41)this.seqLo=0;this.inc=Math.random()*(pj4-$3$)+$3$|0}setPre(){tj4(this.cbuf);for(let $=0;$<AK0;$++)this.buf[$]=z41[this.cbuf[$]%pj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=Z3$-1;Q>=AK0;Q--){let Y=Math.floor($/pj),J=($-Y*pj)*TK0+Z,G=Math.floor(J/pj),W=J-G*pj;this.buf[Q]=z41[W],$=Y,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=TK0)this.seqLo-=TK0,this.seqHi+=1;if(this.seqHi>Ss||this.seqHi===Ss&&this.seqLo>=E41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}X3$.NuidImpl=P41;X3$.nuid=new P41});var F3$=b((K3$)=>{Object.defineProperty(K3$,"__esModule",{value:!0});K3$.nuid=K3$.Nuid=void 0;var W3$=G3$();K3$.Nuid=W3$.NuidImpl;K3$.nuid=W3$.nuid});var qK0=b((RK0)=>{Object.defineProperty(RK0,"__esModule",{value:!0});RK0.nuid=RK0.Nuid=void 0;var U3$=F3$();Object.defineProperty(RK0,"Nuid",{enumerable:!0,get:function(){return U3$.Nuid}});Object.defineProperty(RK0,"nuid",{enumerable:!0,get:function(){return U3$.nuid}})});var nj=b((N3$)=>{Object.defineProperty(N3$,"__esModule",{value:!0});N3$.DEFAULT_HOST=N3$.DEFAULT_PORT=N3$.Match=void 0;N3$.syncIterator=$w4;N3$.createInbox=Zw4;var sj4=qK0(),ej4=eG();N3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function $w4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function Zw4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ej4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${sj4.nuid.next()}`}N3$.DEFAULT_PORT=4222;N3$.DEFAULT_HOST="127.0.0.1"});var _s=b((O3$)=>{Object.defineProperty(O3$,"__esModule",{value:!0});O3$.DataBuffer=void 0;var L3$=sG();class D3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let X=0;X<$.length;X++)Z+=$[X].length;let Q=new Uint8Array(Z),Y=0;for(let X=0;X<$.length;X++)Q.set($[X],Y),Y+=$[X].length;return Q}static fromAscii($){if(!$)$="";return L3$.TE.encode($)}static toAscii($){return L3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let Y=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,Y}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}O3$.DataBuffer=D3$});var UT=b((E3$)=>{Object.defineProperty(E3$,"__esModule",{value:!0});E3$.LF=E3$.CR=E3$.CRLF=E3$.CR_LF_LEN=E3$.CR_LF=void 0;E3$.setTransportFactory=Hw4;E3$.defaultPort=Fw4;E3$.getUrlParseFn=Uw4;E3$.newTransport=Nw4;E3$.getResolveFn=Bw4;E3$.protoLen=w3$;E3$.extractProtocolMessage=Lw4;var Gw4=sG(),Ww4=nj(),Kw4=_s(),$3;function Hw4($){$3=$}function Fw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:Ww4.DEFAULT_PORT}function Uw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function Nw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function Bw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}E3$.CR_LF=`\r
 `;E3$.CR_LF_LEN=E3$.CR_LF.length;E3$.CRLF=Kw4.DataBuffer.fromAscii(E3$.CR_LF);E3$.CR=new Uint8Array(E3$.CRLF)[0];E3$.LF=new Uint8Array(E3$.CRLF)[1];function w3$($){for(let Z=0;Z<$.length;Z++){let Q=Z+1;if($.byteLength>Q&&$[Z]===E3$.CR&&$[Q]===E3$.LF)return Q+1}return 0}function Lw4($){let Z=w3$($);if(Z>0){let Y=new Uint8Array($).slice(0,Z);return Gw4.TD.decode(Y)}return""}});var M41=b((I3$)=>{Object.defineProperty(I3$,"__esModule",{value:!0});I3$.ipV4=R3$;I3$.isIP=qw4;I3$.parseIP=q3$;var vs=4,NT=16,MK0=48,A3$=57,P3$=65,Aw4=70,T3$=97,Rw4=102,q41=16777215;function R3$($,Z,Q,Y){let X=new Uint8Array(NT);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((G,W)=>{X[W]=G}),X[12]=$,X[13]=Z,X[14]=Q,X[15]=Y,X}function qw4($){return q3$($)!==void 0}function q3$($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return M3$($);case":":return Mw4($)}return}function M3$($){let Z=new Uint8Array(vs);for(let Q=0;Q<vs;Q++){if($.length===0)return;if(Q>0){if($[0]!==".")return;$=$.substring(1)}let{n:Y,c:X,ok:J}=Iw4($);if(!J||Y>255)return;$=$.substring(X),Z[Q]=Y}return R3$(Z[0],Z[1],Z[2],Z[3])}function Mw4($){let Z=new Uint8Array(NT),Q=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(Q=0,$=$.substring(2),$.length===0)return Z}let Y=0;while(Y<NT){let{n:X,c:J,ok:G}=Vw4($);if(!G||X>65535)return;if(J<$.length&&$[J]==="."){if(Q<0&&Y!=NT-vs)return;if(Y+vs>NT)return;let W=M3$($);if(W===void 0)return;Z[Y]=W[12],Z[Y+1]=W[13],Z[Y+2]=W[14],Z[Y+3]=W[15],$="",Y+=vs;break}if(Z[Y]=X>>8,Z[Y+1]=X,Y+=2,$=$.substring(J),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(Q>=0)return;if(Q=Y,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(Y<NT){if(Q<0)return;let X=NT-Y;for(let J=Y-1;J>=Q;J--)Z[J+X]=Z[J];for(let J=Q+X-1;J>=Q;J--)Z[J]=0}else if(Q>=0)return;return Z}function Iw4($){let Z=0,Q=0;for(Z=0;Z<$.length&&MK0<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=A3$;Z++)if(Q=Q*10+($.charCodeAt(Z)-MK0),Q>=q41)return{n:q41,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:Q,c:Z,ok:!0}}function Vw4($){let Z=0,Q=0;for(Q=0;Q<$.length;Q++){if(MK0<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=A3$)Z*=16,Z+=$.charCodeAt(Q)-MK0;else if(T3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=Rw4)Z*=16,Z+=$.charCodeAt(Q)-T3$+10;else if(P3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=Aw4)Z*=16,Z+=$.charCodeAt(Q)-P3$+10;else break;if(Z>=q41)return{n:0,c:Q,ok:!1}}if(Q===0)return{n:0,c:Q,ok:!1};return{n:Z,c:Q,ok:!0}}});var _41=b((k3$)=>{Object.defineProperty(k3$,"__esModule",{value:!0});k3$.Servers=k3$.ServerImpl=void 0;k3$.isIPV4OrHostname=V3$;k3$.hostPort=S41;var I41=UT(),V41=jH(),k41=M41(),_w4=nj(),vw4=eG();function V3$($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function C41($){return!V3$($)}function xw4($){let Q=$.toUpperCase().indexOf("::FFFF:");if(Q!==-1&&$.indexOf(".")!==-1){let Y=$.substring(Q+7);return Y=Y.replace("[",""),Y.replace("]","")}return $}function S41($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=xw4($),C41($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=C41($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),Q=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):_w4.DEFAULT_PORT,X=new URL(`${Q===80?"https":"http"}://${$}`);X.port=`${Q}`;let J=X.hostname;if(J.charAt(0)==="[")J=J.substring(1,J.length-1);return{listen:X.host,hostname:J,port:Q}}class jc{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let Q=S41($);this.listen=Q.listen,this.hostname=Q.hostname,this.port=Q.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,k41.isIP)(this.hostname))return[this];else{let Q=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${Q.join(",")}`);for(let Y of Q){let X=this.port===80?"https":"http",J=new URL(`${X}://${C41(Y)?"["+Y+"]":Y}`);J.port=`${this.port}`;let G=new jc(J.host,!1);G.tlsName=this.hostname,Z.push(G)}}if($.randomize)(0,V41.shuffle)(Z);return this.resolves=Z,Z}}k3$.ServerImpl=jc;class IK0{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw vw4.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,I41.getUrlParseFn)(),Q=new Map;for(let X of this.servers)Q.set(X.listen,X);let Y=[];for(let X of $){X=Z?Z(X):X;let{listen:J}=S41(X),G=Q.get(J);if(G)G.gossiped=!1,Y.push(G);else Y.push(new jc(X))}if(this.randomize)(0,V41.shuffle)(Y);if(this.servers=Y,this.currentServer===void 0||!Y.includes(this.currentServer))this.currentServer=Y[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,k41.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let Q=(0,I41.getUrlParseFn)();$=Q?Q($):$;let Y=new jc($,Z);if((0,k41.isIP)(Y.hostname))Y.tlsName=this.tlsName;this.servers.push(Y)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return IK0.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return IK0.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let Q=[],Y=[],X=(0,I41.getUrlParseFn)(),J=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((W)=>{W=X?X(W,Z):W;let K=new jc(W,!0);J.set(W,K)});let G=[];if(this.servers.forEach((W,K)=>{let H=W.listen;if(W.gossiped&&this.currentServer.listen!==H&&J.get(H)===void 0)G.push(K);J.delete(H)}),G.reverse(),G.forEach((W)=>{let K=this.servers.splice(W,1);Y=Y.concat(K[0].listen)}),J.forEach((W,K)=>{this.servers.push(W),Q.push(K)}),this.randomize&&Q.length>0){let W=this.currentServer,K=this.servers.filter((H)=>H!==W);(0,V41.shuffle)(K),this.servers=W?[W,...K]:K}return{added:Q,deleted:Y}}}k3$.Servers=IK0});var VK0=b((v3$)=>{Object.defineProperty(v3$,"__esModule",{value:!0});v3$.QueuedIteratorImpl=void 0;var v41=jH(),S3$=eG();class _3${inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,v41.deferred)(),this.yields=[],this.iterClosed=(0,v41.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(Q){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new S3$.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new S3$.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let Y=$[Z];try{Y()}catch(X){throw X}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let Q=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-Q:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,v41.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}v3$.QueuedIteratorImpl=_3$});var x41=b((y3$)=>{Object.defineProperty(y3$,"__esModule",{value:!0});y3$.MuxSubscription=void 0;var gw4=nj(),f3$=eG();class b3${baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,gw4.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((Q)=>{Q.resolver(Z,{})}),!0;if(Z.operation==="publish"){let Q=this.all().find((Y)=>{return Y.requestSubject===Z.subject});if(Q)return Q.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let Q=this.getToken(Z);if(Q){let Y=this.get(Q);if(Y){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new f3$.NoRespondersError(Y.requestSubject):null;Y.resolver($,Z)}}}}close(){let $=new f3$.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}y3$.MuxSubscription=b3$});var f41=b((u3$)=>{Object.defineProperty(u3$,"__esModule",{value:!0});u3$.Heartbeat=void 0;var hw4=jH();class h3${ph;interval;maxOut;timer;pendings;constructor($,Z,Q){this.ph=$,this.interval=Z,this.maxOut=Q,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,hw4.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}u3$.Heartbeat=h3$});var g41=b((i3$)=>{Object.defineProperty(i3$,"__esModule",{value:!0});i3$.DenoBuffer=i3$.MAX_SIZE=i3$.AssertionError=void 0;i3$.assert=m3$;i3$.concat=d3$;i3$.append=lw4;i3$.readAll=cw4;i3$.writeAll=mw4;var uw4=sG();class b41 extends Error{constructor($){super($);this.name="AssertionError"}}i3$.AssertionError=b41;function m3$($,Z="Assertion failed."){if(!$)throw new b41(Z)}var c3$=32768;i3$.MAX_SIZE=4294967294;function kK0($,Z,Q=0){let Y=Z.byteLength-Q;if($.byteLength>Y)$=$.subarray(0,Y);return Z.set($,Q),$.byteLength}function d3$($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let Q=new Uint8Array($.length+Z.length);return Q.set($,0),Q.set(Z,$.length),Q}function lw4($,Z){return d3$($,Uint8Array.of(Z))}class y41{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){m3$($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=kK0(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(uw4.TE.encode($))}write($){let Z=this._grow($.byteLength);return kK0($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let Q=this._tryGrowByReslice($);if(Q>=0)return Q;let Y=this.capacity;if($<=Math.floor(Y/2)-Z)kK0(this._buf.subarray(this._off),this._buf);else if(Y+$>i3$.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let X=new Uint8Array(Math.min(2*Y+$,i3$.MAX_SIZE));kK0(this._buf.subarray(this._off),X),this._buf=X}return this._off=0,this._reslice(Math.min(Z+$,i3$.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,Q=new Uint8Array(c3$);while(!0){let Y=this.capacity-this.length<c3$,X=Y?Q:new Uint8Array(this._buf.buffer,this.length),J=$.read(X);if(J===null)return Z;if(Y)this.write(X.subarray(0,J));else this._reslice(this.length+J);Z+=J}}}i3$.DenoBuffer=y41;function cw4($){let Z=new y41;return Z.readFrom($),Z.bytes()}function mw4($,Z){let Q=0;while(Q<Z.length)Q+=$.write(Z.subarray(Q))}});var l41=b((a3$)=>{Object.defineProperty(a3$,"__esModule",{value:!0});a3$.cc=a3$.State=a3$.Parser=a3$.Kind=void 0;a3$.describe=aw4;var h41=g41(),u41=sG();a3$.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function aw4($){let Z,Q="";switch($.kind){case a3$.Kind.MSG:Z="MSG";break;case a3$.Kind.OK:Z="OK";break;case a3$.Kind.ERR:Z="ERR",Q=u41.TD.decode($.data);break;case a3$.Kind.PING:Z="PING";break;case a3$.Kind.PONG:Z="PONG";break;case a3$.Kind.INFO:Z="INFO",Q=u41.TD.decode($.data)}return`${Z}: ${Q}`}function n3$(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var t3$=48,rw4=57,wc=67108864;class o3${dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=a3$.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let Q=$[Z];switch(this.state){case a3$.State.OP_START:switch(Q){case a3$.cc.M:case a3$.cc.m:this.state=a3$.State.OP_M,this.hdr=-1,this.ma=n3$();break;case a3$.cc.H:case a3$.cc.h:this.state=a3$.State.OP_H,this.hdr=0,this.ma=n3$();break;case a3$.cc.P:case a3$.cc.p:this.state=a3$.State.OP_P;break;case a3$.cc.PLUS:this.state=a3$.State.OP_PLUS;break;case a3$.cc.MINUS:this.state=a3$.State.OP_MINUS;break;case a3$.cc.I:case a3$.cc.i:this.state=a3$.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_H:switch(Q){case a3$.cc.M:case a3$.cc.m:this.state=a3$.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_M:switch(Q){case a3$.cc.S:case a3$.cc.s:this.state=a3$.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MS:switch(Q){case a3$.cc.G:case a3$.cc.g:this.state=a3$.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MSG:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:this.state=a3$.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MSG_SPC:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:continue;default:this.state=a3$.State.MSG_ARG,this.as=Z}break;case a3$.State.MSG_ARG:switch(Q){case a3$.cc.CR:this.drop=1;break;case a3$.cc.NL:{let Y=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(Y),this.drop=0,this.as=Z+1,this.state=a3$.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;case a3$.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let Y=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:a3$.Kind.MSG,msg:this.ma,data:Y}),this.argBuf=void 0,this.msgBuf=void 0,this.state=a3$.State.MSG_END}else{let Y=this.ma.size-this.msgBuf.length,X=$.length-Z;if(X<Y)Y=X;if(Y>0)this.msgBuf.write($.subarray(Z,Z+Y)),Z=Z+Y-1;else this.msgBuf.writeByte(Q)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:a3$.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=a3$.State.MSG_END;break;case a3$.State.MSG_END:switch(Q){case a3$.cc.NL:this.drop=0,this.as=Z+1,this.state=a3$.State.OP_START;break;default:continue}break;case a3$.State.OP_PLUS:switch(Q){case a3$.cc.O:case a3$.cc.o:this.state=a3$.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PLUS_O:switch(Q){case a3$.cc.K:case a3$.cc.k:this.state=a3$.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PLUS_OK:switch(Q){case a3$.cc.NL:this.dispatcher.push({kind:a3$.Kind.OK}),this.drop=0,this.state=a3$.State.OP_START;break}break;case a3$.State.OP_MINUS:switch(Q){case a3$.cc.E:case a3$.cc.e:this.state=a3$.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MINUS_E:switch(Q){case a3$.cc.R:case a3$.cc.r:this.state=a3$.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MINUS_ER:switch(Q){case a3$.cc.R:case a3$.cc.r:this.state=a3$.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MINUS_ERR:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:this.state=a3$.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_MINUS_ERR_SPC:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:continue;default:this.state=a3$.State.MINUS_ERR_ARG,this.as=Z}break;case a3$.State.MINUS_ERR_ARG:switch(Q){case a3$.cc.CR:this.drop=1;break;case a3$.cc.NL:{let Y;if(this.argBuf)Y=this.argBuf.bytes(),this.argBuf=void 0;else Y=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:a3$.Kind.ERR,data:Y}),this.drop=0,this.as=Z+1,this.state=a3$.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(Q))}break;case a3$.State.OP_P:switch(Q){case a3$.cc.I:case a3$.cc.i:this.state=a3$.State.OP_PI;break;case a3$.cc.O:case a3$.cc.o:this.state=a3$.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PO:switch(Q){case a3$.cc.N:case a3$.cc.n:this.state=a3$.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PON:switch(Q){case a3$.cc.G:case a3$.cc.g:this.state=a3$.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PONG:switch(Q){case a3$.cc.NL:this.dispatcher.push({kind:a3$.Kind.PONG}),this.drop=0,this.state=a3$.State.OP_START;break}break;case a3$.State.OP_PI:switch(Q){case a3$.cc.N:case a3$.cc.n:this.state=a3$.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PIN:switch(Q){case a3$.cc.G:case a3$.cc.g:this.state=a3$.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_PING:switch(Q){case a3$.cc.NL:this.dispatcher.push({kind:a3$.Kind.PING}),this.drop=0,this.state=a3$.State.OP_START;break}break;case a3$.State.OP_I:switch(Q){case a3$.cc.N:case a3$.cc.n:this.state=a3$.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_IN:switch(Q){case a3$.cc.F:case a3$.cc.f:this.state=a3$.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_INF:switch(Q){case a3$.cc.O:case a3$.cc.o:this.state=a3$.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_INFO:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:this.state=a3$.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case a3$.State.OP_INFO_SPC:switch(Q){case a3$.cc.SPACE:case a3$.cc.TAB:continue;default:this.state=a3$.State.INFO_ARG,this.as=Z}break;case a3$.State.INFO_ARG:switch(Q){case a3$.cc.CR:this.drop=1;break;case a3$.cc.NL:{let Y;if(this.argBuf)Y=this.argBuf.bytes(),this.argBuf=void 0;else Y=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:a3$.Kind.INFO,data:Y}),this.drop=0,this.as=Z+1,this.state=a3$.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;default:throw this.fail($.subarray(Z))}}if((this.state===a3$.State.MSG_ARG||this.state===a3$.State.MINUS_ERR_ARG||this.state===a3$.State.INFO_ARG)&&!this.argBuf)this.argBuf=new h41.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===a3$.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new h41.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,Q=new Uint8Array($+Z);if(Q.set(this.ma.subject),this.ma.reply)Q.set(this.ma.reply,$);if(this.argBuf=new h41.DenoBuffer(Q),this.ma.subject=Q.subarray(0,$),this.ma.reply)this.ma.reply=Q.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],Q=-1;for(let Y=0;Y<$.length;Y++)switch($[Y]){case a3$.cc.SPACE:case a3$.cc.TAB:case a3$.cc.CR:case a3$.cc.NL:if(Q>=0)Z.push($.subarray(Q,Y)),Q=-1;break;default:if(Q<0)Q=Y}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],wc);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],wc);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${u41.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],Q=-1;for(let Y=0;Y<$.length;Y++)switch($[Y]){case a3$.cc.SPACE:case a3$.cc.TAB:case a3$.cc.CR:case a3$.cc.NL:if(Q>=0)Z.push($.subarray(Q,Y)),Q=-1;break;default:if(Q<0)Q=Y}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],wc),this.ma.size=this.protoParseInt(Z[3],wc);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],wc),this.ma.size=this.protoParseInt(Z[4],wc);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let Q=0;for(let Y=0;Y<$.length;Y++){if($[Y]<t3$||$[Y]>rw4)return-1;Q=Q*10+($[Y]-t3$)}return Z!==void 0&&Q>Z?-1:Q}}a3$.Parser=o3$;a3$.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};a3$.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var _K0=b((s3$)=>{Object.defineProperty(s3$,"__esModule",{value:!0});s3$.MsgHdrsImpl=void 0;s3$.canonicalMIMEHeaderKey=m41;s3$.headers=$E4;var r3$=sG(),wH=nj(),SK0=eG();function m41($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw SK0.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function $E4($=0,Z=""){if($===0&&Z!=="")throw SK0.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw SK0.InvalidArgumentError.format("description","is required");return new Ec($,Z)}var c41="NATS/1.0";class Ec{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,Q]of this.headers){let Y=$.values(Z);if(Q.length!==Y.length)return!1;let X=[...Q].sort(),J=[...Y].sort();for(let G=0;G<X.length;G++)if(X[G]!==J[G])return!1}return!0}return!1}static decode($){let Z=new Ec,Y=r3$.TD.decode($).split(`\r
 `),X=Y[0];if(X!==c41){let J=X.replace(c41,"").trim();if(J.length>0){if(Z._code=parseInt(J,10),isNaN(Z._code))Z._code=0;let G=Z._code.toString();J=J.replace(G,""),Z._description=J.trim()}}if(Y.length>=1)Y.slice(1).map((J)=>{if(J){let G=J.indexOf(":");if(G>-1){let W=J.slice(0,G),K=J.slice(G+1).trim();Z.append(W,K)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=c41;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,Q]of this.headers)for(let Y=0;Y<Q.length;Y++)$=`${$}\r
 ${Z}: ${Q[Y]}`;return`${$}\r
@@ -3121,7 +3121,7 @@ ${O$}`,...W$[O9].promptCacheBreakpoint!=null&&{prompt_cache_breakpoint:W$[O9].pr
   `.execute($)).rows[0]?.exists)await R6`CREATE ROLE ${R6.id(Q)} NOLOGIN`.execute($);await R6`GRANT ${R6.id(Q)} TO CURRENT_USER`.execute($),await R6`GRANT USAGE, CREATE ON SCHEMA ${R6.id(Z)} TO ${R6.id(Q)}`.execute($),await R6`GRANT ALL ON ALL TABLES IN SCHEMA ${R6.id(Z)} TO ${R6.id(Q)}`.execute($),await R6`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${R6.id(Z)} TO ${R6.id(Q)}`.execute($),await R6`ALTER DEFAULT PRIVILEGES IN SCHEMA ${R6.id(Z)} GRANT ALL ON TABLES TO ${R6.id(Q)}`.execute($),await R6`ALTER DEFAULT PRIVILEGES IN SCHEMA ${R6.id(Z)} GRANT ALL ON SEQUENCES TO ${R6.id(Q)}`.execute($),await R6`REVOKE ALL ON SCHEMA public FROM ${R6.id(Q)}`.execute($)}async function YJ6($,Z,Q,Y){try{return await $.transaction().execute(async(X)=>{return await R6`SET LOCAL ROLE ${R6.id(Q)}`.execute(X),await R6`SET LOCAL search_path TO ${R6.id(Z)}`.execute(X),await R6.raw(Y).execute(X)})}catch(X){if(ZJ6(X))return await QJ6($,Z,Q),await $.transaction().execute(async(J)=>{return await R6`SET LOCAL ROLE ${R6.id(Q)}`.execute(J),await R6`SET LOCAL search_path TO ${R6.id(Z)}`.execute(J),await R6.raw(Y).execute(J)});throw X}}var aX6,sX6,Ug$;var Ng$=L(()=>{_0();aX6=AN.object({results:AN.array(AN.unknown()).optional(),success:AN.boolean().optional()});sX6=AN.object({sql:AN.string().describe("The SQL query to run"),params:AN.array(AN.unknown()).describe("The parameters to pass to the SQL query").optional()});Ug$=m({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:sX6,outputSchema:AN.object({result:AN.array(aX6)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=rX6($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Y=eX6(Z.connectionId),X=$J6(Z.connectionId);return{result:[{results:(await YJ6(Z.db,Y,X,Q)).rows,success:!0}]}}})});function sD0($){let Z=$.access.getRole();if(!mZ(Z))throw new HQ("Only organization owners and admins can change org-wide pin status")}var RK1=L(()=>{fY();fH()});async function eD0($,Z,Q){let Y=[...new Set(Q)],X=await Promise.all(Y.map((G)=>$.storage.connections.findById(G,Z))),J=Y.filter((G,W)=>!X[W]);if(J.length>0)throw Error(`Connection not found: ${J.join(", ")}`)}function wD($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function $O0($){let Z=2166136261;for(let Q=0;Q<$.length;Q++)Z=Math.imul(Z^$.charCodeAt(Q),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function ZO0($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function QO0($,Z){if(!Z)return $;let Q=`${$O0(Z)}_`;return $.startsWith(Q)?$.slice(Q.length):$}function JJ6($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}function GJ6($,Z,Q){let Y,X=new Promise((J,G)=>{Y=setTimeout(()=>G(Error(Q)),Z)});return Promise.race([$,X]).finally(()=>clearTimeout(Y))}var wR;var Bg$=L(()=>{hU();wR=class wR extends K7{static MAX_PAGES_PER_CLIENT=1000;static DEFAULT_LIST_TIMEOUT_MS=30000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;listTimeoutMs;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$,this.listTimeoutMs=Z?.listTimeoutMs??wR.DEFAULT_LIST_TIMEOUT_MS;for(let Q of Object.keys($)){let Y=$O0(Q);if(this.slugToKey.has(Y))throw Error(`GatewayClient: duplicate namespace code "${Y}" from keys "${this.slugToKey.get(Y)}" and "${Q}"`);this.slugToKey.set(Y,Q)}}namespace($,Z){return`${$O0($)}_${Z}`}async resolveNamespacedTarget($,Z,Q){let Y=$.indexOf("_");if(Y!==-1){let X=$.slice(0,Y),J=this.slugToKey.get(X);if(J)return[J,$.slice(Y+1)]}for(let X of await Q()){let J=ZO0(X._meta);if(!J)continue;if(QO0(X.name,J)===$)return[J,$]}if(Y===-1)throw Error(`GatewayClient: could not resolve ${Z} "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Y)}" in "${$}" and not found by original name in any client`)}resolveToolTarget($){return this.resolveNamespacedTarget($,"tool",async()=>(await this.listTools()).tools)}resolvePromptTarget($){return this.resolveNamespacedTarget($,"prompt",async()=>(await this.listPrompts()).prompts)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let Q=this.clients[$];if(!Q)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Y=Q.client,X;try{X=typeof Y==="function"?Promise.resolve(Y()):Promise.resolve(Y)}catch(G){return Promise.reject(G)}let J=X.catch((G)=>{throw this.resolvedClients.delete($),G});return this.resolvedClients.set($,J),J}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,Q){try{return await GJ6((async()=>{let Y=await this.resolveClient($);return await Z(Y)})(),this.listTimeoutMs,`timed out after ${this.listTimeoutMs}ms`)}catch(Y){return console.warn(`GatewayClient: skipping ${Q} from client "${$}" \u2014 ${Y?.message??Y}`),[]}}listFromAllClients($,Z){return Promise.all(Object.entries(this.clients).map(async([Q,Y])=>[Q,Y,await this.listFromClient(Q,(X)=>$(X,Q),Z)]))}async paginate($,Z,Q){let Y=[],X,J=0;do{let G=await Q(X);Y.push(...G.items),X=G.nextCursor,J++}while(X&&J<wR.MAX_PAGES_PER_CLIENT);if(X)console.warn(`GatewayClient: client "${$}" exceeded ${wR.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Y}fetchAllTools($,Z){return this.paginate(Z,"tools",async(Q)=>{let Y=await $.listTools(Q?{cursor:Q}:void 0);return{items:Y.tools,nextCursor:Y.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(Q)=>{let Y=await $.listResources(Q?{cursor:Q}:void 0);return{items:Y.resources,nextCursor:Y.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(Q)=>{let Y=await $.listResourceTemplates(Q?{cursor:Q}:void 0);return{items:Y.resourceTemplates,nextCursor:Y.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(Q)=>{let Y=await $.listPrompts(Q?{cursor:Q}:void 0);return{items:Y.prompts,nextCursor:Y.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[],Z=await this.listFromAllClients((Q,Y)=>this.fetchAllTools(Q,Y),"tools");for(let[Q,Y,X]of Z){let J=Y.tools,G=J?new Set(J):null;for(let W of X){if(G&&!G.has(W.name))continue;$.push({...W,name:this.namespace(Q,W.name),_meta:{...W._meta??{},gatewayClientId:Q}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],Q=new Map,Y=await this.listFromAllClients((X,J)=>this.fetchAllResources(X,J),"resources");for(let[X,J,G]of Y){let W=J.resources,K=W?new Set(W):null;for(let H of G){if(K&&!K.has(H.uri)&&!(H.name&&K.has(H.name)))continue;if($.has(H.uri)){console.warn(`GatewayClient: duplicate resource "${H.uri}" from client "${X}" \u2014 skipping`);continue}$.add(H.uri),Q.set(H.uri,X),Z.push({...H,_meta:{...H._meta??{},gatewayClientId:X}})}}return this.resourceRouteMap=Q,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[],Q=await this.listFromAllClients((Y,X)=>this.fetchAllResourceTemplates(Y,X),"resource templates");for(let[Y,X,J]of Q)for(let G of J){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${Y}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:Y}})}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[],Z=await this.listFromAllClients((Q,Y)=>this.fetchAllPrompts(Q,Y),"prompts");for(let[Q,Y,X]of Z){let J=Y.prompts,G=J?new Set(J):null;for(let W of X){if(G&&!G.has(W.name))continue;$.push({...W,name:this.namespace(Q,W.name),title:W.title??JJ6(W.name),_meta:{...W._meta??{},gatewayClientId:Q}})}}return{prompts:$}}async callTool($,Z,Q){let[Y,X]=await this.resolveToolTarget($.name);return(await this.resolveClient(Y)).callTool({...$,name:X},Z,Q)}async readResource($,Z){let Q=await this.resolveResourceRoute($.uri);return(await this.resolveClient(Q)).readResource($)}async getPrompt($,Z){let[Q,Y]=await this.resolvePromptTarget($.name);return(await this.resolveClient(Q)).getPrompt({...$,name:Y})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((Q)=>Q.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var YO0=L(()=>{Bg$()});function MK1($){return wD($)}function KJ6($,Z){let Q=wD(Z)||"prompt";return`${String($).padStart(WJ6,"0")}-${Q}`}async function IK1($,Z,Q){try{await $.delete(XO0,MK1(Z),{actor:Q})}catch(Y){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Y})}}async function JO0($,Z,Q,Y){let X=MK1(Z);await IK1($,Z,Q),await Promise.all(Y.slice(0,qK1).map(async(J,G)=>{let W=KJ6(G,J.title),K={name:W,title:J.title,description:J.description,text:J.text};try{await $.write(XO0,`${X}/${W}.json`,JSON.stringify(K),{actor:Q,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function Lg$($,Z){let Q=MK1(Z),Y;try{Y=await $.listDir(XO0,Q)}catch{return[]}let X=Y.filter((G)=>G.kind==="file"&&G.path.endsWith(".json")).slice(0,qK1),J=[];for(let G of X)try{let W=await $.read(XO0,G.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")J.push(K)}catch{}return J}var XO0="agent-prompts",qK1=20,WJ6;var G40=L(()=>{YO0();WJ6=String(qK1-1).length});function ri($){if(!$)return $;let Z={...$};return delete Z.sandboxMap,Z}import{z as jg$}from"zod";function HJ6(){let $=Dg$[Math.floor(Math.random()*Dg$.length)];return`icon://${Og$[Math.floor(Math.random()*Og$.length)]}?color=${$}`}var Dg$,Og$,FJ6,UJ6,ER;var VK1=L(()=>{_0();iE();RK1();G40();Dg$=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],Og$=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];FJ6=jg$.object({data:LH0.describe("Data for the new virtual MCP")}),UJ6=jg$.object({item:kY.describe("The created virtual MCP entity")}),ER=m({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:FJ6,outputSchema:UJ6,handler:async($,Z)=>{o(Z);let Q=W0(Z);await Z.access.check();let Y=t0(Z);if(!Y)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)sD0(Z);let{prompts:X,metadata:J,...G}=$.data,W=ri(J);if(G.connections.length>0)await eD0(Z,Q.id,G.connections.map((F)=>F.connection_id));let K={...G,metadata:W,icon:G.icon??HJ6()},H=await Z.storage.virtualMcps.create(Q.id,Y,K);if(X?.length&&Z.orgFs&&H.id)await JO0(Z.orgFs,H.id,Y,X);return{item:H}}})});function kK1($){if(!$)return null;let Z=$.projects;return Array.isArray(Z)?Z:null}function RN($,Z){if($===null)return!0;if($.includes("*"))return!0;return $.includes(Z)}async function qN($){if($.auth.apiKey)return null;let Z=$.organization?.id;if(!Z)return null;let Q=$.access.getRole()??$.organization?.role??$.auth.user?.role;if(!Q||mZ(Q))return null;if($.auth.permissions&&$.auth.permissionsOrganizationId===Z)return kK1($.auth.permissions);let Y=await zR($.db,Z,Q);return kK1(Y)}var si=L(()=>{fY();MN()});function tE($){return typeof $==="string"||typeof $==="number"}function CK1($,Z){let Q=Z.split("."),Y=$;for(let X of Q){if(Y==null||typeof Y!=="object")return;Y=Y[X]}return Y}function NJ6($,Z){return $.connections.some((Q)=>Q.connection_id===Z)}function GO0($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;if(K.length===0)return!0;switch(W){case"and":return K.every((H)=>GO0($,H));case"or":return K.some((H)=>GO0($,H));case"not":return!K.every((H)=>GO0($,H));default:return!0}}let{field:Q,operator:Y,value:X}=Z,J=Q.join(".");if(J==="connection_id"){if(Y!=="eq"||typeof X!=="string")return!1;return NJ6($,X)}let G=CK1($,J);switch(Y){case"eq":return G===X;case"gt":return tE(G)&&tE(X)&&G>X;case"gte":return tE(G)&&tE(X)&&G>=X;case"lt":return tE(G)&&tE(X)&&G<X;case"lte":return tE(G)&&tE(X)&&G<=X;case"in":return Array.isArray(X)&&X.includes(G);case"like":if(typeof G!=="string"||typeof X!=="string")return!1;if(X.length>100)return!1;return ii(X).test(G);case"contains":if(typeof G!=="string"||typeof X!=="string")return!1;return G.toLowerCase().includes(X.toLowerCase());default:return!0}}function BJ6($,Z){return[...$].sort((Q,Y)=>{for(let X of Z){let J=X.field.join("."),G=CK1(Q,J),W=CK1(Y,J),K=0;if(G==null&&W==null)continue;if(G==null)K=X.nulls==="first"?-1:1;else if(W==null)K=X.nulls==="first"?1:-1;else if(typeof G==="string"&&typeof W==="string")K=G.localeCompare(W);else if(typeof G==="number"&&typeof W==="number")K=G-W;else K=String(G).localeCompare(String(W));if(K!==0)return X.direction==="desc"?-K:K}return 0})}var LJ6,DJ6,PR;var SK1=L(()=>{GG();_0();si();iE();LJ6=HF,DJ6=OD(kY),PR=m({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LJ6,outputSchema:DJ6,handler:async($,Z)=>{await Z.access.check();let Q=W0(Z),Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,X=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,G=Y?await Z.storage.virtualMcps.listByConnectionId(Q.id,Y):await Z.storage.virtualMcps.list(Q.id,X!==void 0?{pinnedOnly:X}:void 0);if($.where)G=G.filter((B)=>GO0(B,$.where));let W=await qN(Z);if(W!==null)G=G.filter((B)=>RN(W,B.id));if($.orderBy&&$.orderBy.length>0)G=BJ6(G,$.orderBy);let K=G.length,H=$.offset??0,F=$.limit??100,U=G.slice(H,H+F),N=H+F<K;return{items:U,totalCount:K,hasMore:N}}})});import{z as _K1}from"zod";var OJ6,jJ6,TR;var vK1=L(()=>{_0();si();iE();OJ6=_K1.object({id:_K1.string().describe("ID of the virtual MCP to retrieve")}),jJ6=_K1.object({item:kY.nullable().describe("The retrieved virtual MCP, or null if not found")}),TR=m({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:OJ6,outputSchema:jJ6,handler:async($,Z)=>{o(Z);let Q=W0(Z);await Z.access.check();let Y=await Z.storage.virtualMcps.findById($.id);if(Y&&Y.organization_id!==Q.id)return{item:null};if(!Y)return{item:null};let X=await qN(Z);if(!RN(X,Y.id))return{item:null};return{item:Y}}})});function kZ($){return xK1.test($)}function AR($){let Z=(Q)=>typeof Q==="string"?Q.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}function wg$($){let Z=typeof $?.metadata?.analyticsSiteSlug==="string"?$.metadata.analyticsSiteSlug.trim().toLowerCase():"";if(Z&&kZ(Z))return Z;return AR($)}var xK1;var C3=L(()=>{xK1=/^[a-z0-9][a-z0-9-]{0,59}$/});function Eg$($){let{nextTitle:Z,currentTitle:Q,currentSiteSlug:Y}=$;if(Y?.trim())return null;if(Z===void 0||Z===Q)return null;let X=Q?.trim().toLowerCase()??"";return kZ(X)?X:null}var zg$=L(()=>{C3()});import{z as fK1}from"zod";var wJ6,EJ6,RR;var bK1=L(()=>{_0();si();G40();iE();RK1();zg$();wJ6=fK1.object({id:fK1.string().describe("ID of the virtual MCP to update"),data:DH0.describe("Partial virtual MCP data to update")}),EJ6=fK1.object({item:kY.describe("The updated virtual MCP entity")}),RR=m({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:wJ6,outputSchema:EJ6,handler:async($,Z)=>{o(Z);let Q=W0(Z);await Z.access.check();let Y=t0(Z);if(!Y)throw Error("User ID required to update virtual MCP");let X=await Z.storage.virtualMcps.findById($.id);if(!X)throw Error(`Virtual MCP not found: ${$.id}`);if(X.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${$.id}`);let J=await qN(Z);if(!RN(J,X.id))throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,metadata:W,...K}=$.data,H=ri(W);if(H&&X.metadata)H={...X.metadata,...H};else if(H===null&&X.metadata?.sandboxMap)H={sandboxMap:X.metadata.sandboxMap};let F={...K,...W!==void 0?{metadata:H}:{}},U=Eg$({nextTitle:F.title,currentTitle:X.title,currentSiteSlug:X.metadata?.siteSlug});if(U)F.metadata={...X.metadata,...F.metadata,siteSlug:U};if(F.pinned!==void 0&&F.pinned!==X.pinned)sD0(Z);if(F.connections?.length)await eD0(Z,Q.id,F.connections.map((B)=>B.connection_id));let N=await Z.storage.virtualMcps.update($.id,Y,F);if(G!==void 0&&Z.orgFs)await JO0(Z.orgFs,$.id,Y,G);return{item:N}}})});function gK1($){if(!$)return!1;let Z=W40.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function Pg$($){let Z={...$};for(let Q of W40)Z[Q]="read";return Z}async function Tg$($,Z){let Q={...Z};for(;;){let Y=await $(Q);if(!Y.isError)return{result:Y,grantedPermissions:Q};let X=Y.content?.find((K)=>K.type==="text")?.text,J=W40.find((K)=>(K in Q));if(!J||!gK1(X))return{result:Y,grantedPermissions:Q};let{[J]:G,...W}=Q;Q=W}}function zJ6($){if(!$||typeof $!=="object"||Array.isArray($))return WO0;let Z=$;if(Object.values(Z).some((Q)=>typeof Q!=="string"))return WO0;return Z}function PJ6($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function XZ($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let Q=PJ6(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:Q,owner:Z.owner,repo:Z.repo,permissions:zJ6(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function oE($){return $.metadata?.orgShared===!0}function Ag$($){let Z=new Set,Q=[];for(let Y of $??[]){if(Y.status!=="active")continue;let X=XZ(Y);if(X===null)continue;let J=yK1(X.owner,X.repo);if(Z.has(J))continue;Z.add(J),Q.push(`${X.owner}/${X.repo}`)}return Q}function KO0($,Z,Q){let Y=yK1(Z,Q),X=($??[]).filter((J)=>{if(J.status&&J.status!=="active")return!1;let G=XZ(J);return G!==null&&yK1(G.owner,G.repo)===Y});return X.find(oE)??X[0]??null}var WO0,W40,yK1=($,Z)=>`${$}/${Z}`.toLowerCase();var WG=L(()=>{WO0={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read",statuses:"read"},W40=["statuses","deployments","checks"]});function Rg$($){return dQ($)!==null||hH0($)!==null}var qg$=L(()=>{r8()});import{z as hK1}from"zod";var TJ6,AJ6,qR;var uK1=L(()=>{WG();FF();_0();si();G40();iE();qg$();TJ6=hK1.object({id:hK1.string().describe("ID of the virtual MCP to delete")}),AJ6=hK1.object({item:kY.describe("The deleted virtual MCP entity")}),qR=m({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:TJ6,outputSchema:AJ6,handler:async($,Z)=>{o(Z);let Q=W0(Z);if(await Z.access.check(),Rg$($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${$.id}`);let X=await qN(Z);if(!RN(X,Y.id))throw Error(`Virtual MCP not found: ${$.id}`);if(await Z.storage.virtualMcps.delete($.id),Z.orgFs)await IK1(Z.orgFs,$.id,t0(Z)??"system");let J=Y.metadata?.repository?.connectionId;if(J)try{let G=await Z.storage.connections.findById(J,Q.id),W=G&&(oE(G)||(await Z.storage.virtualMcps.listByConnectionId(Q.id,J)).length>0||await Z.storage.connections.isReferencedByThread(J));if(G&&XZ(G)&&!W){let H=await new V9(Z.db,Z.vault).get(J);if(H?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${H.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(J)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:J,error:G.message})}return{item:Y}}})});function Mg$($,Z){let Q=$!==null&&typeof $==="object"&&!Array.isArray($)?$:null;if(Z===void 0)return Q;return{...Q??{},...Z}}import{z as rX}from"zod";var RJ6,MR;var lK1=L(()=>{_0();si();iE();RJ6=rX.object({connectionId:rX.string(),toolName:rX.string(),label:rX.string(),icon:rX.string().nullable().optional()}),MR=m({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:rX.object({virtualMcpId:rX.string().describe("Virtual MCP ID"),pinnedViews:rX.array(RJ6).describe("Pinned views to set for the virtual MCP sidebar"),layout:rX.object({defaultMainView:rX.object({type:rX.string(),id:rX.string().optional(),toolName:rX.string().optional()}).nullable().optional(),chatDefaultOpen:rX.boolean().nullable().optional()}).optional()}),outputSchema:rX.object({item:kY.nullable()}),handler:async($,Z)=>{o(Z);let Q=W0(Z);await Z.access.check();let{virtualMcpId:Y,pinnedViews:X,layout:J}=$,G=t0(Z),W=await Z.storage.virtualMcps.findById(Y);if(!W)throw Error(`Virtual MCP not found: ${Y}`);if(W.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${Y}`);let K=await qN(Z);if(!RN(K,W.id))throw Error(`Virtual MCP not found: ${Y}`);let H=W.metadata?.ui??{},F={...H,pinnedViews:X.length>0?X:null,layout:Mg$(H.layout,J)};return{item:await Z.storage.virtualMcps.update(Y,G??"system",{metadata:{...W.metadata,ui:F}})}}})});import{z as ED}from"zod";var qJ6,MJ6,cK1;var Ig$=L(()=>{_0();qJ6=ED.object({ids:ED.array(ED.string()).max(1000).describe("Virtual MCP ids to look up")}),MJ6=ED.object({items:ED.array(ED.object({id:ED.string(),last_used_at:ED.string().optional(),last_used_by:ED.string().optional()}))}),cK1=m({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:qJ6,outputSchema:MJ6,handler:async($,Z)=>{o(Z),W0(Z),await Z.access.check();let Q=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Y)=>({id:Y,last_used_at:Q.get(Y)?.last_used_at,last_used_by:Q.get(Y)?.last_used_by}))}}})});var Vg$=L(()=>{VK1();SK1();vK1();bK1();uK1();lK1();Ig$()});import{z as oY}from"zod";var mK1;var kg$=L(()=>{f6();_0();mK1=m({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:oY.object({startDate:oY.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:oY.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:oY.array(oY.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:oY.array(oY.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:oY.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:oY.object({cells:oY.array(oY.object({virtualMcpId:oY.string().nullable(),toolName:oY.string(),calls:oY.number(),errors:oY.number(),outputSize:oY.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let Q=W0(Z);return await Z.access.check(),await kJ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:Q.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as k9}from"zod";var dK1;var Cg$=L(()=>{f6();_0();dK1=m({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:k9.object({id:k9.string().describe("Log ID to fetch")}),outputSchema:k9.object({log:k9.object({id:k9.string().optional(),organizationId:k9.string(),connectionId:k9.string(),toolName:k9.string(),input:k9.record(k9.string(),k9.unknown()),output:k9.record(k9.string(),k9.unknown()),isError:k9.boolean(),errorMessage:k9.string().nullish(),durationMs:k9.number(),timestamp:k9.string(),userId:k9.string().nullish(),requestId:k9.string(),userAgent:k9.string().nullish(),virtualMcpId:k9.string().nullish(),properties:k9.record(k9.string(),k9.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await kJ();let Q=W0(Z),Y=await Z.storage.monitoring.getById(Q.id,$.id);if(!Y)return{log:null};return{log:{...Y,timestamp:Y.timestamp instanceof Date?Y.timestamp.toISOString():Y.timestamp}}}})});import{z as e8}from"zod";var VJ6,iK1;var Sg$=L(()=>{f6();_0();VJ6=e8.object({id:e8.string().optional().describe("Unique log identifier"),organizationId:e8.string().describe("Organization ID"),connectionId:e8.string().describe("Connection ID"),toolName:e8.string().describe("Name of the tool that was called"),isError:e8.boolean().describe("Whether the call resulted in an error"),errorMessage:e8.string().nullish().describe("Error message if applicable"),durationMs:e8.number().describe("Call duration in milliseconds"),timestamp:e8.string().describe("ISO 8601 timestamp of the call"),userId:e8.string().nullish().describe("User who triggered the call"),requestId:e8.string().describe("Unique request identifier"),userAgent:e8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:e8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:e8.record(e8.string(),e8.string()).nullish().describe("Custom key-value metadata attached to the log")}),iK1=m({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:e8.object({connectionId:e8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:e8.array(e8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:e8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:e8.string().optional().describe("Filter by tool name"),isError:e8.boolean().optional().describe("Filter by error status"),startDate:e8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:e8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:e8.number().default(20).describe("Maximum number of results"),offset:e8.number().default(0).describe("Offset for pagination"),properties:e8.record(e8.string(),e8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:e8.array(e8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:e8.record(e8.string(),e8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:e8.record(e8.string(),e8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:e8.object({logs:e8.array(VJ6).describe("Array of monitoring logs"),total:e8.number().describe("Total number of logs matching filters"),offset:e8.number().describe("Current offset for pagination"),limit:e8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await kJ();let Q=W0(Z),X=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,J={organizationId:Q.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:X},G=await Z.storage.monitoring.query(J);return{logs:G.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:G.total,offset:$.offset,limit:$.limit}}})});import{z as f$}from"zod";var pK1;var _g$=L(()=>{f6();_0();pK1=m({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:f$.object({startDate:f$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:f$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:f$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:f$.array(f$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:f$.array(f$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:f$.array(f$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:f$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:f$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:f$.array(f$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:f$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:f$.object({totalCalls:f$.number().describe("Total number of tool calls"),errorRate:f$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:f$.number().describe("Average call duration in milliseconds"),errorRatePercent:f$.string().optional().describe("Error rate as a percentage string"),totalErrors:f$.number().optional().describe("Total number of errors"),p50DurationMs:f$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:f$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:f$.array(f$.object({connectionId:f$.string(),calls:f$.number(),errors:f$.number(),errorRate:f$.number(),avgDurationMs:f$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:f$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:f$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:f$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:f$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:f$.array(f$.object({toolName:f$.string(),connectionId:f$.string().nullable(),calls:f$.number(),inputTokens:f$.number().optional(),outputTokens:f$.number().optional(),costUsd:f$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:f$.array(f$.object({timestamp:f$.string(),toolName:f$.string(),calls:f$.number(),errors:f$.number(),avg:f$.number(),p95:f$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:f$.array(f$.object({timestamp:f$.string(),calls:f$.number(),errors:f$.number(),errorRate:f$.number(),avg:f$.number(),p50:f$.number(),p95:f$.number(),inputTokens:f$.number().optional(),outputTokens:f$.number().optional(),totalTokens:f$.number().optional(),costUsd:f$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let Q=W0(Z);if(await Z.access.check(),await kJ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:Q.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let X=await Z.storage.monitoring.queryMetricTimeseries({organizationId:Q.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return X;let J=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:Q.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...X,topTools:J.topTools,topToolsTimeseries:J.timeseries}}let Y=await Z.storage.monitoring.getStats({organizationId:Q.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Y,errorRatePercent:(Y.errorRate*100).toFixed(2)}}})});import{z as sX}from"zod";var nK1;var vg$=L(()=>{f6();_0();nK1=m({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:sX.object({threadIds:sX.array(sX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:sX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:sX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:sX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:sX.object({items:sX.array(sX.object({threadId:sX.string(),calls:sX.number(),inputTokens:sX.number(),outputTokens:sX.number(),totalTokens:sX.number(),costUsd:sX.number()}))}),handler:async($,Z)=>{let Q=W0(Z);return await Z.access.check(),await kJ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:Q.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var xg$=L(()=>{kg$();Cg$();Sg$();_g$();vg$()});function HO0($){return typeof $==="string"&&CJ6.has($.trim().toLowerCase())}var CJ6;var tK1=L(()=>{CJ6=new Set([".well-known","_admin","_users","api","auth","choose-editor","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reports-onboarding","reset-password"])});import{z as S3}from"zod";var oK1;var fg$=L(()=>{_0();tK1();oK1=m({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:S3.object({slug:S3.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!HO0($),"Slug is reserved by Studio"),name:S3.string().min(1).max(255),description:S3.string().max(500).optional()}),outputSchema:S3.object({id:S3.string(),name:S3.string(),slug:S3.string(),logo:S3.string().nullable().optional(),metadata:S3.any().optional(),createdAt:S3.string().datetime().describe("ISO 8601 timestamp"),members:S3.array(S3.any()).optional()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=t0(Z);if(!Q)throw Error("User ID required to create organization");let Y=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:Q});if(!Y)throw Error("Failed to create organization");return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as IN}from"zod";var aK1;var bg$=L(()=>{_0();aK1=m({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:IN.object({}),outputSchema:IN.object({organizations:IN.array(IN.object({id:IN.string(),name:IN.string(),slug:IN.string(),logo:IN.string().nullable().optional(),metadata:IN.any().optional(),createdAt:IN.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(o(Z),await Z.access.check(),!t0(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Y)=>({...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}))}}})});import{z as LK}from"zod";var rK1;var yg$=L(()=>{_0();rK1=m({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LK.object({}),outputSchema:LK.object({id:LK.string(),name:LK.string(),slug:LK.string(),logo:LK.string().nullable().optional(),metadata:LK.any().optional(),createdAt:LK.string().datetime().describe("ISO 8601 timestamp"),members:LK.array(LK.any()).optional(),invitations:LK.array(LK.any()).optional()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.boundAuth.organization.get(Q);if(!Y)throw Error("No active organization found");let X=new Date,J=Y.invitations?.filter((G)=>new Date(G.expiresAt)>X);return{...Y,invitations:J,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as UF}from"zod";var sK1;var gg$=L(()=>{_0();sK1=m({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:UF.object({id:UF.string(),name:UF.string().min(1).max(255).optional(),description:UF.string().max(500).optional()}),outputSchema:UF.object({id:UF.string(),name:UF.string(),slug:UF.string(),logo:UF.string().nullable().optional(),metadata:UF.any().optional(),createdAt:UF.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(o(Z),await Z.access.check(),$.id!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q={};if($.name)Q.name=$.name;if($.description!==void 0){let X=await Z.boundAuth.organization.get($.id);Q.metadata={...X?.metadata,description:$.description}}let Y=await Z.boundAuth.organization.update({organizationId:$.id,data:Q});if(!Y)throw Error("Failed to update organization");return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{sql as SJ6}from"kysely";import{z as K40}from"zod";var eK1;var hg$=L(()=>{r8();_0();SD0();eK1=m({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:K40.object({id:K40.string()}),outputSchema:K40.object({success:K40.boolean(),id:K40.string()}),handler:async($,Z)=>{if(o(Z),await Z.access.check(),$.id!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=(await Z.boundAuth.organization.get($.id))?.metadata??{};if(Y.archived===!0)return{success:!0,id:$.id};let X=await Z.storage.connections.findById(K4.REPORTS($.id),$.id);await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...Y,archived:!0,archivedAt:new Date().toISOString()}}}),await SJ6`
       update session set "activeOrganizationId" = null
       where "activeOrganizationId" = ${$.id}
-    `.execute(Z.db);let J=X?.metadata?.siteUrl;if(typeof J==="string")mi({siteUrl:J,orgId:$.id,cause:"organization_deleted"});return{success:!0,id:$.id}}})});import{z as F$}from"zod";function CZ($,Z){let Q=$?.[Z];return vJ6.has(Z)?Q!==!1:Q===!0}function cg$($){let Z=$?.auto_resolve_conflicts;return typeof Z==="boolean"?Z:$?.auto_merge===!0}var PD=500,H40,zD,ug$,aE,F40,U40,lg$=50,_J6,N40,B40,IR,vJ6,FO0=262144,xJ6=50,_3=500,fJ6=5000,rE;var JZ=L(()=>{H40=F$.object({title:F$.string().max(PD),url:F$.string().max(PD),icon:F$.string().max(PD)}),zD=F$.object({keyId:F$.string().max(PD),modelId:F$.string().max(PD),title:F$.string().max(PD).optional()}).nullable(),ug$=F$.enum(["fast","smart","thinking","image","web_search","deep_research"]),aE=F$.enum(["fast","smart","thinking"]),F40=F$.object({tiers:F$.object({fast:zD,smart:zD,thinking:zD,image:zD,web_search:zD,deep_research:zD})}),U40=F$.object({tiers:F$.object({fast:zD.optional(),smart:zD.optional(),thinking:zD.optional()})}),_J6=/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/,N40=F$.object({host:F$.string().min(1).max(PD).regex(_J6).describe("Git host, e.g. 'github.com' (bare hostname, no scheme)."),secretId:F$.string().min(1).max(PD).describe("Vault secret id holding the PAT used to authenticate this host.")}),B40=F$.object({ids:F$.array(F$.string().max(PD)).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),IR=F$.object({voice_mode:F$.boolean().optional(),home_task_intake_enabled:F$.boolean().optional().describe("Show Task mode on the Home composer and allow reports to start tasks."),demo_mode:F$.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:F$.boolean().optional().describe("Curated Deco Score look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),reviewer_enabled:F$.boolean().optional().describe("Run the Reviewer on a task's pull request once it's In Review \u2014 it reviews the code with the repo's stack-appropriate skills, fixes what it finds on the PR's own branch, then exercises the change on the deploy preview and approves or hands the card to a human."),qa_agent_enabled:F$.boolean().optional().describe("Deprecated: see reviewer_enabled."),code_reviewer_enabled:F$.boolean().optional().describe("Deprecated: see reviewer_enabled."),auto_merge:F$.boolean().optional().describe("When the Reviewer approves a task's pull request, merge it automatically instead of leaving the merge to a human."),auto_resolve_conflicts:F$.boolean().optional().describe("When an approved pull request can't be merged because it conflicts with its base branch, hand it back to the Super Agent to resolve the conflict (check out the branch, merge the base, push). Unset, it follows `auto_merge`; set it explicitly to run one without the other."),cheap_reviewer_model:F$.boolean().optional().describe("Run the Reviewer on a cheaper model than the Super Agent that wrote the code. On by default \u2014 turning it off trades cost for some review depth."),coding_agent_org_mcps:F$.boolean().optional().describe("Give a coding-agent run (the claude-code harness in a sandbox) every MCP connection in the org as its own MCP server, on top of the narrow task-run surface it always gets. Off by default: each connection is one more server the agent connects to at session start, and all of their tools land in its context."),coding_agents_claude_code:F$.boolean().optional().describe("Run chats on a Code Agent (an agent imported from a GitHub repo) with the claude-code harness inside its sandbox, instead of hosted Decopilot. Off by default: it changes the runtime of every such chat, and claude-code flushes whole turns rather than streaming tokens."),auto_assign_report_tasks_to_super_agent:F$.boolean().optional().describe("When a Deco Score import creates a task board item without an assignee, delegate it to the Super Agent automatically instead of leaving it unassigned."),hosting_enabled:F$.boolean().optional().describe("Per-site Hosting tab (deployments, domains, deploy outcomes). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),deco_analytics_enabled:F$.boolean().optional().describe("Per-site Deco Analytics tab (traffic, realtime, usage & limits). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),e2e_enabled:F$.boolean().optional().describe("Per-site E2E tab (end-to-end test runs). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),experiments_enabled:F$.boolean().optional().describe("Per-site Experiments tab (A/B tests + variant results). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org."),monitor_enabled:F$.boolean().optional().describe("Per-site Monitor tab (CDN Performance + Audience from the stats-lake warehouse). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. Its own deployment-wide switch `MONITOR_GA` opens it to every org at once (independent of the control-plane trio)."),site_create_enabled:F$.boolean().optional().describe('The "Create a new site" option under New project: generates a GitHub repository from a site template in an account the org connected, and opens it as a project. Off by default, for every org \u2014 deco.cx staff included.'),delivery_lanes_enabled:F$.boolean().optional().describe("Board lanes for shipping: Approved, Merged and Post-deploy Validation sit between In Review and Done, and a merged pull request lands on Merged instead of Done. For teams whose release process continues after the merge. Off by default \u2014 with it off the board and the state machine behave exactly as if the lanes did not exist."),new_blocks_editor:F$.boolean().optional().describe("Use the redesigned blocks editor for every member of the organization. Off by default \u2014 the classic editor stays until an admin opts the org in.")}),vJ6=new Set(["reviewer_enabled","cheap_reviewer_model"]);rE=F$.object({id:F$.string().describe("Brand context ID"),name:F$.string().max(_3).describe("Company name"),domain:F$.string().max(_3).describe("Company domain (e.g. example.com)"),overview:F$.string().max(fJ6).describe("Company overview / description"),logo:F$.string().max(_3).nullable().optional().describe("Logo URL"),favicon:F$.string().max(_3).nullable().optional().describe("Favicon URL"),ogImage:F$.string().max(_3).nullable().optional().describe("OG image URL"),fonts:F$.object({heading:F$.string().max(_3).optional().describe("Font family for headings"),body:F$.string().max(_3).optional().describe("Font family for body text"),code:F$.string().max(_3).optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:F$.object({primary:F$.string().max(_3).optional().describe("Primary brand color (hex)"),secondary:F$.string().max(_3).optional().describe("Secondary brand color (hex)"),accent:F$.string().max(_3).optional().describe("Accent / highlight color (hex)"),background:F$.string().max(_3).optional().describe("Background color (hex)"),foreground:F$.string().max(_3).optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:F$.array(F$.record(F$.string(),F$.unknown())).max(xJ6).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=FO0,{message:`images must serialize to at most ${FO0} bytes`}).describe("Brand images"),metadata:F$.record(F$.string(),F$.unknown()).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=FO0,{message:`metadata must serialize to at most ${FO0} bytes`}).describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:F$.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:F$.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as TD}from"zod";var $H1;var mg$=L(()=>{_0();JZ();$H1=m({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TD.object({}),outputSchema:TD.object({organizationId:TD.string(),sidebar_items:TD.array(H40).nullable().optional(),coding_agent_mcp_excluded:TD.array(TD.string()).nullable().optional(),simple_mode:F40.nullable().optional(),default_home_agents:B40.nullable().optional(),flags:IR.nullable().optional(),submodule_credentials:TD.array(N40).nullable().optional(),createdAt:TD.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:TD.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.organizationSettings.get(Q);if(!Y)return{organizationId:Q};return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as ZH1}from"zod";var QH1;var dg$=L(()=>{_0();QH1=m({name:"ORGANIZATION_HAS_SITE",description:"Whether this organization owns at least one legacy deco.cx site. Boolean only \u2014 does not expose site slugs.",annotations:{title:"Has Owned Site",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ZH1.object({}),outputSchema:ZH1.object({hasSite:ZH1.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{hasSite:(await Z.storage.orgSites.listByOrg(Q.id)).length>0}}})});import{z as aY}from"zod";var bJ6=50,yJ6=100,gJ6=500,ig$=500,YH1;var pg$=L(()=>{_0();JZ();YH1=m({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:aY.object({organizationId:aY.string().min(1,"organizationId is required"),sidebar_items:aY.array(H40).max(bJ6).optional(),coding_agent_mcp_excluded:aY.array(aY.string().max(ig$)).max(gJ6).optional().describe("Connection ids a coding-agent run must not mount, even with `coding_agent_org_mcps` on. Replaces the stored list; pass [] to clear it."),simple_mode:F40.optional(),default_home_agents:B40.extend({ids:aY.array(aY.string().max(ig$)).max(yJ6)}).optional(),flags:IR.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),submodule_credentials:aY.array(N40).max(lg$).refine(($)=>new Set($.map((Z)=>Z.host)).size===$.length,"Each git credential host must be unique.").optional().describe("Per-host PATs (as vault secret ids) every sandbox in the org installs in its git config. Replaces the stored list; pass [] to clear it.")}),outputSchema:aY.object({organizationId:aY.string(),sidebar_items:aY.array(H40).nullable().optional(),coding_agent_mcp_excluded:aY.array(aY.string()).nullable().optional(),simple_mode:F40.nullable().optional(),default_home_agents:B40.nullable().optional(),flags:IR.nullable().optional(),submodule_credentials:aY.array(N40).nullable().optional(),createdAt:aY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:aY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(o(Z),await Z.access.check(),W0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Y=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,coding_agent_mcp_excluded:$.coding_agent_mcp_excluded,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,submodule_credentials:$.submodule_credentials});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as UO0}from"zod";var XH1;var ng$=L(()=>{JZ();_0();XH1=m({name:"ORGANIZATION_BLOCKS_EDITOR_SET",description:"Turn the redesigned blocks editor on or off for every member of the organization.",annotations:{title:"Set Blocks Editor",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:UO0.object({enabled:UO0.boolean().describe("Whether the org uses the new blocks editor.")}),outputSchema:UO0.object({enabled:UO0.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationSettings.upsert(Q.id,{flags:{new_blocks_editor:$.enabled}});return{enabled:CZ(Y.flags,"new_blocks_editor")}}})});import{z as NF}from"zod";var tg$,JH1,GH1;var og$=L(()=>{_0();JZ();tg$=rE.extend({organizationId:NF.string(),archivedAt:NF.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:NF.string().describe("ISO 8601 timestamp"),updatedAt:NF.string().describe("ISO 8601 timestamp")}),JH1=m({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NF.object({includeArchived:NF.boolean().optional().describe("Include archived brands in the list")}),outputSchema:NF.object({items:NF.array(tg$)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q,{includeArchived:$.includeArchived})).map((X)=>({...X,archivedAt:X.archivedAt instanceof Date?X.archivedAt.toISOString():X.archivedAt,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,updatedAt:X.updatedAt instanceof Date?X.updatedAt.toISOString():X.updatedAt}))}}}),GH1=m({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NF.object({id:NF.string().describe("Brand context ID")}),outputSchema:tg$.extend({organizationId:NF.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.get($.id,Q);if(!Y)throw Error("Brand context not found");return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as VR}from"zod";var ag$,WH1,KH1,HH1;var rg$=L(()=>{_0();JZ();ag$=rE.extend({organizationId:VR.string(),createdAt:VR.string().describe("ISO 8601 timestamp"),updatedAt:VR.string().describe("ISO 8601 timestamp")}),WH1=m({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:rE.omit({id:!0}),outputSchema:ag$,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.create(Q,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}}),KH1=m({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rE.partial().required({id:!0}),outputSchema:ag$,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");let{id:X,...J}=$;if(J.isDefault===!0)await Z.storage.brandContext.setDefault(X,Q);let G=await Z.storage.brandContext.update(X,Q,{name:J.name,domain:J.domain,overview:J.overview,logo:J.logo!==void 0?J.logo??null:void 0,favicon:J.favicon!==void 0?J.favicon??null:void 0,ogImage:J.ogImage!==void 0?J.ogImage??null:void 0,fonts:J.fonts!==void 0?J.fonts??null:void 0,colors:J.colors!==void 0?J.colors??null:void 0,images:J.images!==void 0?J.images??null:void 0,metadata:J.metadata!==void 0?J.metadata??null:void 0,archivedAt:J.archivedAt!==void 0?J.archivedAt??null:void 0,isDefault:J.isDefault===!1?!1:void 0});return{...G,archivedAt:G.archivedAt instanceof Date?G.archivedAt.toISOString():G.archivedAt,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,updatedAt:G.updatedAt instanceof Date?G.updatedAt.toISOString():G.updatedAt}}}),HH1=m({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:VR.object({id:VR.string().describe("Brand context ID")}),outputSchema:VR.object({success:VR.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,Q,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function NO0($,Z,Q){let Y=$.trim();if(!Y.startsWith("http"))Y=`https://${Y}`;let X=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Y,formats:["branding"]})});if(!X.ok){let N=await X.text().catch(()=>"");throw Error(`Firecrawl API error: ${X.status} ${N.slice(0,200)}`)}let J=await X.json();if(!J.success||!J.data?.branding)return null;let G=J.data.branding,W=J.data.metadata??{},K=lJ6(G,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??W.ogSiteName??Q??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function lJ6($,Z){let Q=$.images??{},Y=$.colors??{},X={};for(let[F,U]of Object.entries(Y))if(typeof U==="string"&&U&&hJ6.has(F))X[F]=U;let J={},W=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(W))if(typeof U==="string"&&U){let N=uJ6[F.toLowerCase()];if(N&&!J[N])J[N]=U}let K=$.fonts;if(Array.isArray(K))for(let F of K){let U=F.family;if(typeof U==="string"&&U&&!J.body)J.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:Q.logo??null,favicon:Q.favicon??null,ogImage:Q.ogImage??Z.ogImage??null,fonts:Object.keys(J).length>0?J:null,colors:Object.keys(X).length>0?X:null,metadata:H}}var hJ6,uJ6;var FH1=L(()=>{hJ6=new Set(["primary","secondary","accent","background","foreground"]),uJ6={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as BO0}from"zod";var cJ6,UH1;var sg$=L(()=>{_0();FH1();JZ();cJ6=rE.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:BO0.boolean()}),UH1=m({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:BO0.object({domain:BO0.string().describe("Website domain to extract brand from"),brandId:BO0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:cJ6,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=Z.firecrawlApiKey;if(!Y)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let X=await NO0($.domain,Y,$.domain);if(!X)throw Error("Firecrawl did not return branding data for this URL");let J={name:X.name,domain:X.domain,overview:X.overview,logo:X.logo,favicon:X.favicon,ogImage:X.ogImage,fonts:X.fonts,colors:X.colors,images:X.images,metadata:X.metadata},G=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,Q))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,Q,J)})():await Z.storage.brandContext.create(Q,J);return{id:G.id,name:G.name,domain:G.domain,overview:G.overview,logo:G.logo,favicon:G.favicon,ogImage:G.ogImage,fonts:G.fonts,colors:G.colors,success:!0}}})});function eg$($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let Q=Object.fromEntries(Object.entries(Z).filter(([Y])=>Y!=="tagline"&&Y!=="tone"));return Object.keys(Q).length>0?Q:void 0})()}}var NH1,BH1;var $h$=L(()=>{FK1();_0();NH1=m({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gD0,outputSchema:a80,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=$.id?await Z.storage.brandContext.get($.id,Q):await Z.storage.brandContext.getDefault(Q);if(!Y)throw Error($.id?"Brand not found":"No default brand configured");return eg$(Y)}}),BH1=m({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hD0,outputSchema:uD0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q)).map(eg$)}}})});import{resolveTxt as mJ6}from"dns/promises";function LH1($){return`${dJ6}.${$.toLowerCase()}`}function Zh$(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function Qh$($,Z,Q=mJ6){if(!Z)return!1;try{return(await Q(LH1($))).some((X)=>X.join("").trim()===Z)}catch{return!1}}var dJ6="_deco-verify";var Yh$=()=>{};import{z as i9}from"zod";function sE($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?LH1($.domain):null,recordValue:Z?$.verificationToken:null}}function pJ6($){let Z=$.toLowerCase().trim();if(!iJ6.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(BF.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var iJ6,Xh$=50,DH1,LO0,OH1,jH1,wH1,EH1,zH1;var Jh$=L(()=>{v3();Yh$();_0();iJ6=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,DH1=i9.enum(["off","auto","request"]),LO0=i9.object({id:i9.string(),domain:i9.string(),joinMode:DH1,verificationStatus:i9.enum(["pending","verified"]),verificationMethod:i9.enum(["email","dns"]).nullable(),verifiedAt:i9.string().nullable(),recordName:i9.string().nullable(),recordValue:i9.string().nullable()});OH1=m({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({}),outputSchema:i9.object({domains:i9.array(LO0)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(Q.id)).map(sE)}}}),jH1=m({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({domain:i9.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:DH1.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:LO0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=pJ6($.domain),J=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),G=Boolean(Z.auth.user?.emailVerified)&&J===Y,W=await Z.storage.organizationDomains.getByOrgAndDomain(Q.id,Y);if(W){if(W.verificationStatus!=="verified"&&G){let F=await Z.storage.organizationDomains.markVerified(W.id,"email");return sE(F)}return sE(W)}if((await Z.storage.organizationDomains.listByOrganizationId(Q.id)).length>=Xh$)throw Error(`An organization can claim at most ${Xh$} domains.`);let H=G?await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:"off",verificationStatus:"pending",verificationToken:Zh$()});return sE(H)}}),wH1=m({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({id:i9.string(),joinMode:DH1}),outputSchema:LO0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if($.joinMode!=="off"&&Y.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let X=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return sE(X)}}),EH1=m({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:i9.object({id:i9.string()}),outputSchema:i9.object({verified:i9.boolean(),domain:LO0}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if(Y.verificationStatus==="verified")return{verified:!0,domain:sE(Y)};if(!Y.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await Qh$(Y.domain,Y.verificationToken))return{verified:!1,domain:sE(Y)};let J=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:sE(J)}}}),zH1=m({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({id:i9.string()}),outputSchema:i9.object({success:i9.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function eE($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as rZ}from"zod";var nJ6,PH1,TH1,AH1;var Gh$=L(()=>{_0();F6();nJ6=rZ.object({id:rZ.string(),userId:rZ.string(),status:rZ.enum(["pending","approved","denied"]),createdAt:rZ.string(),user:rZ.object({id:rZ.string(),name:rZ.string(),email:rZ.string(),image:rZ.string().nullable()}).nullable()}),PH1=m({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({}),outputSchema:rZ.object({requests:rZ.array(nJ6)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(Q.id)).map((X)=>({id:X.id,userId:X.userId,status:X.status,createdAt:new Date(X.createdAt).toISOString(),user:X.user}))}}}),TH1=m({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({requestId:rZ.string()}),outputSchema:rZ.object({success:rZ.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=t0(Z);if(!await Z.storage.organizationJoinRequests.decide(Y.id,"approved",X??Y.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:Q.id,userId:Y.userId,role:["user"]})}catch(G){if(!eE(G))throw G}if(X)h1.capture({distinctId:X,event:"organization_join_request_approved",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}}),AH1=m({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({requestId:rZ.string()}),outputSchema:rZ.object({success:rZ.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=t0(Z);if(await Z.storage.organizationJoinRequests.decide(Y.id,"denied",X??Y.userId)&&X)h1.capture({distinctId:X,event:"organization_join_request_denied",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}})});import{z as KG}from"zod";var RH1;var Wh$=L(()=>{F6();_0();fY();RH1=m({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:KG.object({organizationId:KG.string().optional(),userId:KG.string(),role:KG.array(KG.string())}),outputSchema:KG.object({id:KG.string(),organizationId:KG.string(),userId:KG.string(),role:KG.union([KG.string(),KG.array(KG.string())]),createdAt:KG.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",t0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!rF0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let X=await Z.boundAuth.organization.addMember({organizationId:Q,userId:$.userId,role:$.role});if(!X)throw Error("Failed to add member");let J=t0(Z);if(J)h1.capture({distinctId:J,event:"organization_member_added",groups:{organization:Q},properties:{organization_id:Q,added_user_id:$.userId,role:$.role}});return{...X,role:X.role,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});import{z as ei}from"zod";var qH1;var Kh$=L(()=>{F6();_0();qH1=m({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ei.object({organizationId:ei.string().optional(),memberIdOrEmail:ei.string()}),outputSchema:ei.object({success:ei.boolean(),memberIdOrEmail:ei.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.boundAuth.organization.removeMember({organizationId:Q,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Y.member.userId,Q);let X=t0(Z);if(X)h1.capture({distinctId:X,event:"organization_member_removed",groups:{organization:Q},properties:{organization_id:Q,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as rY}from"zod";var MH1;var Hh$=L(()=>{_0();MH1=m({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rY.object({limit:rY.number().int().min(1).max(1000).optional(),offset:rY.number().int().min(0).optional()}),outputSchema:rY.object({members:rY.array(rY.object({id:rY.string(),organizationId:rY.string(),userId:rY.string(),role:rY.string(),createdAt:rY.string().datetime().describe("ISO 8601 timestamp"),user:rY.object({id:rY.string(),name:rY.string(),email:rY.string(),image:rY.string().optional()}).optional()}))}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:Q,limit:$.limit,offset:$.offset}))?.members??[]).map((J)=>({...J,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt}))}}})});import{z as wQ}from"zod";var IH1;var Fh$=L(()=>{F6();_0();fY();IH1=m({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:wQ.object({organizationId:wQ.string().optional(),memberId:wQ.string(),role:wQ.array(wQ.string())}),outputSchema:wQ.object({id:wQ.string(),organizationId:wQ.string(),userId:wQ.string(),role:wQ.union([wQ.string(),wQ.array(wQ.string())]),createdAt:wQ.string().datetime().describe("ISO 8601 timestamp"),user:wQ.object({email:wQ.string(),name:wQ.string(),image:wQ.string().optional()})}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",t0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!rF0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);if(!$.role.includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("id","=",$.memberId).where("organizationId","=",Q).executeTakeFirst())?.role.split(",").includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("organizationId","=",Q).execute()).filter((H)=>H.role.split(",").includes("owner")).length<=1)throw Error("Cannot remove the organization's last owner. Assign another owner first.")}}let X=await Z.boundAuth.organization.updateMemberRole({organizationId:Q,memberId:$.memberId,role:$.role});if(!X)throw Error("Failed to update member role");Z.invalidateMemberRole?.(X.userId,Q);let J=t0(Z);if(J)h1.capture({distinctId:J,event:"organization_member_role_updated",groups:{organization:Q},properties:{organization_id:Q,member_id:$.memberId,target_user_id:X.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...X,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});async function Uh$(){if(L40&&Date.now()-L40.fetchedAt<600000)return L40.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),Q=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(Q)||Q<=0)throw Error("Invalid rate");return L40={rate:Q,fetchedAt:Date.now()},Q}catch{return L40?.rate??5.5}}function Nh$($,Z,Q){if(Z==="brl")return Math.round($/Q);return $}var L40=null;function VH1($,Z="",Q=new URLSearchParams){for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;let J=Z?`${Z}[${Y}]`:Y;if(Array.isArray(X))X.forEach((G,W)=>{if(typeof G==="object"&&G!==null)VH1(G,`${J}[${W}]`,Q);else Q.append(`${J}[${W}]`,String(G))});else if(typeof X==="object")VH1(X,J,Q);else Q.append(J,String(X))}return Q}async function AD($,Z){let Q=P0().stripeSecretKey;if(!Q)throw new sZ(503,"billing is not configured");let Y=Z?.params?VH1(Z.params).toString():void 0,X=await fetch(`${tJ6}${$}`,{method:Z?.method??(Y?"POST":"GET"),headers:{Authorization:`Bearer ${Q}`,...Y&&{"Content-Type":"application/x-www-form-urlencoded"},...Z?.idempotencyKey&&{"Idempotency-Key":Z.idempotencyKey}},body:Y,signal:AbortSignal.timeout(oJ6)}),J=await X.json().catch(()=>({}));if(!X.ok){let G=J.error?.message??`HTTP ${X.status}`;throw new sZ(X.status,G)}return J}function Bh$($){return{billing_address_collection:"required",custom_fields:[{key:aJ6,label:{type:"custom",custom:"CPF / CNPJ"},type:"text",optional:!1,text:{minimum_length:rJ6,maximum_length:sJ6}}],...$&&{customer_update:{address:"auto",name:"auto"}}}}function Lh$($){return Boolean((P0().stripePlanPriceIds??{})[$])}function kH1($){let Z=P0().stripePlanPriceIds??{};return Object.entries(Z).find(([,Q])=>Q===$)?.[0]}function eJ6($){return["checkout",$.organizationId,$.planId??"flat",$.lastStripeEventAt?.getTime()??0].join(":")}async function Dh$($){let Z=P0(),Q=$.planId?kH1($.planId):Z.stripeOrgPriceId;if(!Q)throw new sZ(503,$.planId?`plan '${$.planId}' has no Stripe price configured`:"billing is not configured");let Y=await AD("/checkout/sessions",{idempotencyKey:eJ6({organizationId:$.organizationId,...$.planId?{planId:$.planId}:{},...$.lastStripeEventAt!==void 0&&{lastStripeEventAt:$.lastStripeEventAt}}),params:{mode:"subscription",...Bh$(null),line_items:[{price:Q,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}},subscription_data:{billing_cycle_anchor_config:{day_of_month:1,hour:0,minute:0,second:0},metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}}}}});if(!Y.url)throw new sZ(500,"checkout session lacks url");return{url:Y.url}}function $G6($,Z){return Math.round($*(1+Z/100))}function QG6($){let Z=Math.floor(($.nowMs??Date.now())/ZG6);return["topup",$.organizationId,$.currency,$.amountCents,Z].join(":")}async function Oh$($){let Z=$G6($.amountCents,$.feePercent),Q=Nh$($.amountCents,$.currency,await Uh$()),Y=P0().stripeTopupProductId,X={kind:"topup",orgId:$.organizationId,creditCents:Q},J=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,G=await AD("/checkout/sessions",{idempotencyKey:QG6({organizationId:$.organizationId,amountCents:$.amountCents,currency:$.currency}),params:{mode:"payment",...$.customerId&&{customer:$.customerId},...Bh$($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Y?{product:Y}:{product_data:{name:J}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:X,payment_intent_data:{metadata:X}}});if(!G.url)throw new sZ(500,"checkout session lacks url");return{url:G.url}}async function DO0($){let Z=await AD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new sZ(500,"portal session lacks url");return{url:Z.url}}async function jh$($){let Z=await AD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl,...P0().stripePortalConfigurationId&&{configuration:P0().stripePortalConfigurationId},flow_data:{type:"subscription_update_confirm",subscription_update_confirm:{subscription:$.subscriptionId,items:[{id:$.subscriptionItemId,price:$.priceId}]},after_completion:{type:"redirect",redirect:{return_url:$.returnUrl}}}}});if(!Z.url)throw new sZ(500,"portal session lacks url");return{url:Z.url}}async function wh$($){return AD(`/prices/${encodeURIComponent($)}`)}async function $z($){return AD(`/subscriptions/${encodeURIComponent($)}`)}async function Eh$($){await AD(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}async function zh$($){let Z=await AD(`/invoices?subscription=${encodeURIComponent($)}&status=paid&limit=100`),Q=YG6($,Z.data??[]);for(let Y of Q)await AD("/refunds",{params:{payment_intent:Y.paymentIntent,reason:"duplicate"},idempotencyKey:Y.idempotencyKey});return{refundedCents:Q.reduce((Y,X)=>Y+X.amountCents,0)}}function YG6($,Z){let Q=[];for(let Y of Z){let X=Y.amount_paid??0;if(X<=0)continue;let J=typeof Y.payment_intent==="string"?Y.payment_intent:Y.payment_intent?.id;if(!J)continue;Q.push({paymentIntent:J,amountCents:X,idempotencyKey:`orphan-refund:${$}:${Y.id??J}`})}return Q}var tJ6="https://api.stripe.com/v1",sZ,oJ6=15000,aJ6="taxid",rJ6=11,sJ6=18,ZG6=120000;var RD=L(()=>{Y$();sZ=class sZ extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as OO0}from"zod";async function XG6($){if(!$.planId)throw Error("This organization already has an active subscription.");let Z=kH1($.planId);if(!Z)throw new sZ(503,`plan '${$.planId}' has no Stripe price configured`);let Q=await $z($.subscriptionId),Y=(Q.items?.data??[]).filter((G)=>G.price?.id?Lh$(G.price.id):!1),X=Y[0];if(Y.length>1)throw Error("This organization's subscription has more than one plan line \u2014 change it in Stripe, not here.");if(!X?.id)throw new sZ(500,"subscription has no plan line to move to another price");if(X.price?.id===Z)throw Error("This organization is already on that plan.");let{url:J}=await jh$({customerId:Q.customer,subscriptionId:$.subscriptionId,subscriptionItemId:X.id,priceId:Z,returnUrl:$.returnUrl});return J}var CH1;var Ph$=L(()=>{RD();A9();_0();F6();CH1=m({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:OO0.object({planId:OO0.string().optional()}),outputSchema:OO0.object({url:OO0.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id,Y=Z.organization?.slug;if(!Q||!Y)throw Error("Organization context required");let X=await Z.storage.organizationBilling.getBilling(Q),J=`${a5()}${dE(Y,"members")}`;if(X?.status==="active"&&X.stripeSubscriptionId){let W=await XG6({subscriptionId:X.stripeSubscriptionId,planId:$.planId,returnUrl:`${J}?checkout=updated`});return gY({event:"subscription_plan_change_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:W}}if(X?.status==="active")throw Error("This organization already has an active subscription.");if(X?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let{url:G}=await Dh$({organizationId:Q,successUrl:`${J}?checkout=success`,cancelUrl:`${J}?checkout=canceled`,...$.planId?{planId:$.planId}:{},lastStripeEventAt:X?.lastStripeEventAt??null});return gY({event:"subscription_checkout_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:G}}})});import{z as Zz}from"zod";async function KG6(){if(D40&&Date.now()-D40.at<D40.ttlMs)return D40.prices;let $=new Set,Z=Object.entries(P0().stripePlanPriceIds??{}).filter(([,J])=>{if($.has(J))return!1;return $.add(J),!0}),Y=(await Promise.all(Z.map(async([J,G])=>{try{let W=await wh$(J);if(W.unit_amount===null)return null;return{planId:G,amountCents:W.unit_amount,currency:W.currency,interval:W.recurring?.interval??null}}catch(W){return console.warn(`plan price ${J} (${G}) unreadable:`,W instanceof sZ?W.message:W),null}}))).filter((J)=>J!==null),X=Y.length===Z.length;return D40={at:Date.now(),prices:Y,ttlMs:X?GG6:WG6},Y}var JG6,GG6=600000,WG6=30000,D40=null,SH1;var Th$=L(()=>{RD();_0();Y$();JG6=Zz.object({planId:Zz.string(),amountCents:Zz.number(),currency:Zz.string(),interval:Zz.string().nullable()});SH1=m({name:"ORGANIZATION_BILLING_PLAN_PRICES",description:"The monthly price of each purchasable plan, read from Stripe. Empty when no plan prices are configured.",annotations:{title:"Plan Prices",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Zz.object({}),outputSchema:Zz.object({prices:Zz.array(JG6)}),handler:async($,Z)=>{return o(Z),await Z.access.check(),{prices:await KG6()}}})});import{z as _H1}from"zod";var vH1;var Ah$=L(()=>{RD();A9();_0();vH1=m({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:_H1.object({}),outputSchema:_H1.object({url:_H1.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);if(!Q.slug)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(Q.id);if(!Y?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await DO0({customerId:Y.stripeCustomerId,returnUrl:`${a5()}${dE(Q.slug,"members")}`})}catch(X){if(X instanceof sZ)throw Error(X.message);throw X}}})});function jO0($){return xH1[$%xH1.length]??HG6}function EQ($){return $.createdBy==="system"}function UG6($){if($?.reviewer_enabled===void 0&&$?.qa_agent_enabled===!1&&$?.code_reviewer_enabled===!1)return!1;return CZ($,"reviewer_enabled")}function qD($){return UG6($)?DK:[]}function NG6($){return CZ($,"delivery_lanes_enabled")}function kN($){return NG6($)?"merged":"done"}function Yz($,Z){if(!$)return!1;return[VN[Z],...FG6].some((Q)=>$.startsWith(`${Q}:`))}function MD($,Z){if(Z)return new Date(Z).getTime();let Q=0;for(let Y of $){if(Y.action!=="status_changed")continue;if(Y.data?.to!=="in_review")continue;Q=Math.max(Q,new Date(Y.occurredAt).getTime())}return Q}function Mh$($,Z,Q){let X=$.filter((J)=>J.action==="status_changed").at(-1);if(!X)return Q;return X.data?.to===Z?X.occurredAt:null}function Xz($,Z){let Q=MD($,Z.cycleStartedAt),Y=new Map;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;if(new Date(X.occurredAt).getTime()<Q)continue;let J=X.data??{};if(J.reviewer!=="reviewer")continue;if(X.action==="review_approved"){if(Z?.verifiedOnly&&J.verified!==!0)continue;Y.set("reviewer","approved")}else Y.set("reviewer","changes_requested")}return Y}function Qz($,Z,Q){if(Z.length===0)return!1;let Y=Xz($,Q);return Z.every((X)=>Y.get(X)==="approved")}function Ih$($,Z,Q){return Qz($,Z,Q)&&!Qz($,Z,{...Q,verifiedOnly:!0})}function Vh$($){let Z=null;for(let Q of $){if(Q.action!=="review_approved"&&Q.action!=="review_changes_requested")continue;let Y=new Date(Q.occurredAt).getTime();if(Z&&Y<Z.at)continue;let X=Q.data?.notes;Z={at:Y,notes:Q.action==="review_changes_requested"&&typeof X==="string"?X:null}}return Z?.notes??null}function vh$($,Z=Date.now()){if($.state!==null&&$.state!=="open")return!1;if($.state===null)return!0;if($.checksStatus==="pending")return!0;if($.previewUrl!==null)return!1;let Q=$.updatedAt?Date.parse($.updatedAt):Number.NaN;return Number.isFinite(Q)&&Z-Q<BG6}var V8="super-agent",xH1,HG6,O40='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',Rh$,fH1="chore",DK,VN,FG6,j40="NO VISUAL SURFACE",LF,I$,qh$,wO0,kh$="task-board.item.updated",Ch$="task-board.item.deleted",Sh$="task-board.item.prs.updated",_h$=4000,BG6=600000;var u4=L(()=>{JZ();xH1=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],HG6=xH1[0];Rh$="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",DK=["reviewer"],VN={reviewer:"Reviewer"},FG6=["QA Agent","Code Reviewer"];LF=["triage","todo","in_progress","in_review","approved","merged","post_deploy_validation","done","archived"],I$={intake:"triage",queue:"todo",progress:"in_progress",review:"in_review",archive:"archived"},qh$=LF.map(($,Z)=>({key:$,title:$,position:Z})),wO0=["approved","merged","post_deploy_validation"]});function bH1($){return $==="trial"?"trial":"subscription"}function w40($,Z,Q,Y={}){gY({event:Z,organizationId:Q.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:Q.id,...Y}})}function yH1($){return $?.status==="active"||$?.status==="past_due"}function EO0($,Z){if(yH1($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function E40(){let $=P0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function Jz(){return{...E40(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function $p($,Z,Q=E40()){if(!Q.enforced||!EQ(Z))return;let Y=await $.storage.organizationBilling.taskClaim(Z.id);if(Y&&Y.runCount>=Q.maxRunsPerTask)throw w40($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new eX("runs_exhausted");if(Y&&Y.state!=="released")return;let X=await $.storage.organizationBilling.getBilling(Z.organizationId),J=EO0(X,Q);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,J.periodKey)>=J.limit)throw w40($,"task_quota_blocked",Z,{phase:"precheck",reason:J.exhaustedReason,billing_mode:bH1(J.periodKey),limit:J.limit}),new eX(J.exhaustedReason)}async function xh$($,Z,Q=E40()){if(!Q.enforced||!EQ(Z))return"skipped";let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),X=EO0(Y,Q),J=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,X.periodKey,X.limit,Q.maxRunsPerTask);if(J==="exhausted")throw w40($,"task_quota_blocked",Z,{phase:"claim",reason:X.exhaustedReason,billing_mode:bH1(X.periodKey),limit:X.limit}),new eX(X.exhaustedReason);if(J==="runs_exhausted")throw w40($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new eX("runs_exhausted");if(J==="claimed")w40($,"task_quota_claimed",Z,{billing_mode:bH1(X.periodKey),period_key:X.periodKey,limit:X.limit});return J}async function fh$($,Z,Q,Y){if(Y==="skipped")return;await $.rollbackTaskClaim(Z,Q,{releaseSlot:Y==="claimed"}).catch((X)=>console.error("[task-quota] rollback failed (stays charged)",X))}async function bh$($,Z){let Q=await $.storage.organizationBilling.taskClaim(Z);return!!Q&&Q.state!=="released"}async function yh$($,Z,Q){if(await $.releaseTaskClaim(Z,Q).catch((X)=>{return console.error("[task-quota] refund failed (stays charged)",X),!1}))gY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:Q}})}var LG6="[SUBSCRIPTION_REQUIRED]",DG6,eX;var OK=L(()=>{u4();F6();Y$();DG6={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};eX=class eX extends Error{reason;constructor($){super(`${LG6} ${DG6[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as ID}from"zod";var gH1;var gh$=L(()=>{_0();OK();gH1=m({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ID.object({}),outputSchema:ID.object({enforced:ID.boolean(),billingStatus:ID.string(),subscribed:ID.boolean(),hasBillingAccount:ID.boolean(),used:ID.number(),limit:ID.number(),currentPeriodEnd:ID.string().datetime().nullable()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=E40(),X=await Z.storage.organizationBilling.getBilling(Q.id),J=EO0(X,Y),G=await Z.storage.organizationBilling.countTaskClaims(Q.id,J.periodKey);return{enforced:Y.enforced,billingStatus:X?.status??"none",subscribed:yH1(X),hasBillingAccount:!!X?.stripeCustomerId,used:G,limit:J.limit,currentPeriodEnd:X?.currentPeriodEnd?.toISOString()??null}}})});var hh$=L(()=>{fg$();bg$();yg$();gg$();hg$();mg$();dg$();pg$();ng$();og$();rg$();sg$();$h$();Jh$();Gh$();Wh$();Kh$();Hh$();Fh$();Ph$();Th$();Ah$();gh$()});function jK($){let Z=$?.status;return typeof Z==="number"?Z:null}function uh$($){let Z=$;if(Z?.isRateLimited!==!0)return;return typeof Z.retryAfterMs==="number"?Z.retryAfterMs:null}async function HG($,Z){let Q=await $.getBranch(Z);if(Q)return Q.sha;throw new g0({provider:$.repo.provider,status:404,message:`Branch ${Z} does not exist in ${$.repo.path}`})}var X5;var z40=L(()=>{S5();X5=class X5 extends Error{constructor($,Z){super($,Z);this.name="RepoWriteConflict"}}});function Zp($){if($.length===0)return null;let Z=!1;for(let Q of $){if(Q.state!=="completed"){Z=!0;continue}if(Q.conclusion&&jG6.has(Q.conclusion))return"failing"}return Z?"pending":"passing"}var jG6,kR;var P40=L(()=>{jG6=new Set(["failure","cancelled","timed_out","action_required"]);kR=class kR extends Error{existing;constructor($,Z){super($);this.name="ChangeRequestExists",this.existing=Z}}});function Qp($){return wG6.test($.trim())}function eZ($,Z,Q){if($===void 0||!Number.isFinite($)||$<=0)return Math.min(Z,Q);return Math.min(Math.floor($),Q)}async function Yp($,Z){let Q=$.headers.get("content-length"),Y=Q===null?Number.NaN:Number(Q),X=Number.isFinite(Y)&&Y>=0?Y:null,J=$.body;if(!J)return{content:"",size:X??0,truncated:!1};let G=J.getReader(),W=[],K=0,H=!1;try{for(;;){let{done:U,value:N}=await G.read();if(U)break;if(!N)continue;let B=Z-K;if(N.byteLength>=B){W.push(N.subarray(0,B)),K+=B,H=N.byteLength>B||!(await G.read()).done;break}W.push(N),K+=N.byteLength}}finally{await G.cancel().catch(()=>{})}return{content:new TextDecoder().decode(EG6(W,K)),size:X??K,truncated:H||X!==null&&X>K}}function EG6($,Z){let Q=new Uint8Array(Z),Y=0;for(let X of $)Q.set(X,Y),Y+=X.byteLength;return Q}function x3($){return $.split("/").map(encodeURIComponent).join("/")}function hH1($){let Z=Number($);return Number.isInteger(Z)&&Z>1?Z:1}var Gz=400,VD=2000,Wz=60000,kD=200000,Kz=50,Hz=50,DF=100,wG6;var Xp=L(()=>{wG6=/\[bot\]$|[-_.]bot$|^bot[-_.]|^(dependabot|renovate)$/i});var CN;var uH1=L(()=>{CN={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});import{sql as T40}from"kysely";function lh$($){return $ instanceof Date?$.toISOString():String($)}function A40($){let Z=$.installation_id===null||$.installation_id===void 0?null:Number($.installation_id);return{id:$.id,organizationId:$.organization_id,type:$.type,host:$.host,authKind:$.auth_kind,externalAccountId:$.external_account_id,login:$.login,avatarUrl:$.avatar_url,installationId:Number.isFinite(Z)?Z:null,status:$.status,installationAuthorizedBy:$.installation_authorized_by??null,installationRepositoryIds:$.installation_repository_ids??null,credentialConnectionId:$.credential_connection_id,connectedBy:$.connected_by_name?{name:$.connected_by_name}:null,createdAt:lh$($.created_at),updatedAt:lh$($.updated_at)}}class CR{db;constructor($){this.db=$}async upsert($){let Z=new Date,Q=await this.db.insertInto("git_provider_accounts").values({organization_id:$.organizationId,type:$.type,host:$.host.toLowerCase(),auth_kind:$.authKind,external_account_id:$.externalAccountId,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",created_by:$.createdBy??null}).onConflict((Y)=>Y.columns(["organization_id","host","external_account_id"]).doUpdateSet({type:$.type,auth_kind:$.authKind,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",updated_at:T40`GREATEST(${Z}, git_provider_accounts.updated_at + interval '1 millisecond')`})).returningAll().executeTakeFirstOrThrow();return A40(Q)}async get($,Z){let Q=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?A40(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).executeTakeFirst();return Z?A40(Z):null}async listByOrg($){return(await this.db.selectFrom("git_provider_accounts").leftJoin("user as connector","connector.id","git_provider_accounts.created_by").selectAll("git_provider_accounts").select("connector.name as connected_by_name").where("git_provider_accounts.organization_id","=",$).orderBy("git_provider_accounts.created_at","asc").execute()).map(A40)}async findByExternalId($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("organization_id","=",$.organizationId).where("host","=",$.host.toLowerCase()).where("external_account_id","=",$.externalAccountId).executeTakeFirst();return Z?A40(Z):null}async setStatus($,Z,Q){await this.db.updateTable("git_provider_accounts").set({status:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).execute()}async grantRepository($,Z,Q){let Y=T40`jsonb_build_array(${Q}::bigint)`;await this.db.updateTable("git_provider_accounts").set({installation_repository_ids:T40`installation_repository_ids || ${Y}`,updated_at:T40`GREATEST(${new Date}, updated_at + interval '1 millisecond')`}).where("id","=",$).where("organization_id","=",Z).where("installation_repository_ids","is not",null).where(T40`NOT installation_repository_ids @> ${Y}`).execute()}async delete($,Z){return(await this.db.deleteFrom("git_provider_accounts").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}}var zO0=()=>{};class R40{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("git_provider_account_credentials").selectAll().where("account_id","=",$).executeTakeFirst();if(!Z)return null;return zG6(this.vault,Z)}async upsert($){let Z=new Date,Q=await this.vault.encrypt($.accessToken),Y=$.refreshToken?await this.vault.encrypt($.refreshToken):null,X=$.clientSecret?await this.vault.encrypt($.clientSecret):null;await this.db.insertInto("git_provider_account_credentials").values({account_id:$.connectionId,access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint}).onConflict((J)=>J.column("account_id").doUpdateSet({access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint,updated_at:Z})).execute()}async delete($){await this.db.deleteFrom("git_provider_account_credentials").where("account_id","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Y=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Y))return!0;return Y-Z<Date.now()}}async function zG6($,Z){try{let Q=await $.decrypt(Z.access_token),Y=Z.refresh_token?await $.decrypt(Z.refresh_token):null,X=Z.client_secret?await $.decrypt(Z.client_secret):null;return{id:Z.account_id,connectionId:Z.account_id,accessToken:Q,refreshToken:Y,scope:Z.scope,expiresAt:Z.expires_at,createdAt:Z.created_at,updatedAt:Z.updated_at,clientId:Z.client_id,clientSecret:X,tokenEndpoint:Z.token_endpoint}}catch(Q){return console.warn("[GitProviderAccountCredential] failed to decrypt credential row",{accountId:Z.account_id,message:Q instanceof Error?Q.message:String(Q)}),null}}import{sql as PG6}from"kysely";function ch$($){return $ instanceof Date?$.toISOString():String($)}function SR($){return{id:$.id,organizationId:$.organization_id,accountId:$.account_id,provider:$.provider,host:$.host,path:$.path,externalId:$.external_id,defaultBranch:$.default_branch,webUrl:$.web_url,visibility:$.visibility,sandboxImage:EN.catch("default").parse($.sandbox_image),legacyConnectionId:$.legacy_connection_id,createdAt:ch$($.created_at),updatedAt:ch$($.updated_at)}}function CD($){return{provider:$.provider,host:$.host,path:$.path}}class q40{db;constructor($){this.db=$}async upsert($){let Z=$.ref.host.toLowerCase(),Q=await this.findByRef($.organizationId,$.ref);if(Q){let X=await this.db.updateTable("repositories").set({path:$.ref.path,provider:$.ref.provider,web_url:XG({...$.ref,host:Z}),...$.accountId!==void 0?{account_id:$.accountId}:{},...$.externalId!==void 0?{external_id:$.externalId}:{},...$.defaultBranch!==void 0?{default_branch:$.defaultBranch}:{},...$.visibility!==void 0?{visibility:$.visibility}:{},...$.sandboxImage!==void 0?{sandbox_image:$.sandboxImage}:{},...$.legacyConnectionId!==void 0?{legacy_connection_id:$.legacyConnectionId}:{},updated_at:new Date}).where("id","=",Q.id).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return SR(X)}let Y=await this.db.insertInto("repositories").values({organization_id:$.organizationId,account_id:$.accountId??null,provider:$.ref.provider,host:Z,path:$.ref.path,external_id:$.externalId??null,default_branch:$.defaultBranch??null,web_url:XG({...$.ref,host:Z}),visibility:$.visibility??null,sandbox_image:$.sandboxImage??null,legacy_connection_id:$.legacyConnectionId??null,created_by:$.createdBy??null}).returningAll().executeTakeFirstOrThrow();return SR(Y)}async get($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?SR(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("repositories").selectAll().where("id","=",$).executeTakeFirst();return Z?SR(Z):null}async findByRef($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("organization_id","=",$).where("host","=",Z.host.toLowerCase()).where(PG6`lower(path)`,"=",Z.path.toLowerCase()).executeTakeFirst();return Q?SR(Q):null}async listByOrg($,Z){let Q=this.db.selectFrom("repositories").selectAll().where("organization_id","=",$);if(Z?.accountId)Q=Q.where("account_id","=",Z.accountId);return(await Q.orderBy("path","asc").execute()).map(SR)}async setSandboxImage($,Z,Q){let Y=await this.db.updateTable("repositories").set({sandbox_image:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).returningAll().executeTakeFirst();return Y?SR(Y):null}async delete($,Z){try{return(await this.db.deleteFrom("repositories").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}catch(Q){if(Q instanceof Error&&"constraint"in Q&&Q.constraint==="org_repo_sync_source_present")throw Error("Remove this repository's sync configurations before unlinking it");throw Q}}}var Jp=L(()=>{a4()});function dh$($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function TG6($,Z){let{owner:Q}=y5(Z),Y=dh$(Z.host),X=new RegExp(`(?:https?://(?:[^@\\s/]*@)?${Y}/|git@${Y}:)${dh$(Q)}/([A-Za-z0-9._-]+)`,"gi");return[...$.matchAll(X)].flatMap((J)=>J[1]?.replace(/\.git$/i,"")||[])}async function ih$($,Z){let{owner:Q,name:Y}=y5(Z),X=new Set,J=[Z.path];while(J.length>0&&X.size<mh$){let G=J.shift();if(!G)break;let W=await $(G,"pubspec.yaml").catch(()=>null);if(!W)continue;for(let K of TG6(W,Z)){if(K===Y||X.has(K))continue;if(X.size>=mh$)break;X.add(K),J.push(`${Q}/${K}`)}}return[...X]}var mh$=20;var ph$=L(()=>{a4()});function th$($){return Bun.hash($).toString(36)}function AG6($){for(let[Z,Q]of Fz)if(Q.expiresAt<=$)Fz.delete(Z);while(Fz.size>=512){let Z=Fz.keys().next();if(Z.done)break;Fz.delete(Z.value)}}function cH1($,Z,Q,Y=Date.now()){AG6(Y),Fz.set(th$($),{owner:Z,expiresAt:Q})}function Gp($,Z=Date.now()){let Q=th$($),Y=Fz.get(Q);if(!Y)return"unknown";if(Y.expiresAt<=Z)return Fz.delete(Q),"unknown";return Y.owner}var nh$="app",lH1="user",Fz;var Wp=L(()=>{Fz=new Map});function Uz($=process.env){let Z=$.GITHUB_APP_ID?.trim(),Q=$.GITHUB_APP_PRIVATE_KEY?.trim(),Y=$.GITHUB_APP_CLIENT_ID?.trim(),X=$.GITHUB_APP_CLIENT_SECRET?.trim(),J=$.GITHUB_APP_SLUG?.trim();if(!Z||!Q||!Y||!X||!J)return null;return{appId:Z,privateKeyPem:Q.replace(/\\n/g,`
+    `.execute(Z.db);let J=X?.metadata?.siteUrl;if(typeof J==="string")mi({siteUrl:J,orgId:$.id,cause:"organization_deleted"});return{success:!0,id:$.id}}})});import{z as F$}from"zod";function CZ($,Z){let Q=$?.[Z];return vJ6.has(Z)?Q!==!1:Q===!0}function cg$($){let Z=$?.auto_resolve_conflicts;return typeof Z==="boolean"?Z:$?.auto_merge===!0}var PD=500,H40,zD,ug$,aE,F40,U40,lg$=50,_J6,N40,B40,IR,vJ6,FO0=262144,xJ6=50,_3=500,fJ6=5000,rE;var JZ=L(()=>{H40=F$.object({title:F$.string().max(PD),url:F$.string().max(PD),icon:F$.string().max(PD)}),zD=F$.object({keyId:F$.string().max(PD),modelId:F$.string().max(PD),title:F$.string().max(PD).optional()}).nullable(),ug$=F$.enum(["fast","smart","thinking","image","web_search","deep_research"]),aE=F$.enum(["fast","smart","thinking"]),F40=F$.object({tiers:F$.object({fast:zD,smart:zD,thinking:zD,image:zD,web_search:zD,deep_research:zD})}),U40=F$.object({tiers:F$.object({fast:zD.optional(),smart:zD.optional(),thinking:zD.optional()})}),_J6=/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/,N40=F$.object({host:F$.string().min(1).max(PD).regex(_J6).describe("Git host, e.g. 'github.com' (bare hostname, no scheme)."),secretId:F$.string().min(1).max(PD).describe("Vault secret id holding the PAT used to authenticate this host.")}),B40=F$.object({ids:F$.array(F$.string().max(PD)).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),IR=F$.object({voice_mode:F$.boolean().optional(),home_task_intake_enabled:F$.boolean().optional().describe("Show Task mode on the Home composer and allow reports to start tasks."),demo_mode:F$.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:F$.boolean().optional().describe("Curated Deco Score look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),reviewer_enabled:F$.boolean().optional().describe("Run the Reviewer on a task's pull request once it's In Review \u2014 it reviews the code with the repo's stack-appropriate skills, fixes what it finds on the PR's own branch, then exercises the change on the deploy preview and approves or hands the card to a human."),qa_agent_enabled:F$.boolean().optional().describe("Deprecated: see reviewer_enabled."),code_reviewer_enabled:F$.boolean().optional().describe("Deprecated: see reviewer_enabled."),auto_merge:F$.boolean().optional().describe("When the Reviewer approves a task's pull request, merge it automatically instead of leaving the merge to a human."),auto_resolve_conflicts:F$.boolean().optional().describe("When an approved pull request can't be merged because it conflicts with its base branch, hand it back to the Super Agent to resolve the conflict (check out the branch, merge the base, push). Unset, it follows `auto_merge`; set it explicitly to run one without the other."),cheap_reviewer_model:F$.boolean().optional().describe("Run the Reviewer on a cheaper model than the Super Agent that wrote the code. On by default \u2014 turning it off trades cost for some review depth."),coding_agent_org_mcps:F$.boolean().optional().describe("Give a coding-agent run (the claude-code harness in a sandbox) every MCP connection in the org as its own MCP server, on top of the narrow task-run surface it always gets. Off by default: each connection is one more server the agent connects to at session start, and all of their tools land in its context."),coding_agents_claude_code:F$.boolean().optional().describe("Run chats on a Code Agent (an agent imported from a GitHub repo) with the claude-code harness inside its sandbox, instead of hosted Decopilot. Off by default: it changes the runtime of every such chat, and claude-code flushes whole turns rather than streaming tokens."),auto_assign_report_tasks_to_super_agent:F$.boolean().optional().describe("When a Deco Score import creates a task board item without an assignee, delegate it to the Super Agent automatically instead of leaving it unassigned."),hosting_enabled:F$.boolean().optional().describe("Per-site Hosting tab (deployments, domains, deploy outcomes). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),deco_analytics_enabled:F$.boolean().optional().describe("Per-site Deco Analytics tab (traffic, realtime, usage & limits). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),e2e_enabled:F$.boolean().optional().describe("Per-site E2E tab (end-to-end test runs). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),experiments_enabled:F$.boolean().optional().describe("Per-site Experiments tab (A/B tests + variant results). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org."),monitor_enabled:F$.boolean().optional().describe("Per-site Monitor tab (CDN Performance + Audience from the stats-lake warehouse). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. Its own deployment-wide switch `MONITOR_GA` opens it to every org at once (independent of the control-plane trio)."),site_create_enabled:F$.boolean().optional().describe('The "Create a new site" option under New project: generates a GitHub repository from a site template in an account the org connected, and opens it as a project. Off by default, for every org \u2014 deco.cx staff included.'),delivery_lanes_enabled:F$.boolean().optional().describe("Board lanes for shipping: Approved, Merged and Post-deploy Validation sit between In Review and Done, and a merged pull request lands on Merged instead of Done. For teams whose release process continues after the merge. Off by default \u2014 with it off the board and the state machine behave exactly as if the lanes did not exist."),new_blocks_editor:F$.boolean().optional().describe("Use the redesigned blocks editor for every member of the organization. Off by default \u2014 the classic editor stays until an admin opts the org in.")}),vJ6=new Set(["reviewer_enabled","cheap_reviewer_model"]);rE=F$.object({id:F$.string().describe("Brand context ID"),name:F$.string().max(_3).describe("Company name"),domain:F$.string().max(_3).describe("Company domain (e.g. example.com)"),overview:F$.string().max(fJ6).describe("Company overview / description"),logo:F$.string().max(_3).nullable().optional().describe("Logo URL"),favicon:F$.string().max(_3).nullable().optional().describe("Favicon URL"),ogImage:F$.string().max(_3).nullable().optional().describe("OG image URL"),fonts:F$.object({heading:F$.string().max(_3).optional().describe("Font family for headings"),body:F$.string().max(_3).optional().describe("Font family for body text"),code:F$.string().max(_3).optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:F$.object({primary:F$.string().max(_3).optional().describe("Primary brand color (hex)"),secondary:F$.string().max(_3).optional().describe("Secondary brand color (hex)"),accent:F$.string().max(_3).optional().describe("Accent / highlight color (hex)"),background:F$.string().max(_3).optional().describe("Background color (hex)"),foreground:F$.string().max(_3).optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:F$.array(F$.record(F$.string(),F$.unknown())).max(xJ6).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=FO0,{message:`images must serialize to at most ${FO0} bytes`}).describe("Brand images"),metadata:F$.record(F$.string(),F$.unknown()).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=FO0,{message:`metadata must serialize to at most ${FO0} bytes`}).describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:F$.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:F$.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as TD}from"zod";var $H1;var mg$=L(()=>{_0();JZ();$H1=m({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TD.object({}),outputSchema:TD.object({organizationId:TD.string(),sidebar_items:TD.array(H40).nullable().optional(),coding_agent_mcp_excluded:TD.array(TD.string()).nullable().optional(),simple_mode:F40.nullable().optional(),default_home_agents:B40.nullable().optional(),flags:IR.nullable().optional(),submodule_credentials:TD.array(N40).nullable().optional(),createdAt:TD.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:TD.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.organizationSettings.get(Q);if(!Y)return{organizationId:Q};return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as ZH1}from"zod";var QH1;var dg$=L(()=>{_0();QH1=m({name:"ORGANIZATION_HAS_SITE",description:"Whether this organization owns at least one legacy deco.cx site. Boolean only \u2014 does not expose site slugs.",annotations:{title:"Has Owned Site",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ZH1.object({}),outputSchema:ZH1.object({hasSite:ZH1.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{hasSite:(await Z.storage.orgSites.listByOrg(Q.id)).length>0}}})});import{z as aY}from"zod";var bJ6=50,yJ6=100,gJ6=500,ig$=500,YH1;var pg$=L(()=>{_0();JZ();YH1=m({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:aY.object({organizationId:aY.string().min(1,"organizationId is required"),sidebar_items:aY.array(H40).max(bJ6).optional(),coding_agent_mcp_excluded:aY.array(aY.string().max(ig$)).max(gJ6).optional().describe("Connection ids a coding-agent run must not mount, even with `coding_agent_org_mcps` on. Replaces the stored list; pass [] to clear it."),simple_mode:F40.optional(),default_home_agents:B40.extend({ids:aY.array(aY.string().max(ig$)).max(yJ6)}).optional(),flags:IR.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),submodule_credentials:aY.array(N40).max(lg$).refine(($)=>new Set($.map((Z)=>Z.host)).size===$.length,"Each git credential host must be unique.").optional().describe("Per-host PATs (as vault secret ids) every sandbox in the org installs in its git config. Replaces the stored list; pass [] to clear it.")}),outputSchema:aY.object({organizationId:aY.string(),sidebar_items:aY.array(H40).nullable().optional(),coding_agent_mcp_excluded:aY.array(aY.string()).nullable().optional(),simple_mode:F40.nullable().optional(),default_home_agents:B40.nullable().optional(),flags:IR.nullable().optional(),submodule_credentials:aY.array(N40).nullable().optional(),createdAt:aY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:aY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(o(Z),await Z.access.check(),W0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Y=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,coding_agent_mcp_excluded:$.coding_agent_mcp_excluded,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,submodule_credentials:$.submodule_credentials});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as UO0}from"zod";var XH1;var ng$=L(()=>{JZ();_0();XH1=m({name:"ORGANIZATION_BLOCKS_EDITOR_SET",description:"Turn the redesigned blocks editor on or off for every member of the organization.",annotations:{title:"Set Blocks Editor",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:UO0.object({enabled:UO0.boolean().describe("Whether the org uses the new blocks editor.")}),outputSchema:UO0.object({enabled:UO0.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationSettings.upsert(Q.id,{flags:{new_blocks_editor:$.enabled}});return{enabled:CZ(Y.flags,"new_blocks_editor")}}})});import{z as NF}from"zod";var tg$,JH1,GH1;var og$=L(()=>{_0();JZ();tg$=rE.extend({organizationId:NF.string(),archivedAt:NF.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:NF.string().describe("ISO 8601 timestamp"),updatedAt:NF.string().describe("ISO 8601 timestamp")}),JH1=m({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NF.object({includeArchived:NF.boolean().optional().describe("Include archived brands in the list")}),outputSchema:NF.object({items:NF.array(tg$)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q,{includeArchived:$.includeArchived})).map((X)=>({...X,archivedAt:X.archivedAt instanceof Date?X.archivedAt.toISOString():X.archivedAt,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,updatedAt:X.updatedAt instanceof Date?X.updatedAt.toISOString():X.updatedAt}))}}}),GH1=m({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NF.object({id:NF.string().describe("Brand context ID")}),outputSchema:tg$.extend({organizationId:NF.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.get($.id,Q);if(!Y)throw Error("Brand context not found");return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as VR}from"zod";var ag$,WH1,KH1,HH1;var rg$=L(()=>{_0();JZ();ag$=rE.extend({organizationId:VR.string(),createdAt:VR.string().describe("ISO 8601 timestamp"),updatedAt:VR.string().describe("ISO 8601 timestamp")}),WH1=m({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:rE.omit({id:!0}),outputSchema:ag$,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.create(Q,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}}),KH1=m({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rE.partial().required({id:!0}),outputSchema:ag$,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");let{id:X,...J}=$;if(J.isDefault===!0)await Z.storage.brandContext.setDefault(X,Q);let G=await Z.storage.brandContext.update(X,Q,{name:J.name,domain:J.domain,overview:J.overview,logo:J.logo!==void 0?J.logo??null:void 0,favicon:J.favicon!==void 0?J.favicon??null:void 0,ogImage:J.ogImage!==void 0?J.ogImage??null:void 0,fonts:J.fonts!==void 0?J.fonts??null:void 0,colors:J.colors!==void 0?J.colors??null:void 0,images:J.images!==void 0?J.images??null:void 0,metadata:J.metadata!==void 0?J.metadata??null:void 0,archivedAt:J.archivedAt!==void 0?J.archivedAt??null:void 0,isDefault:J.isDefault===!1?!1:void 0});return{...G,archivedAt:G.archivedAt instanceof Date?G.archivedAt.toISOString():G.archivedAt,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,updatedAt:G.updatedAt instanceof Date?G.updatedAt.toISOString():G.updatedAt}}}),HH1=m({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:VR.object({id:VR.string().describe("Brand context ID")}),outputSchema:VR.object({success:VR.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,Q,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function NO0($,Z,Q){let Y=$.trim();if(!Y.startsWith("http"))Y=`https://${Y}`;let X=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Y,formats:["branding"]})});if(!X.ok){let N=await X.text().catch(()=>"");throw Error(`Firecrawl API error: ${X.status} ${N.slice(0,200)}`)}let J=await X.json();if(!J.success||!J.data?.branding)return null;let G=J.data.branding,W=J.data.metadata??{},K=lJ6(G,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??W.ogSiteName??Q??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function lJ6($,Z){let Q=$.images??{},Y=$.colors??{},X={};for(let[F,U]of Object.entries(Y))if(typeof U==="string"&&U&&hJ6.has(F))X[F]=U;let J={},W=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(W))if(typeof U==="string"&&U){let N=uJ6[F.toLowerCase()];if(N&&!J[N])J[N]=U}let K=$.fonts;if(Array.isArray(K))for(let F of K){let U=F.family;if(typeof U==="string"&&U&&!J.body)J.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:Q.logo??null,favicon:Q.favicon??null,ogImage:Q.ogImage??Z.ogImage??null,fonts:Object.keys(J).length>0?J:null,colors:Object.keys(X).length>0?X:null,metadata:H}}var hJ6,uJ6;var FH1=L(()=>{hJ6=new Set(["primary","secondary","accent","background","foreground"]),uJ6={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as BO0}from"zod";var cJ6,UH1;var sg$=L(()=>{_0();FH1();JZ();cJ6=rE.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:BO0.boolean()}),UH1=m({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:BO0.object({domain:BO0.string().describe("Website domain to extract brand from"),brandId:BO0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:cJ6,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=Z.firecrawlApiKey;if(!Y)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let X=await NO0($.domain,Y,$.domain);if(!X)throw Error("Firecrawl did not return branding data for this URL");let J={name:X.name,domain:X.domain,overview:X.overview,logo:X.logo,favicon:X.favicon,ogImage:X.ogImage,fonts:X.fonts,colors:X.colors,images:X.images,metadata:X.metadata},G=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,Q))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,Q,J)})():await Z.storage.brandContext.create(Q,J);return{id:G.id,name:G.name,domain:G.domain,overview:G.overview,logo:G.logo,favicon:G.favicon,ogImage:G.ogImage,fonts:G.fonts,colors:G.colors,success:!0}}})});function eg$($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let Q=Object.fromEntries(Object.entries(Z).filter(([Y])=>Y!=="tagline"&&Y!=="tone"));return Object.keys(Q).length>0?Q:void 0})()}}var NH1,BH1;var $h$=L(()=>{FK1();_0();NH1=m({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gD0,outputSchema:a80,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=$.id?await Z.storage.brandContext.get($.id,Q):await Z.storage.brandContext.getDefault(Q);if(!Y)throw Error($.id?"Brand not found":"No default brand configured");return eg$(Y)}}),BH1=m({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hD0,outputSchema:uD0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q)).map(eg$)}}})});import{resolveTxt as mJ6}from"dns/promises";function LH1($){return`${dJ6}.${$.toLowerCase()}`}function Zh$(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function Qh$($,Z,Q=mJ6){if(!Z)return!1;try{return(await Q(LH1($))).some((X)=>X.join("").trim()===Z)}catch{return!1}}var dJ6="_deco-verify";var Yh$=()=>{};import{z as i9}from"zod";function sE($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?LH1($.domain):null,recordValue:Z?$.verificationToken:null}}function pJ6($){let Z=$.toLowerCase().trim();if(!iJ6.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(BF.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var iJ6,Xh$=50,DH1,LO0,OH1,jH1,wH1,EH1,zH1;var Jh$=L(()=>{v3();Yh$();_0();iJ6=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,DH1=i9.enum(["off","auto","request"]),LO0=i9.object({id:i9.string(),domain:i9.string(),joinMode:DH1,verificationStatus:i9.enum(["pending","verified"]),verificationMethod:i9.enum(["email","dns"]).nullable(),verifiedAt:i9.string().nullable(),recordName:i9.string().nullable(),recordValue:i9.string().nullable()});OH1=m({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({}),outputSchema:i9.object({domains:i9.array(LO0)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(Q.id)).map(sE)}}}),jH1=m({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({domain:i9.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:DH1.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:LO0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=pJ6($.domain),J=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),G=Boolean(Z.auth.user?.emailVerified)&&J===Y,W=await Z.storage.organizationDomains.getByOrgAndDomain(Q.id,Y);if(W){if(W.verificationStatus!=="verified"&&G){let F=await Z.storage.organizationDomains.markVerified(W.id,"email");return sE(F)}return sE(W)}if((await Z.storage.organizationDomains.listByOrganizationId(Q.id)).length>=Xh$)throw Error(`An organization can claim at most ${Xh$} domains.`);let H=G?await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:"off",verificationStatus:"pending",verificationToken:Zh$()});return sE(H)}}),wH1=m({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({id:i9.string(),joinMode:DH1}),outputSchema:LO0,handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if($.joinMode!=="off"&&Y.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let X=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return sE(X)}}),EH1=m({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:i9.object({id:i9.string()}),outputSchema:i9.object({verified:i9.boolean(),domain:LO0}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if(Y.verificationStatus==="verified")return{verified:!0,domain:sE(Y)};if(!Y.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await Qh$(Y.domain,Y.verificationToken))return{verified:!1,domain:sE(Y)};let J=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:sE(J)}}}),zH1=m({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:i9.object({id:i9.string()}),outputSchema:i9.object({success:i9.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function eE($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as rZ}from"zod";var nJ6,PH1,TH1,AH1;var Gh$=L(()=>{_0();F6();nJ6=rZ.object({id:rZ.string(),userId:rZ.string(),status:rZ.enum(["pending","approved","denied"]),createdAt:rZ.string(),user:rZ.object({id:rZ.string(),name:rZ.string(),email:rZ.string(),image:rZ.string().nullable()}).nullable()}),PH1=m({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({}),outputSchema:rZ.object({requests:rZ.array(nJ6)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(Q.id)).map((X)=>({id:X.id,userId:X.userId,status:X.status,createdAt:new Date(X.createdAt).toISOString(),user:X.user}))}}}),TH1=m({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({requestId:rZ.string()}),outputSchema:rZ.object({success:rZ.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=t0(Z);if(!await Z.storage.organizationJoinRequests.decide(Y.id,"approved",X??Y.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:Q.id,userId:Y.userId,role:["user"]})}catch(G){if(!eE(G))throw G}if(X)h1.capture({distinctId:X,event:"organization_join_request_approved",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}}),AH1=m({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:rZ.object({requestId:rZ.string()}),outputSchema:rZ.object({success:rZ.boolean()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=t0(Z);if(await Z.storage.organizationJoinRequests.decide(Y.id,"denied",X??Y.userId)&&X)h1.capture({distinctId:X,event:"organization_join_request_denied",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}})});import{z as KG}from"zod";var RH1;var Wh$=L(()=>{F6();_0();fY();RH1=m({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:KG.object({organizationId:KG.string().optional(),userId:KG.string(),role:KG.array(KG.string())}),outputSchema:KG.object({id:KG.string(),organizationId:KG.string(),userId:KG.string(),role:KG.union([KG.string(),KG.array(KG.string())]),createdAt:KG.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",t0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!rF0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let X=await Z.boundAuth.organization.addMember({organizationId:Q,userId:$.userId,role:$.role});if(!X)throw Error("Failed to add member");let J=t0(Z);if(J)h1.capture({distinctId:J,event:"organization_member_added",groups:{organization:Q},properties:{organization_id:Q,added_user_id:$.userId,role:$.role}});return{...X,role:X.role,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});import{z as ei}from"zod";var qH1;var Kh$=L(()=>{F6();_0();qH1=m({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ei.object({organizationId:ei.string().optional(),memberIdOrEmail:ei.string()}),outputSchema:ei.object({success:ei.boolean(),memberIdOrEmail:ei.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.boundAuth.organization.removeMember({organizationId:Q,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Y.member.userId,Q);let X=t0(Z);if(X)h1.capture({distinctId:X,event:"organization_member_removed",groups:{organization:Q},properties:{organization_id:Q,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as rY}from"zod";var MH1;var Hh$=L(()=>{_0();MH1=m({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:rY.object({limit:rY.number().int().min(1).max(1000).optional(),offset:rY.number().int().min(0).optional()}),outputSchema:rY.object({members:rY.array(rY.object({id:rY.string(),organizationId:rY.string(),userId:rY.string(),role:rY.string(),createdAt:rY.string().datetime().describe("ISO 8601 timestamp"),user:rY.object({id:rY.string(),name:rY.string(),email:rY.string(),image:rY.string().optional()}).optional()}))}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{members:(await Z.db.selectFrom("member").innerJoin("user","user.id","member.userId").select(["member.id as id","member.organizationId as organizationId","member.userId as userId","member.role as role","member.createdAt as createdAt","user.name as name","user.email as email","user.image as image"]).where("member.organizationId","=",Q).orderBy("member.createdAt","asc").orderBy("member.id","asc").limit($.limit??100).offset($.offset??0).execute()).map((J)=>({id:J.id,organizationId:J.organizationId,userId:J.userId,role:J.role,createdAt:new Date(J.createdAt).toISOString(),user:{id:J.userId,name:J.name,email:J.email,image:J.image??void 0}}))}}})});import{z as wQ}from"zod";var IH1;var Fh$=L(()=>{F6();_0();fY();IH1=m({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:wQ.object({organizationId:wQ.string().optional(),memberId:wQ.string(),role:wQ.array(wQ.string())}),outputSchema:wQ.object({id:wQ.string(),organizationId:wQ.string(),userId:wQ.string(),role:wQ.union([wQ.string(),wQ.array(wQ.string())]),createdAt:wQ.string().datetime().describe("ISO 8601 timestamp"),user:wQ.object({email:wQ.string(),name:wQ.string(),image:wQ.string().optional()})}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",t0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!rF0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);if(!$.role.includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("id","=",$.memberId).where("organizationId","=",Q).executeTakeFirst())?.role.split(",").includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("organizationId","=",Q).execute()).filter((H)=>H.role.split(",").includes("owner")).length<=1)throw Error("Cannot remove the organization's last owner. Assign another owner first.")}}let X=await Z.boundAuth.organization.updateMemberRole({organizationId:Q,memberId:$.memberId,role:$.role});if(!X)throw Error("Failed to update member role");Z.invalidateMemberRole?.(X.userId,Q);let J=t0(Z);if(J)h1.capture({distinctId:J,event:"organization_member_role_updated",groups:{organization:Q},properties:{organization_id:Q,member_id:$.memberId,target_user_id:X.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...X,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});async function Uh$(){if(L40&&Date.now()-L40.fetchedAt<600000)return L40.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),Q=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(Q)||Q<=0)throw Error("Invalid rate");return L40={rate:Q,fetchedAt:Date.now()},Q}catch{return L40?.rate??5.5}}function Nh$($,Z,Q){if(Z==="brl")return Math.round($/Q);return $}var L40=null;function VH1($,Z="",Q=new URLSearchParams){for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;let J=Z?`${Z}[${Y}]`:Y;if(Array.isArray(X))X.forEach((G,W)=>{if(typeof G==="object"&&G!==null)VH1(G,`${J}[${W}]`,Q);else Q.append(`${J}[${W}]`,String(G))});else if(typeof X==="object")VH1(X,J,Q);else Q.append(J,String(X))}return Q}async function AD($,Z){let Q=P0().stripeSecretKey;if(!Q)throw new sZ(503,"billing is not configured");let Y=Z?.params?VH1(Z.params).toString():void 0,X=await fetch(`${tJ6}${$}`,{method:Z?.method??(Y?"POST":"GET"),headers:{Authorization:`Bearer ${Q}`,...Y&&{"Content-Type":"application/x-www-form-urlencoded"},...Z?.idempotencyKey&&{"Idempotency-Key":Z.idempotencyKey}},body:Y,signal:AbortSignal.timeout(oJ6)}),J=await X.json().catch(()=>({}));if(!X.ok){let G=J.error?.message??`HTTP ${X.status}`;throw new sZ(X.status,G)}return J}function Bh$($){return{billing_address_collection:"required",custom_fields:[{key:aJ6,label:{type:"custom",custom:"CPF / CNPJ"},type:"text",optional:!1,text:{minimum_length:rJ6,maximum_length:sJ6}}],...$&&{customer_update:{address:"auto",name:"auto"}}}}function Lh$($){return Boolean((P0().stripePlanPriceIds??{})[$])}function kH1($){let Z=P0().stripePlanPriceIds??{};return Object.entries(Z).find(([,Q])=>Q===$)?.[0]}function eJ6($){return["checkout",$.organizationId,$.planId??"flat",$.lastStripeEventAt?.getTime()??0].join(":")}async function Dh$($){let Z=P0(),Q=$.planId?kH1($.planId):Z.stripeOrgPriceId;if(!Q)throw new sZ(503,$.planId?`plan '${$.planId}' has no Stripe price configured`:"billing is not configured");let Y=await AD("/checkout/sessions",{idempotencyKey:eJ6({organizationId:$.organizationId,...$.planId?{planId:$.planId}:{},...$.lastStripeEventAt!==void 0&&{lastStripeEventAt:$.lastStripeEventAt}}),params:{mode:"subscription",...Bh$(null),line_items:[{price:Q,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}},subscription_data:{billing_cycle_anchor_config:{day_of_month:1,hour:0,minute:0,second:0},metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}}}}});if(!Y.url)throw new sZ(500,"checkout session lacks url");return{url:Y.url}}function $G6($,Z){return Math.round($*(1+Z/100))}function QG6($){let Z=Math.floor(($.nowMs??Date.now())/ZG6);return["topup",$.organizationId,$.currency,$.amountCents,Z].join(":")}async function Oh$($){let Z=$G6($.amountCents,$.feePercent),Q=Nh$($.amountCents,$.currency,await Uh$()),Y=P0().stripeTopupProductId,X={kind:"topup",orgId:$.organizationId,creditCents:Q},J=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,G=await AD("/checkout/sessions",{idempotencyKey:QG6({organizationId:$.organizationId,amountCents:$.amountCents,currency:$.currency}),params:{mode:"payment",...$.customerId&&{customer:$.customerId},...Bh$($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Y?{product:Y}:{product_data:{name:J}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:X,payment_intent_data:{metadata:X}}});if(!G.url)throw new sZ(500,"checkout session lacks url");return{url:G.url}}async function DO0($){let Z=await AD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new sZ(500,"portal session lacks url");return{url:Z.url}}async function jh$($){let Z=await AD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl,...P0().stripePortalConfigurationId&&{configuration:P0().stripePortalConfigurationId},flow_data:{type:"subscription_update_confirm",subscription_update_confirm:{subscription:$.subscriptionId,items:[{id:$.subscriptionItemId,price:$.priceId}]},after_completion:{type:"redirect",redirect:{return_url:$.returnUrl}}}}});if(!Z.url)throw new sZ(500,"portal session lacks url");return{url:Z.url}}async function wh$($){return AD(`/prices/${encodeURIComponent($)}`)}async function $z($){return AD(`/subscriptions/${encodeURIComponent($)}`)}async function Eh$($){await AD(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}async function zh$($){let Z=await AD(`/invoices?subscription=${encodeURIComponent($)}&status=paid&limit=100`),Q=YG6($,Z.data??[]);for(let Y of Q)await AD("/refunds",{params:{payment_intent:Y.paymentIntent,reason:"duplicate"},idempotencyKey:Y.idempotencyKey});return{refundedCents:Q.reduce((Y,X)=>Y+X.amountCents,0)}}function YG6($,Z){let Q=[];for(let Y of Z){let X=Y.amount_paid??0;if(X<=0)continue;let J=typeof Y.payment_intent==="string"?Y.payment_intent:Y.payment_intent?.id;if(!J)continue;Q.push({paymentIntent:J,amountCents:X,idempotencyKey:`orphan-refund:${$}:${Y.id??J}`})}return Q}var tJ6="https://api.stripe.com/v1",sZ,oJ6=15000,aJ6="taxid",rJ6=11,sJ6=18,ZG6=120000;var RD=L(()=>{Y$();sZ=class sZ extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as OO0}from"zod";async function XG6($){if(!$.planId)throw Error("This organization already has an active subscription.");let Z=kH1($.planId);if(!Z)throw new sZ(503,`plan '${$.planId}' has no Stripe price configured`);let Q=await $z($.subscriptionId),Y=(Q.items?.data??[]).filter((G)=>G.price?.id?Lh$(G.price.id):!1),X=Y[0];if(Y.length>1)throw Error("This organization's subscription has more than one plan line \u2014 change it in Stripe, not here.");if(!X?.id)throw new sZ(500,"subscription has no plan line to move to another price");if(X.price?.id===Z)throw Error("This organization is already on that plan.");let{url:J}=await jh$({customerId:Q.customer,subscriptionId:$.subscriptionId,subscriptionItemId:X.id,priceId:Z,returnUrl:$.returnUrl});return J}var CH1;var Ph$=L(()=>{RD();A9();_0();F6();CH1=m({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:OO0.object({planId:OO0.string().optional()}),outputSchema:OO0.object({url:OO0.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id,Y=Z.organization?.slug;if(!Q||!Y)throw Error("Organization context required");let X=await Z.storage.organizationBilling.getBilling(Q),J=`${a5()}${dE(Y,"members")}`;if(X?.status==="active"&&X.stripeSubscriptionId){let W=await XG6({subscriptionId:X.stripeSubscriptionId,planId:$.planId,returnUrl:`${J}?checkout=updated`});return gY({event:"subscription_plan_change_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:W}}if(X?.status==="active")throw Error("This organization already has an active subscription.");if(X?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let{url:G}=await Dh$({organizationId:Q,successUrl:`${J}?checkout=success`,cancelUrl:`${J}?checkout=canceled`,...$.planId?{planId:$.planId}:{},lastStripeEventAt:X?.lastStripeEventAt??null});return gY({event:"subscription_checkout_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:G}}})});import{z as Zz}from"zod";async function KG6(){if(D40&&Date.now()-D40.at<D40.ttlMs)return D40.prices;let $=new Set,Z=Object.entries(P0().stripePlanPriceIds??{}).filter(([,J])=>{if($.has(J))return!1;return $.add(J),!0}),Y=(await Promise.all(Z.map(async([J,G])=>{try{let W=await wh$(J);if(W.unit_amount===null)return null;return{planId:G,amountCents:W.unit_amount,currency:W.currency,interval:W.recurring?.interval??null}}catch(W){return console.warn(`plan price ${J} (${G}) unreadable:`,W instanceof sZ?W.message:W),null}}))).filter((J)=>J!==null),X=Y.length===Z.length;return D40={at:Date.now(),prices:Y,ttlMs:X?GG6:WG6},Y}var JG6,GG6=600000,WG6=30000,D40=null,SH1;var Th$=L(()=>{RD();_0();Y$();JG6=Zz.object({planId:Zz.string(),amountCents:Zz.number(),currency:Zz.string(),interval:Zz.string().nullable()});SH1=m({name:"ORGANIZATION_BILLING_PLAN_PRICES",description:"The monthly price of each purchasable plan, read from Stripe. Empty when no plan prices are configured.",annotations:{title:"Plan Prices",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Zz.object({}),outputSchema:Zz.object({prices:Zz.array(JG6)}),handler:async($,Z)=>{return o(Z),await Z.access.check(),{prices:await KG6()}}})});import{z as _H1}from"zod";var vH1;var Ah$=L(()=>{RD();A9();_0();vH1=m({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:_H1.object({}),outputSchema:_H1.object({url:_H1.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z);if(!Q.slug)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(Q.id);if(!Y?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await DO0({customerId:Y.stripeCustomerId,returnUrl:`${a5()}${dE(Q.slug,"members")}`})}catch(X){if(X instanceof sZ)throw Error(X.message);throw X}}})});function jO0($){return xH1[$%xH1.length]??HG6}function EQ($){return $.createdBy==="system"}function UG6($){if($?.reviewer_enabled===void 0&&$?.qa_agent_enabled===!1&&$?.code_reviewer_enabled===!1)return!1;return CZ($,"reviewer_enabled")}function qD($){return UG6($)?DK:[]}function NG6($){return CZ($,"delivery_lanes_enabled")}function kN($){return NG6($)?"merged":"done"}function Yz($,Z){if(!$)return!1;return[VN[Z],...FG6].some((Q)=>$.startsWith(`${Q}:`))}function MD($,Z){if(Z)return new Date(Z).getTime();let Q=0;for(let Y of $){if(Y.action!=="status_changed")continue;if(Y.data?.to!=="in_review")continue;Q=Math.max(Q,new Date(Y.occurredAt).getTime())}return Q}function Mh$($,Z,Q){let X=$.filter((J)=>J.action==="status_changed").at(-1);if(!X)return Q;return X.data?.to===Z?X.occurredAt:null}function Xz($,Z){let Q=MD($,Z.cycleStartedAt),Y=new Map;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;if(new Date(X.occurredAt).getTime()<Q)continue;let J=X.data??{};if(J.reviewer!=="reviewer")continue;if(X.action==="review_approved"){if(Z?.verifiedOnly&&J.verified!==!0)continue;Y.set("reviewer","approved")}else Y.set("reviewer","changes_requested")}return Y}function Qz($,Z,Q){if(Z.length===0)return!1;let Y=Xz($,Q);return Z.every((X)=>Y.get(X)==="approved")}function Ih$($,Z,Q){return Qz($,Z,Q)&&!Qz($,Z,{...Q,verifiedOnly:!0})}function Vh$($){let Z=null;for(let Q of $){if(Q.action!=="review_approved"&&Q.action!=="review_changes_requested")continue;let Y=new Date(Q.occurredAt).getTime();if(Z&&Y<Z.at)continue;let X=Q.data?.notes;Z={at:Y,notes:Q.action==="review_changes_requested"&&typeof X==="string"?X:null}}return Z?.notes??null}function vh$($,Z=Date.now()){if($.state!==null&&$.state!=="open")return!1;if($.state===null)return!0;if($.checksStatus==="pending")return!0;if($.previewUrl!==null)return!1;let Q=$.updatedAt?Date.parse($.updatedAt):Number.NaN;return Number.isFinite(Q)&&Z-Q<BG6}var V8="super-agent",xH1,HG6,O40='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',Rh$,fH1="chore",DK,VN,FG6,j40="NO VISUAL SURFACE",LF,I$,qh$,wO0,kh$="task-board.item.updated",Ch$="task-board.item.deleted",Sh$="task-board.item.prs.updated",_h$=4000,BG6=600000;var u4=L(()=>{JZ();xH1=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],HG6=xH1[0];Rh$="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",DK=["reviewer"],VN={reviewer:"Reviewer"},FG6=["QA Agent","Code Reviewer"];LF=["triage","todo","in_progress","in_review","approved","merged","post_deploy_validation","done","archived"],I$={intake:"triage",queue:"todo",progress:"in_progress",review:"in_review",archive:"archived"},qh$=LF.map(($,Z)=>({key:$,title:$,position:Z})),wO0=["approved","merged","post_deploy_validation"]});function bH1($){return $==="trial"?"trial":"subscription"}function w40($,Z,Q,Y={}){gY({event:Z,organizationId:Q.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:Q.id,...Y}})}function yH1($){return $?.status==="active"||$?.status==="past_due"}function EO0($,Z){if(yH1($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function E40(){let $=P0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function Jz(){return{...E40(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function $p($,Z,Q=E40()){if(!Q.enforced||!EQ(Z))return;let Y=await $.storage.organizationBilling.taskClaim(Z.id);if(Y&&Y.runCount>=Q.maxRunsPerTask)throw w40($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new eX("runs_exhausted");if(Y&&Y.state!=="released")return;let X=await $.storage.organizationBilling.getBilling(Z.organizationId),J=EO0(X,Q);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,J.periodKey)>=J.limit)throw w40($,"task_quota_blocked",Z,{phase:"precheck",reason:J.exhaustedReason,billing_mode:bH1(J.periodKey),limit:J.limit}),new eX(J.exhaustedReason)}async function xh$($,Z,Q=E40()){if(!Q.enforced||!EQ(Z))return"skipped";let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),X=EO0(Y,Q),J=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,X.periodKey,X.limit,Q.maxRunsPerTask);if(J==="exhausted")throw w40($,"task_quota_blocked",Z,{phase:"claim",reason:X.exhaustedReason,billing_mode:bH1(X.periodKey),limit:X.limit}),new eX(X.exhaustedReason);if(J==="runs_exhausted")throw w40($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new eX("runs_exhausted");if(J==="claimed")w40($,"task_quota_claimed",Z,{billing_mode:bH1(X.periodKey),period_key:X.periodKey,limit:X.limit});return J}async function fh$($,Z,Q,Y){if(Y==="skipped")return;await $.rollbackTaskClaim(Z,Q,{releaseSlot:Y==="claimed"}).catch((X)=>console.error("[task-quota] rollback failed (stays charged)",X))}async function bh$($,Z){let Q=await $.storage.organizationBilling.taskClaim(Z);return!!Q&&Q.state!=="released"}async function yh$($,Z,Q){if(await $.releaseTaskClaim(Z,Q).catch((X)=>{return console.error("[task-quota] refund failed (stays charged)",X),!1}))gY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:Q}})}var LG6="[SUBSCRIPTION_REQUIRED]",DG6,eX;var OK=L(()=>{u4();F6();Y$();DG6={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};eX=class eX extends Error{reason;constructor($){super(`${LG6} ${DG6[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as ID}from"zod";var gH1;var gh$=L(()=>{_0();OK();gH1=m({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ID.object({}),outputSchema:ID.object({enforced:ID.boolean(),billingStatus:ID.string(),subscribed:ID.boolean(),hasBillingAccount:ID.boolean(),used:ID.number(),limit:ID.number(),currentPeriodEnd:ID.string().datetime().nullable()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=E40(),X=await Z.storage.organizationBilling.getBilling(Q.id),J=EO0(X,Y),G=await Z.storage.organizationBilling.countTaskClaims(Q.id,J.periodKey);return{enforced:Y.enforced,billingStatus:X?.status??"none",subscribed:yH1(X),hasBillingAccount:!!X?.stripeCustomerId,used:G,limit:J.limit,currentPeriodEnd:X?.currentPeriodEnd?.toISOString()??null}}})});var hh$=L(()=>{fg$();bg$();yg$();gg$();hg$();mg$();dg$();pg$();ng$();og$();rg$();sg$();$h$();Jh$();Gh$();Wh$();Kh$();Hh$();Fh$();Ph$();Th$();Ah$();gh$()});function jK($){let Z=$?.status;return typeof Z==="number"?Z:null}function uh$($){let Z=$;if(Z?.isRateLimited!==!0)return;return typeof Z.retryAfterMs==="number"?Z.retryAfterMs:null}async function HG($,Z){let Q=await $.getBranch(Z);if(Q)return Q.sha;throw new g0({provider:$.repo.provider,status:404,message:`Branch ${Z} does not exist in ${$.repo.path}`})}var X5;var z40=L(()=>{S5();X5=class X5 extends Error{constructor($,Z){super($,Z);this.name="RepoWriteConflict"}}});function Zp($){if($.length===0)return null;let Z=!1;for(let Q of $){if(Q.state!=="completed"){Z=!0;continue}if(Q.conclusion&&jG6.has(Q.conclusion))return"failing"}return Z?"pending":"passing"}var jG6,kR;var P40=L(()=>{jG6=new Set(["failure","cancelled","timed_out","action_required"]);kR=class kR extends Error{existing;constructor($,Z){super($);this.name="ChangeRequestExists",this.existing=Z}}});function Qp($){return wG6.test($.trim())}function eZ($,Z,Q){if($===void 0||!Number.isFinite($)||$<=0)return Math.min(Z,Q);return Math.min(Math.floor($),Q)}async function Yp($,Z){let Q=$.headers.get("content-length"),Y=Q===null?Number.NaN:Number(Q),X=Number.isFinite(Y)&&Y>=0?Y:null,J=$.body;if(!J)return{content:"",size:X??0,truncated:!1};let G=J.getReader(),W=[],K=0,H=!1;try{for(;;){let{done:U,value:N}=await G.read();if(U)break;if(!N)continue;let B=Z-K;if(N.byteLength>=B){W.push(N.subarray(0,B)),K+=B,H=N.byteLength>B||!(await G.read()).done;break}W.push(N),K+=N.byteLength}}finally{await G.cancel().catch(()=>{})}return{content:new TextDecoder().decode(EG6(W,K)),size:X??K,truncated:H||X!==null&&X>K}}function EG6($,Z){let Q=new Uint8Array(Z),Y=0;for(let X of $)Q.set(X,Y),Y+=X.byteLength;return Q}function x3($){return $.split("/").map(encodeURIComponent).join("/")}function hH1($){let Z=Number($);return Number.isInteger(Z)&&Z>1?Z:1}var Gz=400,VD=2000,Wz=60000,kD=200000,Kz=50,Hz=50,DF=100,wG6;var Xp=L(()=>{wG6=/\[bot\]$|[-_.]bot$|^bot[-_.]|^(dependabot|renovate)$/i});var CN;var uH1=L(()=>{CN={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});import{sql as T40}from"kysely";function lh$($){return $ instanceof Date?$.toISOString():String($)}function A40($){let Z=$.installation_id===null||$.installation_id===void 0?null:Number($.installation_id);return{id:$.id,organizationId:$.organization_id,type:$.type,host:$.host,authKind:$.auth_kind,externalAccountId:$.external_account_id,login:$.login,avatarUrl:$.avatar_url,installationId:Number.isFinite(Z)?Z:null,status:$.status,installationAuthorizedBy:$.installation_authorized_by??null,installationRepositoryIds:$.installation_repository_ids??null,credentialConnectionId:$.credential_connection_id,connectedBy:$.connected_by_name?{name:$.connected_by_name}:null,createdAt:lh$($.created_at),updatedAt:lh$($.updated_at)}}class CR{db;constructor($){this.db=$}async upsert($){let Z=new Date,Q=await this.db.insertInto("git_provider_accounts").values({organization_id:$.organizationId,type:$.type,host:$.host.toLowerCase(),auth_kind:$.authKind,external_account_id:$.externalAccountId,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",created_by:$.createdBy??null}).onConflict((Y)=>Y.columns(["organization_id","host","external_account_id"]).doUpdateSet({type:$.type,auth_kind:$.authKind,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",updated_at:T40`GREATEST(${Z}, git_provider_accounts.updated_at + interval '1 millisecond')`})).returningAll().executeTakeFirstOrThrow();return A40(Q)}async get($,Z){let Q=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?A40(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).executeTakeFirst();return Z?A40(Z):null}async listByOrg($){return(await this.db.selectFrom("git_provider_accounts").leftJoin("user as connector","connector.id","git_provider_accounts.created_by").selectAll("git_provider_accounts").select("connector.name as connected_by_name").where("git_provider_accounts.organization_id","=",$).orderBy("git_provider_accounts.created_at","asc").execute()).map(A40)}async findByExternalId($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("organization_id","=",$.organizationId).where("host","=",$.host.toLowerCase()).where("external_account_id","=",$.externalAccountId).executeTakeFirst();return Z?A40(Z):null}async setStatus($,Z,Q){await this.db.updateTable("git_provider_accounts").set({status:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).execute()}async grantRepository($,Z,Q){let Y=T40`jsonb_build_array(${Q}::bigint)`;await this.db.updateTable("git_provider_accounts").set({installation_repository_ids:T40`installation_repository_ids || ${Y}`,updated_at:T40`GREATEST(${new Date}, updated_at + interval '1 millisecond')`}).where("id","=",$).where("organization_id","=",Z).where("installation_repository_ids","is not",null).where(T40`NOT installation_repository_ids @> ${Y}`).execute()}async delete($,Z){return(await this.db.deleteFrom("git_provider_accounts").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}}var zO0=()=>{};class R40{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("git_provider_account_credentials").selectAll().where("account_id","=",$).executeTakeFirst();if(!Z)return null;return zG6(this.vault,Z)}async upsert($){let Z=new Date,Q=await this.vault.encrypt($.accessToken),Y=$.refreshToken?await this.vault.encrypt($.refreshToken):null,X=$.clientSecret?await this.vault.encrypt($.clientSecret):null;await this.db.insertInto("git_provider_account_credentials").values({account_id:$.connectionId,access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint}).onConflict((J)=>J.column("account_id").doUpdateSet({access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint,updated_at:Z})).execute()}async delete($){await this.db.deleteFrom("git_provider_account_credentials").where("account_id","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Y=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Y))return!0;return Y-Z<Date.now()}}async function zG6($,Z){try{let Q=await $.decrypt(Z.access_token),Y=Z.refresh_token?await $.decrypt(Z.refresh_token):null,X=Z.client_secret?await $.decrypt(Z.client_secret):null;return{id:Z.account_id,connectionId:Z.account_id,accessToken:Q,refreshToken:Y,scope:Z.scope,expiresAt:Z.expires_at,createdAt:Z.created_at,updatedAt:Z.updated_at,clientId:Z.client_id,clientSecret:X,tokenEndpoint:Z.token_endpoint}}catch(Q){return console.warn("[GitProviderAccountCredential] failed to decrypt credential row",{accountId:Z.account_id,message:Q instanceof Error?Q.message:String(Q)}),null}}import{sql as PG6}from"kysely";function ch$($){return $ instanceof Date?$.toISOString():String($)}function SR($){return{id:$.id,organizationId:$.organization_id,accountId:$.account_id,provider:$.provider,host:$.host,path:$.path,externalId:$.external_id,defaultBranch:$.default_branch,webUrl:$.web_url,visibility:$.visibility,sandboxImage:EN.catch("default").parse($.sandbox_image),legacyConnectionId:$.legacy_connection_id,createdAt:ch$($.created_at),updatedAt:ch$($.updated_at)}}function CD($){return{provider:$.provider,host:$.host,path:$.path}}class q40{db;constructor($){this.db=$}async upsert($){let Z=$.ref.host.toLowerCase(),Q=await this.findByRef($.organizationId,$.ref);if(Q){let X=await this.db.updateTable("repositories").set({path:$.ref.path,provider:$.ref.provider,web_url:XG({...$.ref,host:Z}),...$.accountId!==void 0?{account_id:$.accountId}:{},...$.externalId!==void 0?{external_id:$.externalId}:{},...$.defaultBranch!==void 0?{default_branch:$.defaultBranch}:{},...$.visibility!==void 0?{visibility:$.visibility}:{},...$.sandboxImage!==void 0?{sandbox_image:$.sandboxImage}:{},...$.legacyConnectionId!==void 0?{legacy_connection_id:$.legacyConnectionId}:{},updated_at:new Date}).where("id","=",Q.id).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return SR(X)}let Y=await this.db.insertInto("repositories").values({organization_id:$.organizationId,account_id:$.accountId??null,provider:$.ref.provider,host:Z,path:$.ref.path,external_id:$.externalId??null,default_branch:$.defaultBranch??null,web_url:XG({...$.ref,host:Z}),visibility:$.visibility??null,sandbox_image:$.sandboxImage??null,legacy_connection_id:$.legacyConnectionId??null,created_by:$.createdBy??null}).returningAll().executeTakeFirstOrThrow();return SR(Y)}async get($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?SR(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("repositories").selectAll().where("id","=",$).executeTakeFirst();return Z?SR(Z):null}async findByRef($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("organization_id","=",$).where("host","=",Z.host.toLowerCase()).where(PG6`lower(path)`,"=",Z.path.toLowerCase()).executeTakeFirst();return Q?SR(Q):null}async listByOrg($,Z){let Q=this.db.selectFrom("repositories").selectAll().where("organization_id","=",$);if(Z?.accountId)Q=Q.where("account_id","=",Z.accountId);return(await Q.orderBy("path","asc").execute()).map(SR)}async setSandboxImage($,Z,Q){let Y=await this.db.updateTable("repositories").set({sandbox_image:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).returningAll().executeTakeFirst();return Y?SR(Y):null}async delete($,Z){try{return(await this.db.deleteFrom("repositories").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}catch(Q){if(Q instanceof Error&&"constraint"in Q&&Q.constraint==="org_repo_sync_source_present")throw Error("Remove this repository's sync configurations before unlinking it");throw Q}}}var Jp=L(()=>{a4()});function dh$($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function TG6($,Z){let{owner:Q}=y5(Z),Y=dh$(Z.host),X=new RegExp(`(?:https?://(?:[^@\\s/]*@)?${Y}/|git@${Y}:)${dh$(Q)}/([A-Za-z0-9._-]+)`,"gi");return[...$.matchAll(X)].flatMap((J)=>J[1]?.replace(/\.git$/i,"")||[])}async function ih$($,Z){let{owner:Q,name:Y}=y5(Z),X=new Set,J=[Z.path];while(J.length>0&&X.size<mh$){let G=J.shift();if(!G)break;let W=await $(G,"pubspec.yaml").catch(()=>null);if(!W)continue;for(let K of TG6(W,Z)){if(K===Y||X.has(K))continue;if(X.size>=mh$)break;X.add(K),J.push(`${Q}/${K}`)}}return[...X]}var mh$=20;var ph$=L(()=>{a4()});function th$($){return Bun.hash($).toString(36)}function AG6($){for(let[Z,Q]of Fz)if(Q.expiresAt<=$)Fz.delete(Z);while(Fz.size>=512){let Z=Fz.keys().next();if(Z.done)break;Fz.delete(Z.value)}}function cH1($,Z,Q,Y=Date.now()){AG6(Y),Fz.set(th$($),{owner:Z,expiresAt:Q})}function Gp($,Z=Date.now()){let Q=th$($),Y=Fz.get(Q);if(!Y)return"unknown";if(Y.expiresAt<=Z)return Fz.delete(Q),"unknown";return Y.owner}var nh$="app",lH1="user",Fz;var Wp=L(()=>{Fz=new Map});function Uz($=process.env){let Z=$.GITHUB_APP_ID?.trim(),Q=$.GITHUB_APP_PRIVATE_KEY?.trim(),Y=$.GITHUB_APP_CLIENT_ID?.trim(),X=$.GITHUB_APP_CLIENT_SECRET?.trim(),J=$.GITHUB_APP_SLUG?.trim();if(!Z||!Q||!Y||!X||!J)return null;return{appId:Z,privateKeyPem:Q.replace(/\\n/g,`
 `),clientId:Y,clientSecret:X,slug:J}}function _R($,Z){let Q=$.get(Z);if(Q===null)return null;let Y=Number(Q);return Number.isFinite(Y)?Y:null}function RG6($){return{limit:_R($,"x-ratelimit-limit"),remaining:_R($,"x-ratelimit-remaining"),reset:_R($,"x-ratelimit-reset"),used:_R($,"x-ratelimit-used"),resource:$.get("x-ratelimit-resource")}}function Nz($){if($.status===429)return!0;if($.status!==403)return!1;if($.headers.get("retry-after")!==null)return!0;return _R($.headers,"x-ratelimit-remaining")===0}function Bz($,Z=Date.now()){let Q=_R($,"retry-after");if(Q!==null)return Math.max(0,Q*1000);let Y=_R($,"x-ratelimit-reset");if(Y!==null)return Math.max(0,Y*1000-Z);return null}function Lz($,Z){let Q=RG6($),Y=Q.resource??"unknown",X={installation:Z.installation,resource:Y},J={...X,lane:Z.lane,operation:Z.operation};if(rh$??=X$.createCounter("github_api_calls",{description:"Calls to the GitHub API, by transport and operation",unit:"{calls}"}),rh$.add(1,J),Q.remaining!==null)oh$??=X$.createGauge("github_rate_limit_remaining",{description:"Requests (REST) or points (GraphQL) left in the window",unit:"{requests}"}),oh$.record(Q.remaining,X);if(Q.used!==null)ah$??=X$.createGauge("github_rate_limit_used",{description:"Requests (REST) or points (GraphQL) spent in the window",unit:"{requests}"}),ah$.record(Q.used,X);return Q}function Dz($){sh$??=X$.createCounter("github_rate_limited",{description:"GitHub responses refused for rate-limit reasons",unit:"{responses}"}),sh$.add(1,$)}var oh$=null,ah$=null,rh$=null,sh$=null;var M40=L(()=>{f6()});function wK($){return process.env.GITHUB_API_BASE_URL??LD("github",$)}async function GZ($,Z){let Q={Authorization:`Bearer ${Z.token}`,Accept:Z.accept??MG6,"X-GitHub-Api-Version":qG6};if(Z.body!==void 0)Q["Content-Type"]="application/json";let Y;try{Y=await fetch($,{method:Z.method??"GET",headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:AbortSignal.timeout(Z.timeoutMs??mH1)})}catch(J){throw new g0({provider:"github",status:0,message:`GitHub ${Z.operation} failed: ${J instanceof Error?J.message:String(J)}`,cause:J})}let X=Gp(Z.token);if(Lz(Y.headers,{lane:"rest",operation:Z.operation,installation:X}),Nz(Y)){await Y.body?.cancel().catch(()=>{});let J=Y.headers.get("retry-after")!==null?"secondary":"primary";Dz({lane:"rest",operation:Z.operation,installation:X,kind:J});let G=Bz(Y.headers);throw new g0({provider:"github",status:Y.status,retryAfterMs:G,message:`GitHub ${J} rate limit reached${G===null?"":`; retry in ${Math.ceil(G/1000)}s`}`})}return Y}function I40($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"&&"message"in Z&&typeof Z.message==="string"&&Z.message.length>0)return Z.message}catch{}return $.slice(0,300)}function V40($,Z,Q){let Y=I40(Z);return new g0({provider:"github",status:$,message:`GitHub ${Q} failed: ${$}${Y?` ${Y}`:""}`})}async function $7($,Z){let Q=await $.text().catch(()=>"");return V40($.status,Q,Z)}async function zQ($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new g0({provider:"github",status:$.status,message:`GitHub ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}var qG6="2022-11-28",MG6="application/vnd.github+json",mH1=15000;var Oz=L(()=>{a4();M40();Wp();S5()});function fG6($){return $==="public"||$==="private"||$==="internal"}function dH1($,Z){let Q="public";if($.private)Q="private";else if($.visibility&&fG6($.visibility))Q=$.visibility;return{ref:{provider:"github",host:Z,path:$.full_name},externalId:String($.id),defaultBranch:$.default_branch??null,webUrl:$.html_url,visibility:Q,description:$.description??null,updatedAt:$.pushed_at??$.updated_at??null}}function pH1($,Z){let Q=Z?.trim().toLowerCase();if(!Q)return!0;return $.toLowerCase().includes(Q)}function bG6($){return{name:$.name||$.login,email:$.email||`${$.login}@users.noreply.github.com`}}function yG6($){return $.split("/").filter(Boolean).map(encodeURIComponent).join("/")}function gG6($,Z){let{owner:Q,name:Y}=y5($),X=`/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}/tarball`;return Z?`${X}/${encodeURIComponent(Z)}`:X}function $u$($,Z,Q){return new g0({provider:"github",status:Z,message:Q?`Studio cannot create repositories in ${$}. The GitHub App needs the Administration permission there; ask an owner of ${$} to accept it.`:`The connected GitHub account cannot create repositories in ${$}.`})}class xR{kind="github";host;apiBaseUrl;options;grantedIds=new Map;constructor($){this.options=$,this.host=$.host.toLowerCase(),this.apiBaseUrl=wK($.host)}async tokenForRepo($,Z={}){let Q=this.options;if("appAuth"in Q){let Y=Q.repositoryIds??null,X=Z.alsoRepositories??[],J=await Q.appAuth.installationToken(Q.installationId,{...Y?{repositoryIds:[await this.grantedRepositoryId($,Y),...await this.grantedSiblingIds($,X,Y)]}:{repositories:[mW1($),...X]},permissions:WO0,bufferMs:Z.bufferMs,forceRefresh:Z.forceRefresh});return{token:J.token,kind:"installation",expiresAt:J.expiresAt}}return this.sourceToken(Q.tokenSource,Z)}async accountToken($={}){let Z=this.options;if("appAuth"in Z){let Q=await Z.appAuth.installationToken(Z.installationId,{...Z.repositoryIds?{repositoryIds:Z.repositoryIds}:{},permissions:IG6,bufferMs:$.bufferMs,forceRefresh:$.forceRefresh});return{token:Q.token,kind:"installation",expiresAt:Q.expiresAt}}return this.sourceToken(Z.tokenSource,$)}async grantedRepositoryId($,Z){let Q=$.path.toLowerCase(),Y=this.grantedIds.get(Q);if(Y!==void 0)return Y;let X=Number((await this.getRepo($))?.externalId);if(!Number.isSafeInteger(X)||!Z.includes(X))throw new g0({provider:"github",status:403,message:`${$.path} is outside what this GitHub account authorized for Studio. Ask someone who administers it to connect it.`});return this.grantedIds.set(Q,X),X}async grantedSiblingIds($,Z,Q){let{owner:Y}=y5($),X=[];for(let J of Z){let G=await this.getRepo({...$,path:`${Y}/${J}`}).catch(()=>null),W=Number(G?.externalId);if(Number.isSafeInteger(W)&&Q.includes(W))X.push(W)}return X}async createRepoFromTemplate($){let{template:Q,owner:Y,name:X}=$,J=await this.creationToken(Y),G=await GZ(`${this.apiBaseUrl}/repos/${encodeURIComponent(Q.owner)}/${encodeURIComponent(Q.name)}/generate`,{method:"POST",token:J,operation:"create_repo_from_template",body:{owner:Y,name:X,private:$.private,include_all_branches:!1}});if(!G.ok){let K=await G.text().catch(()=>"");if(G.status===422&&/already exists/i.test(I40(K)))throw new g0({provider:"github",status:409,message:`${Y}/${X} already exists on GitHub. Choose another name.`});if(G.status===403||G.status===404)throw $u$(Y,G.status,"appAuth"in this.options);throw V40(G.status,K,"create_repo_from_template")}let W=dH1(await zQ(G,"create_repo_from_template"),this.host);return await this.waitForTemplateCopy(W.ref,J).catch(()=>{}),W}async creationToken($){let Z=this.options;if(!("appAuth"in Z))return(await this.sourceToken(Z.tokenSource,{})).token;if((Z.repositoryIds?.length??0)>=vR)throw new g0({provider:"github",status:409,message:`This GitHub account already grants Studio ${vR} repositories, the most one account can. Create the site with another account.`});try{return(await Z.appAuth.installationToken(Z.installationId,{permissions:VG6})).token}catch(Q){if(Q instanceof g0&&Q.status===422)throw $u$($,403,!0);throw Q}}async waitForTemplateCopy($,Z){let{owner:Q,name:Y}=y5($),X=`${this.apiBaseUrl}/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}/commits?per_page=1`;await O8(async()=>{let J=await GZ(X,{token:Z,operation:"wait_template_copy"});if(await J.body?.cancel().catch(()=>{}),!J.ok)throw new iH1},{maxAttempts:kG6,minTimeout:CG6,maxTimeout:SG6,isRetriable:(J)=>J instanceof iH1})}async sourceToken($,Z){let Q=await $.get(Z);if(!Q)throw new g0({provider:"github",status:401,message:`No usable GitHub token for ${this.host}; reconnect the account`});return Q}async getRepo($){let{owner:Q,name:Y}=y5($),X=await this.request(`/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}`,{operation:"get_repo"});if(X.status===404)return await X.body?.cancel().catch(()=>{}),null;if(!X.ok)throw await $7(X,"get_repo");return dH1(await zQ(X,"get_repo"),this.host)}async listRepos($={}){let Z=Math.max(1,Math.floor($.page??1)),Q=Math.min(vG6,Math.max(1,Math.floor($.perPage??_G6))),Y=`per_page=${Q}&page=${Z}`,X;if("appAuth"in this.options){let G=await this.request(`/installation/repositories?${Y}`,{operation:"list_installation_repositories"});if(!G.ok)throw await $7(G,"list_installation_repositories");let W=await zQ(G,"list_installation_repositories");X=Array.isArray(W.repositories)?W.repositories:[]}else{let G=await this.request(`/user/repos?affiliation=owner,collaborator,organization_member&sort=pushed&${Y}`,{operation:"list_user_repositories"});if(!G.ok)throw await $7(G,"list_user_repositories");let W=await zQ(G,"list_user_repositories");X=Array.isArray(W)?W:[]}return{repositories:X.filter((J)=>pH1(J.full_name,$.query)).map((J)=>dH1(J,this.host)),hasMore:X.length===Q}}async readFile($,Z,Q){let{owner:X,name:J}=y5($),G=Q?`?ref=${encodeURIComponent(Q)}`:"",W=await this.request(`/repos/${encodeURIComponent(X)}/${encodeURIComponent(J)}/contents/${yG6(Z)}${G}`,{operation:"read_file",accept:xG6});if(W.status===404)return await W.body?.cancel().catch(()=>{}),null;if(!W.ok)throw await $7(W,"read_file");return W.text()}async archiveTarball($,Z){let Y=`${this.apiBaseUrl}${gG6($,Z)}`,X=await this.tokenForRepo($),J=await GZ(Y,{operation:"archive_tarball",token:X.token,timeoutMs:eh$});if(J.status===401){await J.body?.cancel().catch(()=>{});let G=await this.tokenForRepo($,{forceRefresh:!0});J=await GZ(Y,{operation:"archive_tarball",token:G.token,timeoutMs:eh$})}if(J.status===404)return await J.body?.cancel().catch(()=>{}),null;if(!J.ok)throw await $7(J,"archive_tarball");return J.body}async identity(){if("appAuth"in this.options)return null;let $="get_user",Z=await this.request("/user",{operation:$});if(!Z.ok)throw await $7(Z,$);return bG6(await zQ(Z,$))}async request($,Z){let Q=`${this.apiBaseUrl}${$}`,Y=await this.accountToken(),X=await GZ(Q,{...Z,token:Y.token});if(X.status!==401)return X;await X.body?.cancel().catch(()=>{});let J=await this.accountToken({forceRefresh:!0});return GZ(Q,{...Z,token:J.token})}}var IG6,VG6,kG6=8,CG6=500,SG6=4000,iH1,_G6=30,vG6=100,xG6="application/vnd.github.raw+json",eh$=60000;var PO0=L(()=>{a4();WG();$8();S5();k40();Oz();IG6={metadata:"read",contents:"read"},VG6={administration:"write",contents:"read",metadata:"read"};iH1=class iH1 extends Error{}});import{z as jz}from"zod";function TO0($){return $.repositories.filter((Z)=>Z.permissions?.admin===!0).map((Z)=>({id:Z.id,name:Z.full_name}))}function AO0($){if($.total_count===void 0)return-1;return Math.max(0,Math.ceil($.total_count/fR)-1)}function Qu$($){return AO0($)===0&&TO0($).length===0}function Yu$($,Z,Q){let Y=$.filter((J)=>pH1(J.name,Q)),X=(Z-1)*fR;return{repositories:Y.slice(X,X+fR),hasMore:Y.length>X+fR}}function Xu$($,Z){let Q=new Set($.map((Y)=>Y.id));return Z.every((Y)=>Q.has(Y))}function Ju$($,Z,Q){if(Z!==null){let J=new Set(Z);return $.filter((G)=>J.has(G.id)).map((G)=>G.id)}let Y=new Set(Q.flatMap((J)=>J.externalId?[J.externalId]:[])),X=new Set(Q.filter((J)=>!J.externalId).map((J)=>J.path.toLowerCase()));return $.filter((J)=>Y.has(String(J.id))||X.has(J.name.toLowerCase())).map((J)=>J.id)}class nH1{ttlMs;entries=new Map;constructor($){this.ttlMs=$}installations($){return this.live($)?.installations}repositories($,Z){return this.live($)?.repositories.get(Z)}rememberInstallations($,Z){this.entry($).installations=Z}rememberRepositories($,Z,Q){this.entry($).repositories.set(Z,Q)}forget($){this.entries.delete($)}live($){let Z=this.entries.get($);if(!Z)return;if(Z.expiresAt<=Date.now()){this.entries.delete($);return}return Z}entry($){let Z=Date.now();for(let[Y,X]of this.entries)if(X.expiresAt<=Z)this.entries.delete(Y);let Q=this.entries.get($);if(!Q)Q={expiresAt:Z+this.ttlMs,repositories:new Map},this.entries.set($,Q);return Q}}var fR=100,Zu$;var tH1=L(()=>{PO0();Zu$=jz.object({total_count:jz.number().int().nonnegative().optional(),repositories:jz.array(jz.object({id:jz.number().int().positive().safe(),full_name:jz.string().min(1),permissions:jz.object({admin:jz.boolean().optional()}).optional()}))})});import{createPrivateKey as Ku$,sign as hG6}from"crypto";import{z as Gu$}from"zod";function oH1($){return Buffer.from($).toString("base64url")}function iG6($){let Z=oH1(JSON.stringify({alg:"RS256",typ:"JWT"})),Q=oH1(JSON.stringify({iat:$.nowSeconds-lG6,exp:$.nowSeconds+rH1,iss:$.appId})),Y=`${Z}.${Q}`,X=hG6("RSA-SHA256",Buffer.from(Y),Ku$($.privateKeyPem));return`${Y}.${oH1(X)}`}function pG6($){let Z=W40.find((X)=>(X in $));if(!Z)return null;let{[Z]:Q,...Y}=$;return Y}function nG6($){let{repositories:Z,repositoryIds:Q}=$;if(Z&&Q)return"A GitHub installation token is scoped by repository name or by id, never both";let Y=Z?.length??Q?.length;if(Y!==void 0&&(Y===0||Y>vR))return`A GitHub installation token covers 1 to ${vR} repositories, not ${Y}`;if(Q?.some((X)=>!Number.isSafeInteger(X)||X<=0))return"A GitHub repository id must be a positive integer";return null}function tG6($,Z){let Q=(Z.repositories??[]).map((J)=>J.toLowerCase()).sort(),Y=Object.entries(Z.permissions??{}).map(([J,G])=>`${J}=${G}`).sort(),X=Z.repositoryIds?`ids:${[...Z.repositoryIds].sort((J,G)=>J-G).join(",")}`:"all";return`${$}|${Q.join(",")}|${X}|${Y.join(",")}`}function oG6($,Z){for(let[Q,Y]of $)if(Y.expiresAt.getTime()<=Z)$.delete(Q)}function Wu$($){let Z=$.account;if(typeof $.id!=="number"||!Z||typeof Z.id!=="number"||typeof Z.login!=="string")return null;return{installationId:$.id,externalAccountId:String(Z.id),login:Z.login,avatarUrl:typeof Z.avatar_url==="string"?Z.avatar_url:null,accountType:typeof Z.type==="string"?Z.type:"User",htmlUrl:typeof $.html_url==="string"?$.html_url:null}}function aG6($){if(!$||typeof $!=="object"||Array.isArray($))return null;let Z={};for(let[Q,Y]of Object.entries($))if(typeof Y==="string")Z[Q]=Y;return Z}class Hu${appId;privateKeyPem;apiBaseUrl;jwt=null;cache=new Map;inFlight=new Map;flowAccess=new nH1(dG6);constructor($,Z){this.appId=$.appId,this.privateKeyPem=$.privateKeyPem,this.apiBaseUrl=(Z?.apiBaseUrl??uG6).replace(/\/+$/,"")}appJwt(){let $=Math.floor(Date.now()/1000);if(this.jwt&&this.jwt.exp-$>cG6)return this.jwt.value;let Z=iG6({appId:this.appId,privateKeyPem:this.privateKeyPem,nowSeconds:$});return this.jwt={value:Z,exp:$+rH1},cH1(Z,nh$,($+rH1)*1000),Z}installationToken($,Z={}){let Q=nG6(Z);if(Q)return Promise.reject(new g0({provider:"github",status:403,message:Q}));let Y=tG6($,Z),X=Z.bufferMs??mG6;if(!Z.forceRefresh){let W=this.cache.get(Y);if(W&&W.expiresAt.getTime()-Date.now()>X)return Promise.resolve(W)}let J=this.inFlight.get(Y);if(J)return J;let G=this.mint($,Z).then((W)=>{return this.cache.set(Y,W),cH1(W.token,String($),W.expiresAt.getTime()),oG6(this.cache,Date.now()),W}).finally(()=>{this.inFlight.delete(Y)});return this.inFlight.set(Y,G),G}async mint($,Z){let Y=`${this.apiBaseUrl}/app/installations/${$}/access_tokens`,X=Z.repositories&&Z.repositories.length>0?Z.repositories:void 0,J=Z.permissions?{...Z.permissions}:void 0;for(;;){let G=await GZ(Y,{method:"POST",token:this.appJwt(),body:{...X&&{repositories:X},...Z.repositoryIds&&{repository_ids:Z.repositoryIds},...J&&{permissions:J}},operation:"installation_access_token"});if(G.ok){let W=await zQ(G,"installation_access_token");if(typeof W.token!=="string"||W.token.length===0||typeof W.expires_at!=="string"||W.expires_at.length===0)throw new g0({provider:"github",status:G.status,message:"GitHub installation_access_token returned no token"});let K=new Date(W.expires_at);if(isNaN(K.getTime()))throw new g0({provider:"github",status:G.status,message:"GitHub installation_access_token returned invalid token expiration"});return{token:W.token,expiresAt:K,permissions:aG6(W.permissions)??J??{}}}if(G.status===422&&J){let W=await G.text().catch(()=>""),K=pG6(J);if(K&&gK1(I40(W))){J=K;continue}throw V40(G.status,W,"installation_access_token")}throw await $7(G,"installation_access_token")}}async getInstallation($){let Q=await GZ(`${this.apiBaseUrl}/app/installations/${$}`,{token:this.appJwt(),operation:"get_installation"});if(Q.status===404)return null;if(!Q.ok)throw await $7(Q,"get_installation");let Y=Wu$(await zQ(Q,"get_installation"));if(!Y)throw new g0({provider:"github",status:Q.status,message:"GitHub get_installation returned an installation without a user or organization account"});return Y}async connectingUserId($){let Z=Gu$.object({id:Gu$.number().int().positive().safe()}).parse(await this.userGet("/user",$,"get_connecting_user"));return String(Z.id)}async listConnectableInstallations($,Z){this.flowAccess.forget($);let Q=await this.listUserInstallations(Z);return this.flowAccess.rememberInstallations($,Q),(await E9(Q,4,async(X)=>{let J=await this.repositoryPage(Z,X.installationId,1);if(AO0(J)===0)this.flowAccess.rememberRepositories($,X.installationId,TO0(J));return Qu$(J)?null:X})).filter((X)=>X!==null)}async connectableInstallation($,Z,Q,Y={}){let X=Y.fresh?void 0:this.flowAccess.installations($);if(!X)X=await this.listUserInstallations(Z),this.flowAccess.rememberInstallations($,X);return X.find((J)=>J.installationId===Q)??null}async delegableRepositories($,Z,Q,Y={}){if(!Y.fresh){let K=this.flowAccess.repositories($,Q);if(K)return K}let X=await this.repositoryPage(Z,Q,1),J=[X],G=AO0(X);if(G>0)J.push(...await E9(Array.from({length:G},(K,H)=>H+2),4,(K)=>this.repositoryPage(Z,Q,K)));else if(G<0)for(let K=2;J[J.length-1].repositories.length===fR;K++)J.push(await this.repositoryPage(Z,Q,K));let W=J.flatMap(TO0);return this.flowAccess.rememberRepositories($,Q,W),W}forgetFlow($){this.flowAccess.forget($)}async repositoryPage($,Z,Q){return Zu$.parse(await this.userGet(`/user/installations/${Z}/repositories?per_page=${fR}&page=${Q}`,$,"list_connecting_user_repositories"))}async userGet($,Z,Q){let Y=await GZ(`${this.apiBaseUrl}${$}`,{token:Z,operation:Q});if(!Y.ok)throw await $7(Y,Q);return zQ(Y,Q)}async listUserInstallations($){let Y=[];for(let X=1;;X++){let J=await GZ(`${this.apiBaseUrl}/user/installations?per_page=100&page=${X}`,{token:$,operation:"list_user_installations"});if(!J.ok)throw await $7(J,"list_user_installations");let G=await zQ(J,"list_user_installations"),W=Array.isArray(G.installations)?G.installations:[];for(let K of W){let H=Wu$(K);if(H)Y.push(H)}if(W.length<100)return Y}}}function OF(){if(aH1===void 0){let $=Uz();aH1=$&&rG6($)?new Hu$($,{apiBaseUrl:wK("github.com")}):null}return aH1}function rG6($){try{return Ku$($.privateKeyPem),!0}catch(Z){return console.error("[git-providers] GITHUB_APP_PRIVATE_KEY is not a usable private key \u2014 "+"the GitHub App stays disabled and orgs keep their existing connections. Check that newlines survived the secret store.",Z),!1}}function Fu$(){let $=Uz()!==null&&OF()!==null;return{configured:$,hosts:$?[sG6]:[]}}var uG6="https://api.github.com",lG6=60,rH1=540,cG6=60,mG6=300000,dG6=600000,vR=500,aH1,sG6="github.com";var k40=L(()=>{$8();WG();Wp();S5();tH1();Oz()});import{execFile as eG6}from"child_process";import{promisify as $36}from"util";import{z as RO0}from"zod";function bR(){return P0().localMode}function C40($){return new g0({provider:"github",status:403,message:$})}async function Uu$($){if(!bR())throw C40("GitHub CLI connections are only available in local mode.");let Z={...process.env,GH_PROMPT_DISABLED:"1"};delete Z.GH_TOKEN,delete Z.GITHUB_TOKEN,delete Z.GH_DEBUG,delete Z.DEBUG;try{let{stdout:Q}=await Z36("gh",["auth","token","--hostname",sH1,...$?["--user",$]:[]],{env:Z,timeout:1e4,maxBuffer:16384}),Y=Q.trim();if(!Y||/\s/.test(Y))throw Error("Invalid CLI token");return Y}catch{throw C40("Could not read your GitHub CLI login. Install gh and run gh auth login --hostname github.com, then connect again.")}}async function Nu$($){try{let Z=await GZ(`${wK(sH1)}/user`,{token:$,operation:"cli_current_user"});if(!Z.ok)throw Error("GitHub rejected the CLI token");return Q36.parse(await Z.json())}catch{throw C40("Could not verify your GitHub CLI account. Run gh auth login --hostname github.com and connect again.")}}async function Bu$(){let $=await Nu$(await Uu$());return{externalAccountId:`cli:user:${$.id}`,login:$.login,avatarUrl:$.avatar_url??null}}function Lu$($){return{kind:"token",async get(){if($.host!==sH1)throw C40("Unsupported GitHub CLI host.");let Z=await Uu$($.login);if(`cli:user:${(await Nu$(Z)).id}`!==$.externalAccountId)throw C40("Your GitHub CLI account changed. Connect it again.");return{token:Z,kind:"token",expiresAt:null}}}}var Z36,sH1="github.com",Q36;var qO0=L(()=>{Y$();S5();Oz();Z36=$36(eG6),Q36=RO0.object({id:RO0.number().int().positive().safe(),login:RO0.string().min(1),avatar_url:RO0.string().url().nullable().optional()})});function Kp($){return LD("gitlab",$)}function X36($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"){let Q=Z,Y=[...IL(Q.message),...IL(Q.error),...IL(Q.error_description)];if(Y.length>0)return Y.join("; ")}}catch{}return $.slice(0,300)}async function f3($){let Z=await $.text().catch(()=>""),Q=Z?X36(Z):$.statusText;return new g0({provider:"gitlab",status:$.status,message:`GitLab API ${$.status}: ${Q}`,retryAfterMs:$.status===429?Du$($.headers):null})}async function S40($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new g0({provider:"gitlab",status:$.status,message:`GitLab ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}async function SN($,Z,Q={}){let Y={Authorization:`Bearer ${Z}`,Accept:Q.accept??"application/json"};if(Q.body!==void 0)Y["Content-Type"]="application/json";try{return await fetch($,{method:Q.method??"GET",headers:Y,body:Q.body===void 0?void 0:JSON.stringify(Q.body),signal:AbortSignal.timeout(Q.timeoutMs??Y36)})}catch(X){throw new g0({provider:"gitlab",status:0,message:`GitLab request failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}}var Y36=15000;var _40=L(()=>{a4();S5();wz()});import{z as sY}from"zod";function SD($){return encodeURIComponent($)}function v40($){return encodeURIComponent($.replace(/^\/+/,""))}function K36($,Z){let Q=`/projects/${SD($.path)}/repository/archive.tar.gz`;return Z?`${Q}?sha=${encodeURIComponent(Z)}`:Q}function Du$($,Z=Date.now()){let Q=$.get("retry-after");if(Q!==null){let X=Number(Q);if(Number.isFinite(X))return Math.max(0,X*1000);let J=Date.parse(Q);if(Number.isFinite(J))return Math.max(0,J-Z)}let Y=$.get("ratelimit-reset");if(Y!==null){let X=Number(Y);if(Number.isFinite(X))return Math.max(0,X*1000-Z)}return null}function Ou$($,Z){let Q=H36.parse($),Y={provider:"gitlab",host:Z,path:Q.path_with_namespace};return{ref:Y,externalId:String(Q.id),defaultBranch:Q.default_branch??null,webUrl:Q.web_url??XG(Y),visibility:Q.visibility,description:Q.description??null,updatedAt:Q.last_activity_at??null}}async function F36($,Z,Q={}){let Y=await SN($,Z,Q);if(Y.status===404)return await Y.body?.cancel().catch(()=>{}),null;if(!Y.ok)throw await f3(Y);return Y}async function U36($,Z){let Q=await F36(`${LD("gitlab",$)}/user`,Z);if(!Q)throw new g0({provider:"gitlab",status:404,message:"GitLab did not recognise the authenticated user"});return ju$.parse(await S40(Q,"get_user"))}async function MO0($,Z){let Q=await U36($,Z);return{externalAccountId:String(Q.id),login:Q.username,avatarUrl:Q.avatar_url??null}}class x40{kind="gitlab";host;apiBase;tokenSource;constructor($){this.host=$.host,this.apiBase=LD("gitlab",$.host),this.tokenSource=$.tokenSource}async tokenForRepo($,Z){return this.accountToken(Z)}async accountToken($){let Z=await this.tokenSource.get($);if(!Z)throw new g0({provider:"gitlab",status:401,message:"GitLab account is not authenticated"});return Z}async getRepo($){let Z=await this.get(`/projects/${SD($.path)}`);if(!Z)return null;return Ou$(await S40(Z,"get_repo"),this.host)}async listRepos($={}){let Z=new URLSearchParams({membership:"true",simple:"true",order_by:"id",sort:"desc",per_page:String(Math.min(W36,Math.max(1,$.perPage??G36))),page:String(Math.max(1,$.page??1))}),Q=$.query?.trim();if(Q)Z.set("search",Q);let Y=await this.get(`/projects?${Z}`);if(!Y)return{repositories:[],hasMore:!1};let X=await S40(Y,"list_repos");if(!Array.isArray(X))throw new g0({provider:"gitlab",status:502,message:"GitLab /projects returned a non-array payload"});return{repositories:X.map((J)=>Ou$(J,this.host)),hasMore:X.length===Number(Z.get("per_page"))}}async readFile($,Z,Q){let Y=Q;if(!Y){let J=await this.getRepo($);if(!J?.defaultBranch)return null;Y=J.defaultBranch}let X=await this.get(`/projects/${SD($.path)}/repository/files/${v40(Z)}/raw?ref=${encodeURIComponent(Y)}`,{accept:"text/plain, */*"});if(!X)return null;return X.text()}async archiveTarball($,Z){let Q=await this.authedFetch(`${this.apiBase}${K36($,Z)}`,{accept:"application/octet-stream, */*",timeoutMs:J36});if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await f3(Q);return Q.body}async identity(){let $=await this.authedFetch(`${this.apiBase}/user`);if(!$.ok)throw await f3($);let Z=ju$.parse(await S40($,"identity"));return{name:Z.name||Z.username,email:Z.commit_email||Z.public_email||Z.email||`${Z.username}@users.noreply.${this.host}`}}async get($,Z){let Q=await this.authedFetch(`${this.apiBase}${$}`,Z);if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await f3(Q);return Q}async authedFetch($,Z={}){let Q=await this.accountToken(),Y=await SN($,Q.token,Z);if(Y.status!==401)return Y;await Y.body?.cancel().catch(()=>{});let X=await this.accountToken({forceRefresh:!0});return SN($,X.token,Z)}}var J36=60000,G36=30,W36=100,H36,ju$;var wz=L(()=>{a4();S5();_40();H36=sY.object({id:sY.number(),path_with_namespace:sY.string().min(1),default_branch:sY.string().nullish(),web_url:sY.string().nullish(),visibility:sY.enum(["public","private","internal"]),description:sY.string().nullish(),last_activity_at:sY.string().nullish()});ju$=sY.object({id:sY.number(),username:sY.string().min(1),name:sY.string().nullish(),avatar_url:sY.string().nullish(),email:sY.string().nullish(),public_email:sY.string().nullish(),commit_email:sY.string().nullish()})});function IO0($=process.env){let Z=$.BITBUCKET_OAUTH_CLIENT_ID?.trim(),Q=$.BITBUCKET_OAUTH_CLIENT_SECRET?.trim();if(!Z||!Q)return null;return{host:_D,clientId:Z,clientSecret:Q}}function wu$(){let $=IO0();return{configured:$!==null,hosts:$?[$.host]:[]}}var _D;var Hp=L(()=>{a4();_D=PD0.bitbucket});function f40($){if($.toLowerCase()===_D)return;throw new g0({provider:"bitbucket",status:400,message:`${$} is not Bitbucket Cloud. Only bitbucket.org is supported; Bitbucket Data Center has a different API.`})}function B36($,Z=Date.now()){let Q=$.get("retry-after");if(Q===null)return null;let Y=Number(Q);if(Number.isFinite(Y))return Math.max(0,Y*1000);let X=Date.parse(Q);return Number.isFinite(X)?Math.max(0,X-Z):null}function L36($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"){let Q=Z,Y=[...IL(Q.error),...IL(Q.error_description)];if(Y.length>0)return Y.join("; ")}}catch{}return $.slice(0,300)}async function $J($){let Z=await $.text().catch(()=>""),Q=Z?L36(Z):$.statusText;return new g0({provider:"bitbucket",status:$.status,message:`Bitbucket API ${$.status}: ${Q}`,retryAfterMs:$.status===429?B36($.headers):null})}async function yR($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new g0({provider:"bitbucket",status:$.status,message:`Bitbucket ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}async function eY($,Z,Q={}){let Y={Authorization:Q.basicAuth?`Basic ${Buffer.from(`x-token-auth:${Z}`).toString("base64")}`:`Bearer ${Z}`,Accept:Q.accept??"application/json"},X=Q.body instanceof FormData;if(Q.body!==void 0&&!X)Y["Content-Type"]="application/json";try{return await fetch($,{method:Q.method??"GET",headers:Y,body:Q.body===void 0?void 0:X?Q.body:JSON.stringify(Q.body),signal:AbortSignal.timeout(Q.timeoutMs??N36)})}catch(J){throw new g0({provider:"bitbucket",status:0,message:`Bitbucket request failed: ${J instanceof Error?J.message:String(J)}`,cause:J})}}function Eu$($){if(!$.next)return null;try{let Z=new URL($.next).searchParams.get("page"),Q=Number(Z);return Z!==null&&Number.isInteger(Q)&&Q>0?Q:null}catch{return null}}function b3($){return`"${$.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}var N36=15000,PQ;var b40=L(()=>{a4();S5();Hp();PQ=LD("bitbucket",_D)});import{z as Z7}from"zod";function ZF1($){let{owner:Z,name:Q}=y5({path:$});if(!Z||!Q||Z.includes("/"))throw new g0({provider:"bitbucket",status:400,message:`${$} is not a Bitbucket repository path (expected workspace/repo_slug)`});return{workspace:Z,slug:Q}}function Ez($){let{workspace:Z,slug:Q}=ZF1($.path);return`/repositories/${encodeURIComponent(Z)}/${encodeURIComponent(Q)}`}function j36($,Z){return`${XG($)}/get/${encodeURIComponent(Z)}.tar.gz`}function zu$($,Z){let Q=w36.parse($),Y={provider:"bitbucket",host:Z,path:Q.full_name};return{ref:Y,externalId:Q.uuid,defaultBranch:Q.mainbranch?.name??null,webUrl:Q.links?.html?.href??XG(Y),visibility:Q.is_private?"private":"public",description:Q.description??null,updatedAt:Q.updated_on??null}}async function VO0($,Z,Q){f40($);let Y=Q?.trim().toLowerCase();if(Y){let G=await $F1(`${PQ}/workspaces/${encodeURIComponent(Y)}`,Z);if(G.ok)return Pu$(G.json);throw G.failure}let X=await $F1(`${PQ}/user`,Z);if(X.ok){let G=Au$.parse(X.json);return{externalAccountId:G.uuid,login:G.nickname,avatarUrl:G.links?.avatar?.href??null}}let J=await $F1(`${PQ}/user/workspaces?pagelen=1`,Z);if(J.ok){let G=J.json.values?.[0];if(G?.workspace!==void 0)return Pu$(G.workspace)}throw J.ok?new g0({provider:"bitbucket",status:401,message:"Bitbucket did not recognise this token. An access token cannot name itself \u2014 say which workspace it belongs to and connect it again."}):J.failure}function Pu$($){let Z=E36.parse($);return{externalAccountId:Z.uuid,login:Z.slug,avatarUrl:Z.links?.avatar?.href??null}}async function $F1($,Z){let Q=await eY($,Z);if(!Q.ok)return{ok:!1,failure:await $J(Q)};return{ok:!0,json:await yR(Q,"principal")}}class y40{kind="bitbucket";host;tokenSource;workspace;constructor($){f40($.host),this.host=_D,this.tokenSource=$.tokenSource,this.workspace=$.workspace?.trim().toLowerCase()||null}async tokenForRepo($,Z){return this.accountToken(Z)}async accountToken($){let Z=await this.tokenSource.get($);if(!Z)throw new g0({provider:"bitbucket",status:401,message:"Bitbucket account is not authenticated"});return Z}async getRepo($){let Z=await this.get(Ez($));if(!Z)return null;return zu$(await yR(Z,"get_repo"),this.host)}async listRepos($={}){let Z=Math.min(eH1,Math.max(1,$.perPage??O36)),Q=new URLSearchParams({role:"member",sort:"-updated_on",pagelen:String(Z),page:String(Math.max(1,$.page??1))}),Y=$.query?.trim();if(Y)Q.set("q",`name ~ ${b3(Y)}`);let X=await this.workspaceSlugs(),J=await Promise.all(X.map(async(K)=>{let H=await this.get(`/repositories/${encodeURIComponent(K)}?${Q}`);if(!H)return{values:[],next:null};let F=await yR(H,"list_repos");if(!Array.isArray(F.values))throw new g0({provider:"bitbucket",status:502,message:`Bitbucket /repositories/${K} returned no values array`});return F})),G=J.flatMap((K)=>K.values??[]).map((K)=>zu$(K,this.host)).sort((K,H)=>(H.updatedAt??"").localeCompare(K.updatedAt??"")),W=X.length<=1;return{repositories:W?G:G.slice(0,Z),hasMore:J.some((K)=>!!K.next)||!W&&G.length>Z}}async workspaceSlugs(){if(this.workspace)return[this.workspace];let $=await this.get(`/user/workspaces?pagelen=${eH1}`);if(!$)return[];return((await yR($,"list_workspaces")).values??[]).flatMap((Q)=>typeof Q.workspace?.slug==="string"?[Q.workspace.slug]:[])}async readFile($,Z,Q){let Y=Q;if(!Y){let J=await this.getRepo($);if(!J?.defaultBranch)return null;Y=J.defaultBranch}let X=await this.get(`${Ez($)}/src/${encodeURIComponent(Y)}/${Fp(Z)}`,{accept:"text/plain, */*"});if(!X)return null;return X.text()}async archiveTarball($,Z){let Q=Z;if(!Q){let G=await this.getRepo($);if(!G?.defaultBranch)return null;Q=G.defaultBranch}let Y=j36($,Q),X={accept:"application/octet-stream, */*",timeoutMs:D36},J=await this.authedFetch(Y,X);if(J.status===401||J.status===403){await J.body?.cancel().catch(()=>{});let{token:G}=await this.accountToken();J=await eY(Y,G,{...X,basicAuth:!0})}if(J.status===404)return await J.body?.cancel().catch(()=>{}),null;if(!J.ok)throw await $J(J);return J.body}async identity(){let $=await this.authedFetch(`${PQ}/user`);if($.status===401||$.status===403)return await $.body?.cancel().catch(()=>{}),null;if(!$.ok)throw await $J($);let Z=Au$.parse(await yR($,"identity"));return{name:Z.display_name||Z.nickname,email:await this.primaryEmail()??`${Z.nickname}@users.noreply.${this.host}`}}async primaryEmail(){let $=await this.authedFetch(`${PQ}/user/emails?pagelen=${eH1}`);if(!$.ok)return await $.body?.cancel().catch(()=>{}),null;let Q=(await yR($,"user_emails").catch(()=>null))?.values??[],Y=Q.find((X)=>X.is_primary===!0&&X.is_confirmed!==!1)??Q.find((X)=>X.is_confirmed!==!1);return typeof Y?.email==="string"&&Y.email?Y.email:null}async get($,Z){let Q=await this.authedFetch(`${PQ}${$}`,Z);if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await $J(Q);return Q}async authedFetch($,Z={}){let Q=await this.accountToken(),Y=await eY($,Q.token,Z);if(Y.status!==401)return Y;await Y.body?.cancel().catch(()=>{});let X=await this.accountToken({forceRefresh:!0});return eY($,X.token,Z)}}function Fp($){return $.replace(/^\/+/,"").split("/").map((Z)=>encodeURIComponent(Z)).join("/")}var D36=60000,O36=30,eH1=100,w36,Tu$,Au$,E36;var gR=L(()=>{a4();S5();Hp();b40();w36=Z7.object({uuid:Z7.string().min(1),full_name:Z7.string().min(1),is_private:Z7.boolean(),description:Z7.string().nullish(),mainbranch:Z7.object({name:Z7.string().nullish()}).nullish(),links:Z7.object({html:Z7.object({href:Z7.string()}).nullish()}).nullish(),updated_on:Z7.string().nullish()});Tu$=Z7.object({avatar:Z7.object({href:Z7.string().nullish()}).nullish()}).nullish(),Au$=Z7.object({uuid:Z7.string().min(1),nickname:Z7.string().min(1),display_name:Z7.string().nullish(),links:Tu$}),E36=Z7.object({uuid:Z7.string().min(1),slug:Z7.string().min(1),links:Tu$})});function QF1($,Z,Q){return{kind:Q,async get(Y){let X=Y?.forceRefresh?await $.get(Z):null,J=await y3({connectionId:Z,tokenStorage:$,bufferMs:Y?.bufferMs,force:Y?.forceRefresh===!0&&X!==null&&zz(X)});if(!J.accessToken)return null;return{token:J.accessToken,kind:Q,expiresAt:null}}}}function kO0($){return $==="token"?"token":"oauth"}function g40($){return YF1($)===null}function YF1($){if($.status!=="active")return"revoked";if($.authKind==="github_cli")return $.type==="github"&&$.host==="github.com"&&bR()?null:"provider_unavailable";if($.type==="github"&&$.authKind==="github_app"){if(OF()===null)return"provider_unavailable";if($.installationId===null)return"installation_missing";if(!$.installationAuthorizedBy)return"authorization_required";if($.installationRepositoryIds?.length===0)return"no_repositories"}return null}function _N($,Z){if(Z.status!=="active")throw new g0({provider:Z.type,status:403,message:"This git account was revoked. Reconnect it before accessing repositories."});if(Z.authKind==="github_app"&&(!Z.installationAuthorizedBy||Z.installationRepositoryIds?.length===0))throw new g0({provider:Z.type,status:403,message:"Reconnect this git account. A GitHub installation must be authorized by its account owner or by someone who administers repositories in it."});let Q=new R40($.db,$.vault);switch(Z.type){case"github":{if(Z.authKind==="github_cli")return new xR({host:Z.host,tokenSource:Lu$(Z)});if(Z.authKind==="github_app"){let Y=OF();if(!Y)throw new g0({provider:"github",status:503,message:"GitHub App credentials are not configured on this deployment"});if(Z.installationId===null)throw new g0({provider:"github",status:403,message:"This GitHub account has no installation linked. Reconnect it to select repositories."});return new xR({host:Z.host,installationId:Z.installationId,repositoryIds:Z.installationRepositoryIds,appAuth:Y})}return new xR({host:Z.host,tokenSource:QF1(Q,Z.id,kO0(Z.authKind))})}case"gitlab":return new x40({host:Z.host,tokenSource:QF1(Q,Z.id,kO0(Z.authKind))});case"bitbucket":return new y40({workspace:Z.authKind==="token"?Z.login:null,host:Z.host,tokenSource:QF1(Q,Z.id,kO0(Z.authKind))})}}function Ru$($){if($.authKind==="github_app")return"installation";if($.authKind==="github_cli")return"token";return kO0($.authKind)}function h40($,Z,Q="installation"){return{ref:$,tokenSource:{kind:Q,get:()=>Promise.resolve({token:Z,kind:Q,expiresAt:null})}}}async function CO0($,Z){let Q=CD(Z);if(!Z.accountId)throw new g0({provider:Z.provider,status:401,message:`${Z.path} is linked without an account; link it again to read and write it`});let Y=await qu$($,Z,Z.accountId),X=_N($,Y),J=Ru$(Y);return{ref:Q,tokenSource:{kind:J,get:(G)=>X.tokenForRepo(Q,G)}}}async function vN($,Z,Q){let Y=CD(Z);if(!Z.accountId)return z36(Y);let X=await qu$($,Z,Z.accountId),J=_N($,X),W=Ru$(X)==="installation"?await ih$((F,U)=>J.readFile({...Y,path:F},U),Y):[],K=await J.tokenForRepo(Y,{...Q,alsoRepositories:W}),H=K.kind==="installation"?null:await J.identity().catch(()=>null);return{cloneUrl:b80(Y,K.token),expiresAt:K.expiresAt,gitUserName:H?.name??CN.name,gitUserEmail:H?.email??CN.email}}function z36($){return{cloneUrl:b80($),gitUserName:CN.name,gitUserEmail:CN.email}}async function qu$($,Z,Q){let Y=await new CR($.db).getUnscoped(Q);if(!Y||Y.organizationId!==Z.organizationId)throw new g0({provider:Z.provider,status:404,message:`The account backing ${Z.path} no longer exists. Link the repository again.`});return Y}async function SO0($,Z,Q){let Y=Q.repositoryId?await $.repositories.get(Q.repositoryId,Z):Q.ref?await $.repositories.findByRef(Z,Q.ref):null,X=Y?CD(Y):Q.ref??null;if(!X)return null;return{ref:X,repository:Y,servable:Y?await vD($,Y):!1}}async function vD($,Z){if(!Z.accountId)return!1;let Q=await $.gitProviderAccounts.getUnscoped(Z.accountId);return Q!==null&&g40(Q)}var _O0=L(()=>{a4();BK();uH1();zO0();Jp();ph$();k40();PO0();qO0();wz();gR();S5()});async function P36($,Z){let Q=$.organization?.id;if(!Q)throw Error(l7);if(!Z.sourceConnectionId)throw Error(l7);let Y=await $.storage.connections.findById(Z.sourceConnectionId,Q);if(!Y)throw Error(l7);let{clientFromConnection:X}=await Promise.resolve().then(() => (g80(),ku$)),J=await X(Y,$,!0);try{let{result:G}=await Tg$((H)=>J.callTool({name:"MINT_REPO_TOKEN",arguments:{installationId:Z.installationId,owner:Z.owner,repo:Z.repo,permissions:H}}),Pg$(Z.permissions)),W=G.structuredContent?.token;if(G.isError||!W)throw Error(l7);let K=G.structuredContent?.expiresAt;return{accessToken:W,expiresAt:K?new Date(K):null}}finally{await J.close().catch(()=>{})}}function T36($,Z){return($?.getTime()??0)>Z?$:new Date(Z+Vu$)}async function A36($,Z,Q,Y){let X=Date.now(),J=await P36($,Q),G=T36(J.expiresAt,X);try{await Y.upsert({connectionId:Z,accessToken:J.accessToken,refreshToken:null,scope:null,expiresAt:G,clientId:null,clientSecret:null,tokenEndpoint:null})}catch(W){console.warn("[GithubMint] failed to persist minted token",{connectionId:Z,message:W instanceof Error?W.message:String(W)})}return J.accessToken}async function u40($,Z,Q){let Y=XZ(Z);if(!Y)throw Error("Connection is not repo-scoped");if(!Y.sourceConnectionId)throw Error(l7);let X=new V9($.db,$.vault),J=await X.get(Z.id);if(!Q?.forceRefresh&&J&&!X.isExpired(J,c40))return J.accessToken;let G=XF1.get(Z.id);if(G)return G;let W=A36($,Z.id,Y,X).finally(()=>{XF1.delete(Z.id)});return XF1.set(Z.id,W),W}function Mu$($){return $.slug==="mcp-github"}async function Iu$($,Z,Q){if(XZ(Z)?.sourceConnectionId)return u40($,Z,Q);return(await y3({connectionId:Z.id,connectionUrl:Z.connection_url,tokenStorage:new V9($.db,$.vault),force:Q?.forceRefresh})).accessToken}var XF1;var l40=L(()=>{BK();WG();FF();XF1=new Map});function R36(){return process.env.GITHUB_GRAPHQL_URL??"https://api.github.com/graphql"}function M36($){return $>=500&&$<600}function I36($){return $ instanceof k5?$.cause:$}function V36($,Z){try{return JSON.parse($)}catch(Q){throw Error(`GitHub GraphQL ${Z} returned invalid JSON: ${$.slice(0,300)}`,{cause:Q})}}function k36($,Z){let Q=$.errors?.[0]?.message;if(Q)throw Error(`GitHub GraphQL ${Z} failed: ${Q}`);if($.data==null)throw Error(`GitHub GraphQL ${Z} returned no data`);return $.data}async function Up($){let Z=await $.getToken();if(!Z)throw Error($.missingTokenMessage);let Q=(W)=>fetch(R36(),{method:"POST",headers:{Authorization:`Bearer ${W}`,Accept:"application/vnd.github+json","Content-Type":"application/json"},body:JSON.stringify({query:$.query,variables:$.variables}),signal:AbortSignal.timeout(q36)}),Y=async(W)=>{try{return await O8(async()=>{let K=await Q(W);if(M36(K.status)){let H=K.status;throw await K.body?.cancel().catch(()=>{}),Error(`GitHub GraphQL transient error: ${H}`)}return K},{maxAttempts:3,minTimeout:300,maxTimeout:3000,jitter:1})}catch(K){throw I36(K)}},X=await Y(Z),J=Z;if(X.status===401){try{await X.body?.cancel()}catch{}let W=await $.getToken(!0);if(!W)throw Error($.missingTokenMessage);if(X=await Y(W),J=W,X.status===401)throw Error($.missingTokenMessage)}let G=Gp(J);if(Lz(X.headers,{lane:"graphql",operation:$.operation,installation:G}),Nz(X)){let W=X.headers.get("retry-after")!==null?"secondary":"primary";Dz({lane:"graphql",operation:$.operation,installation:G,kind:W});let K=Bz(X.headers);throw await X.body?.cancel().catch(()=>{}),new g0({provider:"github",status:X.status,retryAfterMs:K,message:`GitHub ${W} rate limit reached${K===null?"":`; retry in ${Math.ceil(K/1000)}s`}`})}if(!X.ok)throw await X.body?.cancel().catch(()=>{}),new g0({provider:"github",status:X.status,message:`GitHub GraphQL ${$.label} failed: ${X.status}`});return k36(V36(await X.text(),$.label),$.label)}var q36=15000;var vO0=L(()=>{$8();S5();M40();Wp()});function _36($){if(!$)return null;if($.state!=="open")return!1;if(typeof $.mergeable==="boolean")return!$.mergeable;let Z=$.mergeable_state;if(typeof Z!=="string"||Z===""||Z==="unknown")return null;return Z==="dirty"}function v36($){if($==="clean")return"passing";if($==="unstable")return"failing";return null}function JF1($){let Z=$.merged===!0||typeof $.merged_at==="string";return{number:$.number??0,url:$.html_url??"",title:$.title??"",body:$.body??"",state:Z?"merged":$.state==="closed"?"closed":"open",draft:$.draft===!0,mergedAt:$.merged_at??null,updatedAt:$.updated_at??null,base:$.base?.ref??"main",head:$.head?.ref??"",headSha:$.head?.sha??"",headRepoPath:$.head?.repo?.full_name??null,author:$.user?.login??"",conflicting:_36($),checks:v36($.mergeable_state),changedFiles:typeof $.changed_files==="number"?$.changed_files:null}}function x36($){if($==="IN_PROGRESS")return"running";if($==="COMPLETED")return"completed";return"queued"}function f36($){switch($){case"SUCCESS":return"success";case"FAILURE":case"STARTUP_FAILURE":return"failure";case"NEUTRAL":case"STALE":return"neutral";case"CANCELLED":return"cancelled";case"SKIPPED":return"skipped";case"TIMED_OUT":return"timed_out";case"ACTION_REQUIRED":return"action_required";default:return null}}function h36($){let Z=$.state;return{id:null,name:$.context??"",state:Z==="PENDING"||Z==="EXPECTED"?"running":"completed",conclusion:Z==="SUCCESS"?"success":Z==="FAILURE"||Z==="ERROR"?"failure":Z==="PENDING"||Z==="EXPECTED"?null:"neutral",url:$.targetUrl??null,durationMs:null,summary:$.description??null}}function u36($){let Z=$.commits?.nodes?.[0]?.commit?.statusCheckRollup?.contexts?.nodes??[],Q=[];for(let Y of Z){if(!Y)continue;if(Y.__typename==="StatusContext"){Q.push(h36(Y));continue}if(Y.__typename!=="CheckRun")continue;let{startedAt:X,completedAt:J}=Y;Q.push({id:Y.databaseId==null?null:String(Y.databaseId),name:Y.name??"",state:x36(Y.status),conclusion:f36(Y.conclusion),url:Y.detailsUrl??null,durationMs:X&&J?new Date(J).getTime()-new Date(X).getTime():null,summary:Y.summary??null})}return Q}function l36($,Z){let Q=($.reviewThreads?.nodes??[]).filter((K)=>K?.isResolved===!1).length,Y=$.reviewDecision,X=Y==="REVIEW_REQUIRED"||Y==="CHANGES_REQUESTED",J=u36($),G=$.number??0,W=$.merged===!0;return{number:G,url:$.url??HK(Z,G),title:$.title??"",body:$.body??"",state:W?"merged":$.state==="OPEN"?"open":"closed",draft:$.isDraft===!0,mergedAt:$.mergedAt??null,updatedAt:$.updatedAt??null,base:$.baseRefName??"main",head:$.headRefName??"",headSha:$.headRefOid??"",headRepoPath:$.headRepository?.nameWithOwner??null,author:$.author?.login??"",conflicting:$.state!=="OPEN"?!1:$.mergeable==="CONFLICTING"?!0:$.mergeable==="MERGEABLE"?!1:null,checks:Zp(J),changedFiles:$.changedFiles??null,checkRuns:J,comments:($.comments?.nodes??[]).flatMap((K)=>K?[{id:String(K.databaseId??0),author:K.author?.login??"",body:K.body??"",createdAt:K.createdAt??"",updatedAt:K.updatedAt??K.createdAt??"",url:K.url??""}]:[]),unresolvedConversations:Q,reviewBlocked:X}}function c36($){let Z=null,Q=-1/0;for(let Y of $??[]){if(!Y?.mergedAt)continue;let X=Date.parse(Y.mergedAt);if(Number.isNaN(X)||X<=Q)continue;Z=Y,Q=X}return Z}function Cu$($){return/not allowed on this repository/i.test($)}class GF1{repo;tokenSource;apiBaseUrl;owner;name;constructor($){this.repo=$.repo,this.tokenSource=$.tokenSource,this.apiBaseUrl=wK($.repo.host);let{owner:Z,name:Q}=y5($.repo);this.owner=Z,this.name=Q}async token($){return(await this.tokenSource.get($?{forceRefresh:!0}:void 0))?.token??null}async requireToken(){let $=await this.token();if($)return $;throw new g0({provider:"github",status:401,message:`No usable GitHub token for ${this.repo.path}; reconnect the account`})}get base(){return`${this.apiBaseUrl}/repos/${this.owner}/${this.name}`}async rest($,Z){let Q=await GZ(`${this.base}${$}`,{method:Z.method,body:Z.body,token:await this.requireToken(),operation:Z.operation});if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await $7(Q,Z.operation);if(Q.status===204)return null;return zQ(Q,Z.operation)}graphql($){return Up({getToken:(Z)=>this.token(Z),missingTokenMessage:`No usable GitHub token for ${this.repo.path}; reconnect the account`,...$})}async read($){let Z=await this.rest(`/pulls/${$}`,{operation:"change_request_read"});return Z?JF1(Z):null}async readForBranch($){return await this.readDetailed({branch:$})}async readDetailed($){let Z="number"in $,Y=(await this.graphql({query:Z?y36:b36,variables:Z?{owner:this.owner,repo:this.name,number:$.number}:{owner:this.owner,repo:this.name,branch:$.branch},label:`change request for ${this.repo.path}`,operation:"change_request_detail"})).repository;if(!Y)throw new g0({provider:"github",status:404,message:`${this.repo.path} is not accessible with this credential`});let X=Z?Y.pullRequest:Y.pullRequests?.nodes?.[0];return X?l36(X,this.repo):null}async listOpen($){return(await this.rest(`/pulls?state=open&sort=updated&direction=desc&per_page=${Math.min($,100)}`,{operation:"change_request_list"})??[]).map(JF1)}async lastMergedInto($){let Z=await this.graphql({query:g36,variables:{owner:this.owner,repo:this.name,base:$},label:`last merged into ${$} on ${this.repo.path}`,operation:"change_request_last_merged"});if(!Z.repository)throw new g0({provider:"github",status:404,message:`${this.repo.path} is not accessible with this credential`});let Q=c36(Z.repository.pullRequests?.nodes);if(!Q)return null;let Y=Q.number??0;return{number:Y,url:Q.url??HK(this.repo,Y),title:Q.title??"",body:Q.body??"",state:"merged",draft:!1,mergedAt:Q.mergedAt??null,updatedAt:Q.mergedAt??null,base:Q.baseRefName??$,head:Q.headRefName??"",headSha:Q.headRefOid??"",headRepoPath:null,author:Q.author?.login??"",conflicting:!1,checks:null,changedFiles:null}}async open($){let Z=await GZ(`${this.base}/pulls`,{method:"POST",token:await this.requireToken(),operation:"change_request_open",body:{title:$.title,body:$.body||void 0,head:$.head,base:$.base}});if(Z.ok)return JF1(await zQ(Z,"change_request_open"));let Q=await $7(Z,"change_request_open");if(/already exists|pull request already/i.test(Q.message))throw new kR(Q.message,await this.readForBranch($.head).catch(()=>null));throw Q}async describe($,Z){await this.rest(`/pulls/${$}`,{method:"PATCH",body:{body:Z},operation:"change_request_describe"})}async merge($,Z={}){let Q=C36[Z.strategy??"any"],Y="";for(let X of Q){let J=await this.attemptMerge($,X,Z);if(J.merged)return J;if(J.reason==="blocked"&&Cu$(J.detail)){Y=J.detail;continue}return J}return{merged:!1,reason:"blocked",detail:Y}}async attemptMerge($,Z,Q){let Y;try{Y=await GZ(`${this.base}/pulls/${$}/merge`,{method:"PUT",token:await this.requireToken(),operation:"change_request_merge",body:{merge_method:Z,...Q.commitTitle?{commit_title:Q.commitTitle}:{},...Q.commitMessage?{commit_message:Q.commitMessage}:{}}})}catch(G){return{merged:!1,...m36(G)}}if(Y.ok)return await Y.body?.cancel().catch(()=>{}),{merged:!0};let X=await $7(Y,"change_request_merge");if(Y.status===404)return{merged:!1,reason:"not_found",detail:X.message};if(Cu$(X.message))return{merged:!1,reason:"blocked",detail:X.message};return{merged:!1,reason:await this.read($).then((G)=>G?.conflicting??null).catch(()=>null)===!0?"conflict":"blocked",detail:X.message}}async readCheckLog($){let Z=await this.rest(`/check-runs/${encodeURIComponent($)}`,{operation:"change_request_check_log"});return Z?.output?.summary??Z?.output?.text??null}async readDeployedUrl($){let Z=await this.rest(`/deployments?sha=${encodeURIComponent($)}&per_page=${S36}`,{operation:"change_request_deployments"});for(let Q of Z??[]){if(typeof Q.id!=="number")continue;let X=(await this.rest(`/deployments/${Q.id}/statuses?per_page=10`,{operation:"change_request_deployment_statuses"})??[]).find((J)=>J.state==="success"&&typeof J.environment_url==="string"&&J.environment_url.length>0);if(X?.environment_url)return X.environment_url}return null}}function m36($){let Z=$ instanceof Error?$.message:String($);if($ instanceof g0&&$.isRateLimited)return{reason:"rate_limited",detail:Z};return{reason:"error",detail:Z}}var C36,S36=3,Su$=`
 fragment CrDetail on PullRequest {
   number
@@ -3337,7 +3337,7 @@ ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{
 `);yield B?ba$(B):"alive"}}}catch(W){if(Y.signal.aborted&&!Z?.aborted)throw Y.signal.reason;throw W}finally{clearTimeout(X)}}async hostStall($,Z){let Q=Date.now(),Y=0;while(!Z.aborted){let X=!1,J="";try{for await(let G of this.watchOnce($,Z))if(Q=Date.now(),Y=0,G!=="alive"&&Sa$(G))break;X=!0}catch(G){if(Z.aborted)return null;if(G instanceof dC0)return console.warn(`[${dp}] ${G.message} for ${$}: its progress is unbounded`),null;J=ip(G)}if(Date.now()-Q>=this.stallMs)return new Pg(`the host showed no progress for ${$} in ${this.stallMs/1000}s${J?`: ${J}`:""}`);await $$(X?this.stallMs/4:_a$(Y++),{signal:Z}).catch(()=>{})}return null}async*watchClaimLifecycle($,Z){let Q=mC0(Z,this.closed.signal),Y=Date.now(),X=0,J="";while(!Q?.aborted){let G="watch ended before ready";try{for await(let W of this.watchOnce($,Q)){if(Y=Date.now(),X=0,W==="alive")continue;let K=JSON.stringify(W);if(K!==J)J=K,yield W;if(Sa$(W))return}}catch(W){if(Q?.aborted)return;if(W instanceof dC0){yield iC0(W.message);return}G=`watch failed: ${ip(W)}`}if(Date.now()-Y>=this.stallMs){yield iC0(G);return}await $$(_a$(X++),{signal:Q}).catch(()=>{})}}}function ba$($){let Z;try{Z=JSON.parse($)}catch{return iC0("host sent a non-JSON phase")}let Q=ul$.safeParse(Z);return Q.success?Q.data:iC0(`host sent a malformed phase: ${Q.error.message}`)}var dp="RemoteSandboxProvider",Ca$=30000,oE6=2147483647,va$=500,aE6=10,rE6=0.5,xa$=5000,sE6=3000,eE6=300000,$z6=5000,Pg,dC0;var lB1=L(()=>{hU();Vd();$8();Dg();vF1();fp();MC0();IC0();uC0();Pg=class Pg extends Error{constructor($){super($);this.name="SandboxHostError"}};dC0=class dC0 extends Error{}});var ua$={};J0(ua$,{subscribeLifecycle:()=>pB1,readControlPlaneSandboxConfig:()=>b60,getOrInitSharedRunner:()=>y60,getAgentSandboxProviderForTeardown:()=>iB1,getAgentSandboxProvider:()=>KJ,__resetSharedLifecyclesForTesting:()=>Lz6});function mB1($){let Z=f60[ya$];if(Z)return Promise.resolve(Z);let Q=f60[cB1];if(Q)return Q;let Y=$().then((X)=>{return f60[ya$]=X,X}).finally(()=>{delete f60[cB1]});return f60[cB1]=Y,Y}function Xz6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Jz6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Gz6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Wz6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Kz6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}function b60(){let $=process.env.STUDIO_SANDBOX_CONTROL_PLANE_URL?.trim(),Z=process.env.STUDIO_SANDBOX_CONTROL_PLANE_TOKEN?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_CONTROL_PLANE_URL and STUDIO_SANDBOX_CONTROL_PLANE_TOKEN must both be set, or both unset.");return{url:$,token:Z}}async function dB1($){let Z=process.env.FREESTYLE_API_KEY?.trim();if(!Z)return ga$($);let Q=await ga$($).catch((J)=>{console.warn("[lifecycle] kubernetes sandbox provider unavailable, using Freestyle only:",J instanceof Error?J.message:String(J));return}),[{FreestyleSandboxProvider:Y},{SandboxProviderRouter:X}]=await Promise.all([Promise.resolve().then(() => (Ia$(),Ma$)),Promise.resolve().then(() => (hB1(),gB1))]);return new X({kubernetes:Q,freestyle:new Y({apiKey:Z,image:process.env.STUDIO_SANDBOX_FREESTYLE_IMAGE?.trim()||void 0,meter:X$})},{freestyleShare:Hz6()})}function Hz6(){let $=Number(process.env.STUDIO_SANDBOX_FREESTYLE_SHARE??0);if(Number.isFinite($)&&$>=0&&$<=1)return $;return console.warn("[lifecycle] STUDIO_SANDBOX_FREESTYLE_SHARE must be a number from 0 to 1; using 0"),0}async function ga$($){let Z=b60();if(Z){let{RemoteSandboxProvider:K}=await Promise.resolve().then(() => (lB1(),uB1));return new K({baseUrl:Z.url,token:Z.token,credentialLifetimeMs:{orgFsConfig:vC0},meter:X$})}let Q=new p40($),Y=Xz6(),{AgentSandboxProvider:X}=await Promise.resolve().then(() => (V60(),zo$)),J=new fX(P0().encryptionKey),G=rO0($,J),W=CC0(process.env.STUDIO_SANDBOX_TENANT_POOLS);return new X({stateStore:Q,previewUrlPattern:Y,sandboxTemplateName:Jz6(),envName:Gz6(),previewGateway:Kz6(),sentinelToken:Wz6(),tenantPools:To$(W),mintPoolCloneUrl:Ao$(W,G.mintCloneUrl),meter:X$,...G})}function KJ($){if(!P0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return mB1(()=>dB1($.db))}function iB1($){return mB1(()=>dB1($.db))}async function y60(){if(!P0().agentSandboxEnabled)return null;return mB1(()=>dB1(Z8().db))}function pB1($,Z,Q){let Y=fz.get(Z);if(Y){if(Y.terminated){if(Y.lastPhase)try{Q(Y.lastPhase)}catch{}return{unsubscribe:Nz6}}if(Y.listeners.add(Q),Y.lastPhase)try{Q(Y.lastPhase)}catch{}return ha$(Z,Y,Q)}let X=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:X};return fz.set(Z,J),Bz6($,Z,J),ha$(Z,J,Q)}function Nz6(){}function ha$($,Z,Q){return{unsubscribe(){if(fz.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)fz.delete($),Z.abort.abort()}}}async function Bz6($,Z,Q){let Y=null;try{for await(let X of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=X;let J=X.kind==="ready"||X.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let W of G)try{W(X)}catch{}if(J)break}}catch(X){Y=X}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let X={kind:"failed",reason:"unknown",message:Y instanceof Error?Y.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=X,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(X)}catch{}}if(fz.get(Z)===Q)fz.delete(Z)}}function Lz6(){for(let $ of fz.values())$.abort.abort();fz.clear()}var ya$,cB1,f60,Fz6,Uz6,fz;var RK=L(()=>{bQ();f6();MF1();$w();Y$();kF1();xC0();SC0();ya$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),cB1=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),f60=globalThis;Fz6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Uz6=globalThis,fz=Uz6[Fz6]??=new Map});import{sql as Dz6}from"kysely";function la$($){return $ instanceof Date?$.toISOString():String($)}class nB1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:la$($.created_at),updatedBy:$.updated_by,updatedAt:la$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new bz($.id)}async create($){let Z=a8("sec"),Q=await this.vault.encrypt($.value),Y=new Date,X=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(pC0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new qK($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let Y=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(pC0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Y)throw new qK($);this.assertVisible(Y,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(pC0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Y)=>Y.or([Y("scope","=","organization"),Y.and([Y("scope","=","user"),Y("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Y)=>this.rowToInfo(Y))}async findById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(pC0).executeTakeFirst();if(!Y)throw new qK($);return this.assertVisible(Y,Q),this.rowToInfo(Y)}async resolveById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Y)throw new qK($);this.assertVisible(Y,Q);let X=await this.vault.decrypt(Y.encrypted_value);return{info:this.rowToInfo(Y),value:X}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(Dz6`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new qK(`${$.scope.kind}:${$.name}`);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}}var pC0,qK,bz;var g60=L(()=>{SY();pC0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];qK=class qK extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};bz=class bz extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function nC0({ctx:$,orgId:Z,userId:Q,entries:Y}){if(!Y||Y.length===0)return[];let X=[];for(let J of Y)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);X.push({host:J.host,token:G})}catch(G){if(G instanceof qK||G instanceof bz){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return X}var tB1=L(()=>{g60()});function KZ($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function TF($,Z,Q){let Y=$[Z]?.[Q];if(!Y)return null;return VL(Y)[XY]??null}function h60($,Z,Q,Y){let J={...VL($[Z]?.[Q]),[XY]:Y};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function ca$($,Z,Q,Y,X,J){let G=await $.findById(Z);if(!G)return;let W=G.metadata??{},K=h60(KZ(W),Y,X,J);await $.update(Z,Q,{metadata:{...W,sandboxMap:K}})}function oB1($,Z,Q){let Y=VL($[Z]?.[Q]);if(!Y[XY])return null;let X={...Y};delete X[XY];let J={...$[Z]??{}};if(Object.keys(X).length===0)delete J[Q];else J[Q]=X;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function yz($,Z,Q,Y,X){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},W=oB1(KZ(G),Y,X);if(!W)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:W}})}var XY="agent-sandbox";var OG=L(()=>{r8()});async function u60($,Z,Q){let Y=$.storage.threads.getOrganizationId();if(!Y||!Z)return null;let X=await(Q??$.storage.virtualMcps.findById(Z,Y));return X?.organization_id===Y?X.metadata??null:null}function dD($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function AF($,Z={}){let Q=$.replace(/^thread:/,"").replace(/\//g,"-");return Z.flat?`sandbox-thread-${Q}`:`sandbox/thread-${Q}`}function Tg($){return $==="gitlab"}async function aB1($,Z,Q){if(!Q)return AF(Z);return AF(Z,{flat:Tg(await Oz6($,Q))})}async function Oz6($,Z){let Q=typeof Z.url==="string"?tY(Z.url)?.provider:void 0;if(Q)return Q;let Y=$.storage.threads.getOrganizationId();if(!Z.repositoryId||!Y)return null;return(await $.storage.repositories.get(Z.repositoryId,Y).catch(()=>null))?.provider??null}function mN($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Ag($,Z,Q){return sB1(await rB1($,Z),Q)}async function rB1($,Z){let Q=mN(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function sB1($,Z){return $?.created_by??Z}async function gz($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function tC0($,Z){let Y=(await gz($,Z))?.headRef;return typeof Y==="string"&&Y.length>0?Y:null}async function ma$($,Z,Q){let Y=await gz($,Z);if(!Y)return;if(Y.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...Y,headRef:Q}}).catch((X)=>console.warn("[thread-repo] setThreadHeadRef failed",X))}function jz6($,Z){let Q=KO0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let Y=XZ(Q);return{...$,connectionId:Q.id,...Y?.installationId?{installationId:Y.installationId}:{}}}async function eB1($,Z){let Y=(await gz($,Z))?.additionalRepositories;return Array.isArray(Y)?Y.filter((X)=>X?.owner&&X?.name):[]}async function dN($,Z){let Q=await gz($,Z),Y=Q?.repository??null;if(!Z||!Q||!Y?.connectionId||Y.repositoryId)return Y;try{let X=$.storage.threads.getOrganizationId();if(!X)return Y;if(await $.storage.connections.findById(Y.connectionId,X))return Y;let{items:J}=await $.storage.connections.list(X),G=jz6(Y,J);if(!G)return Y;return await $.storage.threads.update(Z,{metadata:{...Q,repository:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Y.connectionId,to:G.connectionId}),G}catch(X){return console.warn("[thread-repo] repoint check failed",X),Y}}function $L1($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===dD($.threadId))return $.runBranch;if($.threadRepo)return dD($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function ZL1($,Z){let Y=(await gz($,Z))?.pinnedRef;return typeof Y==="string"&&Y.length>0?Y:null}async function pp($,Z){let[Q,Y]=await Promise.all([dN($,Z.threadId),ZL1($,Z.threadId)]);return $L1({...Z,threadRepo:Q,pinnedRef:Y})}async function da$($,Z,Q,Y,X){let J=await gz($,Z);if(!J)return;let G=h60(KZ(J),Q,Y,X);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function oC0($,Z){return KZ(await gz($,Z))}async function ia$($,Z,Q,Y){let X=await gz($,Z);if(!X)return;let J=oB1(KZ(X),Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...X,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var MK=L(()=>{a4();WG();OG()});function l60($){let Z=new Set($.map((F)=>F.name.toLowerCase()).filter((F,U,N)=>N.indexOf(F)!==U)),Q=$.map((F)=>Z.has(F.name.toLowerCase())),Y=(F)=>{let U=$[F];return QL1(Q[F]?`${U.owner}-${U.name}`:U.name).toLowerCase()};for(let F=0;F<$.length;F++){let U=new Map,N=!1;for(let B=0;B<$.length;B++){let D=Y(B),O=U.get(D);if(O!==void 0){if(!Q[B])Q[B]=!0,N=!0;if(!Q[O])Q[O]=!0,N=!0}U.set(D,B)}if(!N)break}let X=$.map((F,U)=>QL1(Q[U]?`${F.owner}-${F.name}`:F.name)),J=new Map;for(let F of X)J.set(F.toLowerCase(),(J.get(F.toLowerCase())??0)+1);let G=X.map((F,U)=>{if(J.get(F.toLowerCase())===1)return F;let N=new URL($[U].url).host;return QL1(`${N}-${F}`)}),W=new Map;for(let F of G)W.set(F.toLowerCase(),(W.get(F.toLowerCase())??0)+1);let K=new Set(G.filter((F)=>W.get(F.toLowerCase())===1).map((F)=>F.toLowerCase())),H=G.map((F,U)=>U).filter((F)=>W.get(G[F].toLowerCase())!==1).sort((F,U)=>(we($[F])??"").localeCompare(we($[U])??""));for(let F of H){let U=G[F],N=1,B=`${U}-${N}`;while(K.has(B.toLowerCase()))B=`${U}-${++N}`;K.add(B.toLowerCase()),G[F]=B}return G}function pa$($,Z){let Q=$.findIndex((Y)=>_L(Y,Z));return Q===-1?null:l60($)[Q]??null}function QL1($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}var YL1=()=>{};import{AsyncLocalStorage as wz6}from"async_hooks";function c60(){let $=m3.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function aC0($){if($?.metadata?.source==="jira")return zz6;return DK.some((Q)=>Yz($?.title,Q))?Ez6:na$}var m3,na$,Ez6,zz6;var iD=L(()=>{u4();m3=new wz6;na$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],Ez6=[...na$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],zz6=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD","JIRA_ISSUE_CREATE","JIRA_ISSUE_SEARCH"]});import{z as d3}from"zod";async function Rz6($,Z,Q,Y,X){return O8(async()=>{let G=TF(await oC0($,Z),Q,Y)??(X?TF(KZ(await u60($,X)),Q,Y):null);if(!G)throw Error("sandbox record not written yet");return G},{maxAttempts:Pz6,minTimeout:Tz6,maxTimeout:Az6,jitter:0}).catch(()=>null)}function Mz6($,Z,Q=oa$){if($.some((Y)=>_L(Y,Z)))return!1;return $.length>=Q}async function JL1($,Z,Q,Y){let X=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:Y})});if(!X.ok)throw Error(`sandbox bash failed (${X.status} ${X.statusText})`);let J=await X.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function aa$($){return`cd ${$} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`}async function Iz6($,Z,Q,Y){let X=()=>JL1($,Z,Q,aa$(Y)).then((W)=>ra$(W.stdout)).catch(()=>null),J=await X();if(!J?.cloned)return!1;await $$(XL1);let G=await X();return!!G?.cloned&&G.listing===J.listing}function ra$($){let Z=$.split(`
 `).map((X)=>X.trim()),Q=Z.includes("__CLONED__"),Y=Z.filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Q,listing:Y.join(`
 `)}}function Vz6($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...kz6].join(`
-`)}async function Cz6($,Z,Q){if(Q.repository)return vN($,Q.repository,{bufferMs:rC0});return await Op({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),xN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:rC0})}async function Sz6($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return nC0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function _z6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function vz6($,Z,Q,Y){let X=l60(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await Pz($.storage,Z,G),H=K&&await vD($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await vN($,H,{bufferMs:rC0}):await xN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:rC0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var rC0=3300000,Pz6=4,Tz6=250,Az6=2000,ta$=45000,XL1=1500,qz6=5,oa$=20,kz6,GL1;var sa$=L(()=>{_0();N7();i40();dO0();RK();t40();tB1();OG();MK();$8();YL1();iD();kz6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];GL1=m({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. If your workspace already names a repository, use that checkout directly. For a workspace without a repository, call this once with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:d3.object({id:d3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:d3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:d3.object({success:d3.boolean(),repositories:d3.array(d3.object({id:d3.string(),repo:d3.string()})).optional(),repo:d3.string().optional(),cloned:d3.boolean().optional(),files:d3.string().optional(),message:d3.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=t0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=c60(),J=await Tz(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((X0)=>X0.id===G):void 0;if(!W){let X0=J.map((N0)=>({id:N0.id,repo:N0.label}));return{success:!1,repositories:X0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:X0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=K.metadata?.repository?null:await u60(Z,K.virtual_mcp_id),F=await pp(Z,{threadId:X,runBranch:K.branch,agentRepo:H?.repository}),U=await Ag(Z,F,Y),N=await Rz6(Z,X,U,F,H?.repository?K.virtual_mcp_id:null);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.repository??H?.repository,D=K.metadata?.additionalRepositories??[],O={url:W.webUrl,repositoryId:W.repository?.id},j=B&&_L(B,O),w=await KJ(Z);if(j&&await Iz6(w,N.sandboxHandle,X,"."))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`${W.label} is already checked out at your working directory.`};if(B&&!j&&Mz6(D,O))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`This run already has ${oa$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:E,gitUserName:z,gitUserEmail:A}=await Cz6(Z,Q.id,W),P={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},T=!B||!!j,q=T?[]:await Z.storage.threads.appendThreadRepository(X,P);if(!B)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},repository:P},updated_by:Y});let f=mO0({branch:F,derivedRef:AF(F,{flat:Tg(W.provider)}),recordedHeadRef:null,sticky:!1}),S=await Sz6(Z,Q.id,Y),V=await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(_z6({...T?{primary:{cloneUrl:E,branch:f,repoName:`${W.owner}/${W.name}`}}:{secondaries:await vz6(Z,Q.id,q,S)},submoduleCredentials:S,gitUserName:z,gitUserEmail:A}))});if(!V.ok)throw Error(`the sandbox rejected the repository (${V.status} ${V.statusText})`);await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((X0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",X0)});let u=T?null:pa$(q,P),g=T||!u?".":`"$(dirname "$PWD")/repos/${u}"`,l=Date.now()+ta$,h=!1,i="",H0=0,R0=null;while(Date.now()<l){let X0=await JL1(w,N.sandboxHandle,X,aa$(g)).catch(()=>null);if(!X0){if(++H0>=qz6)break;await $$(XL1);continue}H0=0;let N0=ra$(X0.stdout);if(N0.cloned&&N0.listing===R0){h=!0,i=N0.listing;break}R0=N0.cloned?N0.listing:null,await $$(XL1)}if(h)await JL1(w,N.sandboxHandle,X,Vz6(T?null:`../repos/${u}`)).catch((X0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",X0));return{success:h,repo:`${W.owner}/${W.name}`,cloned:h,files:i,message:h?T?`${W.label} is checked out at your working directory on branch ${f}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${u}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(ta$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as y1}from"zod";var np=50000,tp=500,sC0=200,op=50000,pD,m60,Rg,xz6,fz6,bz6,ea$,ap,yz6,gz6,$r$;var jG=L(()=>{u4();u4();pD=y1.enum(LF),m60=y1.enum(["bug","feature","chore","spike","security"]),Rg=y1.enum(["none","low","medium","high","urgent"]),xz6=y1.object({threadId:y1.string(),virtualMcpId:y1.string().nullable(),status:y1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:y1.string().nullable(),lastMessage:y1.string().nullable(),hasPreview:y1.boolean(),failureKind:y1.string().nullable(),hasMessages:y1.boolean(),costUsd:y1.number().nullable(),costProvider:y1.string().nullable(),createdAt:y1.string(),lastActiveAt:y1.string()}),fz6=y1.object({reviewer:y1.enum(DK),verdict:y1.enum(["approved","changes_requested"]),verified:y1.boolean()}),bz6=y1.object({id:y1.string(),name:y1.string(),color:y1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:y1.string(),createdAt:y1.string().datetime()}),ea$=y1.object({url:y1.string(),number:y1.number(),repoOwner:y1.string(),repoName:y1.string(),createdAt:y1.string(),updatedAt:y1.string().nullable(),title:y1.string().nullable(),body:y1.string().nullable(),state:y1.enum(["open","closed"]).nullable(),draft:y1.boolean().nullable(),merged:y1.boolean().nullable(),mergeable:y1.boolean().nullable(),checksStatus:y1.enum(["pending","passing","failing"]).nullable(),checks:y1.array(y1.object({name:y1.string(),status:y1.string(),conclusion:y1.string().nullable(),detailsUrl:y1.string().nullable(),summary:y1.string().nullable()})),previewUrl:y1.string().nullable()}),ap=y1.object({id:y1.string(),organizationId:y1.string(),title:y1.string(),description:y1.string().nullable(),status:pD,priority:Rg,type:m60,assigneeId:y1.string().nullable(),assignedBy:y1.string().nullable(),repo:y1.string().nullable(),repositoryId:y1.string().nullable(),dueDate:y1.string().datetime().nullable(),sortOrder:y1.number(),keySeq:y1.number().nullable(),externalUrl:y1.string().nullable(),previewRoutes:y1.array(y1.string()),source:y1.enum(["jira"]).nullable(),retryAttempts:y1.number(),reviewCycleStartedAt:y1.string().datetime().nullable(),threads:y1.array(xz6),tags:y1.array(bz6),reviewVerdicts:y1.array(fz6),statusSince:y1.string().datetime().nullable(),createdBy:y1.string(),createdAt:y1.string().datetime(),updatedBy:y1.string(),updatedAt:y1.string().datetime()}),yz6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported","finding_resolved"],gz6=y1.enum(yz6),$r$=y1.object({id:y1.string(),taskBoardItemId:y1.string(),action:gz6,actorId:y1.string().nullable(),data:y1.record(y1.string(),y1.unknown()),occurredAt:y1.string().datetime()})});async function eC0($,Z,Q){if(Q===V8)return;let{members:Y}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!Y.some((X)=>X.userId===Q))throw Error("assigneeId is not a member of the organization")}var WL1=L(()=>{jG()});async function $S0($,Z,Q){let Y=await $.storage.tags.listOrgTags(Z),X=new Set(Y.map((J)=>J.id));for(let J of Q)if(!X.has(J))throw Error(`Tag not found: ${J}`)}function Yr$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(hz6))continue;Z[Q]=Y}return Z}function ZS0($){return{taskBoardItemId:$.id,...EQ($)&&{[Zr$]:Qr$}}}function uz6($){return $?.[Zr$]===Qr$}function lz6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function cz6($,Z){let Q=P0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&HE.provisionKey){let J=await lQ(X,$.auth?.user?.email),G=await HE.provisionKey(J,lz6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function Xr$($,Z,Q){if(!P0().taskQuotaEnforced)return;if(!uz6(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!EQ(X))return;if(!await bh$($,Y))return;return await cz6($,Z)}function Jr$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var hz6="srv.",Zr$="srv.billing",Qr$="subscription";var d60=L(()=>{cd();IH();Y$();OK()});function i60($){let Z=$?.runClass;return Z&&Z in KL1?KL1[Z]:KL1.interactive}var KL1,rp="runClass";var sp=L(()=>{KL1={interactive:10,reviewer:20,retry:30,new_task:40}});async function QS0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),mz6)})])}finally{if(Y)clearTimeout(Y)}}function dz6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function YS0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function S6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=aE.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((j)=>IT(j.providerId)),F=await xf$($,Y,Z),U=F?H.find((j)=>j.providerId==="deco"):void 0;if(F&&U){let j=await QS0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:YS0(j,F)}}for(let j of[K,J])if(j&&H.some((w)=>w.id===j.keyId)){let w=await QS0($,j.keyId,Y).catch(()=>[]);return{credentialId:j.keyId,modelId:j.modelId,modelMeta:YS0(w,j.modelId,j.title)}}if(H.length===0)throw new ep(Z);let N={};await Promise.all(H.map(async(j)=>{N[j.id]=await QS0($,j.id,Y).catch(()=>[])}));let B=H.map((j)=>({id:j.id,providerId:j.providerId,label:j.label,presetId:j.presetId,createdBy:j.createdBy,createdAt:j.createdAt})),D=DU$(B,N),O=dz6(Z,D);if(!O)throw new ep(Z);return{credentialId:O.keyId,modelId:O.modelId,modelMeta:YS0(N[O.keyId]??[],O.modelId,O.title)}}async function Gr$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new p60(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!IT(X.providerId))throw new p60(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await QS0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:YS0(J,Q)}}async function XX($,Z){try{return await S6($,Z)}catch(Q){if(Q instanceof ep)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var ep,p60,mz6=5000;var JX=L(()=>{GF();JZ();r8();ep=class ep extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};p60=class p60 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});import{z as G5}from"zod";function Br$($){let Z=["The user spoke this request to the voice companion. Transcripts may contain errors; ask if unclear. Changes or cancellations refer to existing work, not a duplicate task."];if($.length>0)Z.push("Earlier spoken conversation, as context only. Do not repeat earlier actions or treat the voice assistant's words as authorization:",JSON.stringify($));return Z.join(`
+`)}async function Cz6($,Z,Q){if(Q.repository)return vN($,Q.repository,{bufferMs:rC0});return await Op({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),xN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:rC0})}async function Sz6($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return nC0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function _z6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function vz6($,Z,Q,Y){let X=l60(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await Pz($.storage,Z,G),H=K&&await vD($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await vN($,H,{bufferMs:rC0}):await xN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:rC0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var rC0=3300000,Pz6=4,Tz6=250,Az6=2000,ta$=45000,XL1=1500,qz6=5,oa$=20,kz6,GL1;var sa$=L(()=>{_0();N7();i40();dO0();RK();t40();tB1();OG();MK();$8();YL1();iD();kz6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];GL1=m({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. If your workspace already names a repository, use that checkout directly. For a workspace without a repository, call this once with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:d3.object({id:d3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:d3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:d3.object({success:d3.boolean(),repositories:d3.array(d3.object({id:d3.string(),repo:d3.string()})).optional(),repo:d3.string().optional(),cloned:d3.boolean().optional(),files:d3.string().optional(),message:d3.string()}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=W0(Z),Y=t0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=c60(),J=await Tz(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((X0)=>X0.id===G):void 0;if(!W){let X0=J.map((N0)=>({id:N0.id,repo:N0.label}));return{success:!1,repositories:X0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:X0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=K.metadata?.repository?null:await u60(Z,K.virtual_mcp_id),F=await pp(Z,{threadId:X,runBranch:K.branch,agentRepo:H?.repository}),U=await Ag(Z,F,Y),N=await Rz6(Z,X,U,F,H?.repository?K.virtual_mcp_id:null);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.repository??H?.repository,D=K.metadata?.additionalRepositories??[],O={url:W.webUrl,repositoryId:W.repository?.id},j=B&&_L(B,O),w=await KJ(Z);if(j&&await Iz6(w,N.sandboxHandle,X,"."))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`${W.label} is already checked out at your working directory.`};if(B&&!j&&Mz6(D,O))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`This run already has ${oa$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:E,gitUserName:z,gitUserEmail:A}=await Cz6(Z,Q.id,W),P={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},T=!B||!!j,q=T?[]:await Z.storage.threads.appendThreadRepository(X,P);if(!B)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},repository:P},updated_by:Y});let f=mO0({branch:F,derivedRef:AF(F,{flat:Tg(W.provider)}),recordedHeadRef:null,sticky:!1}),S=await Sz6(Z,Q.id,Y),V=await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(_z6({...T?{primary:{cloneUrl:E,branch:f,repoName:`${W.owner}/${W.name}`}}:{secondaries:await vz6(Z,Q.id,q,S)},submoduleCredentials:S,gitUserName:z,gitUserEmail:A}))});if(!V.ok)throw Error(`the sandbox rejected the repository (${V.status} ${V.statusText})`);await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((X0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",X0)});let u=T?null:pa$(q,P),g=T||!u?".":`"$(dirname "$PWD")/repos/${u}"`,l=Date.now()+ta$,h=!1,i="",H0=0,R0=null;while(Date.now()<l){let X0=await JL1(w,N.sandboxHandle,X,aa$(g)).catch(()=>null);if(!X0){if(++H0>=qz6)break;await $$(XL1);continue}H0=0;let N0=ra$(X0.stdout);if(N0.cloned&&N0.listing===R0){h=!0,i=N0.listing;break}R0=N0.cloned?N0.listing:null,await $$(XL1)}if(h)await JL1(w,N.sandboxHandle,X,Vz6(T?null:`../repos/${u}`)).catch((X0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",X0));return{success:h,repo:`${W.owner}/${W.name}`,cloned:h,files:i,message:h?T?`${W.label} is checked out at your working directory on branch ${f}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${u}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(ta$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as y1}from"zod";var np=50000,tp=500,sC0=200,op=50000,pD,m60,Rg,xz6,fz6,bz6,ea$,ap,yz6,gz6,$r$;var jG=L(()=>{u4();u4();pD=y1.enum(LF),m60=y1.enum(["bug","feature","chore","spike","security"]),Rg=y1.enum(["none","low","medium","high","urgent"]),xz6=y1.object({threadId:y1.string(),virtualMcpId:y1.string().nullable(),status:y1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:y1.string().nullable(),lastMessage:y1.string().nullable(),hasPreview:y1.boolean(),failureKind:y1.string().nullable(),hasMessages:y1.boolean(),costUsd:y1.number().nullable(),costProvider:y1.string().nullable(),createdAt:y1.string(),lastActiveAt:y1.string()}),fz6=y1.object({reviewer:y1.enum(DK),verdict:y1.enum(["approved","changes_requested"]),verified:y1.boolean()}),bz6=y1.object({id:y1.string(),name:y1.string(),color:y1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:y1.string(),createdAt:y1.string().datetime()}),ea$=y1.object({url:y1.string(),number:y1.number(),repoOwner:y1.string(),repoName:y1.string(),createdAt:y1.string(),updatedAt:y1.string().nullable(),title:y1.string().nullable(),body:y1.string().nullable(),state:y1.enum(["open","closed"]).nullable(),draft:y1.boolean().nullable(),merged:y1.boolean().nullable(),mergeable:y1.boolean().nullable(),checksStatus:y1.enum(["pending","passing","failing"]).nullable(),checks:y1.array(y1.object({name:y1.string(),status:y1.string(),conclusion:y1.string().nullable(),detailsUrl:y1.string().nullable(),summary:y1.string().nullable()})),previewUrl:y1.string().nullable()}),ap=y1.object({id:y1.string(),organizationId:y1.string(),title:y1.string(),description:y1.string().nullable(),status:pD,priority:Rg,type:m60,assigneeId:y1.string().nullable(),assignedBy:y1.string().nullable(),repo:y1.string().nullable(),repositoryId:y1.string().nullable(),dueDate:y1.string().datetime().nullable(),sortOrder:y1.number(),keySeq:y1.number().nullable(),externalUrl:y1.string().nullable(),previewRoutes:y1.array(y1.string()),source:y1.enum(["jira"]).nullable(),retryAttempts:y1.number(),reviewCycleStartedAt:y1.string().datetime().nullable(),threads:y1.array(xz6),tags:y1.array(bz6),reviewVerdicts:y1.array(fz6),statusSince:y1.string().datetime().nullable(),createdBy:y1.string(),createdAt:y1.string().datetime(),updatedBy:y1.string(),updatedAt:y1.string().datetime()}),yz6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported","finding_resolved"],gz6=y1.enum(yz6),$r$=y1.object({id:y1.string(),taskBoardItemId:y1.string(),action:gz6,actorId:y1.string().nullable(),data:y1.record(y1.string(),y1.unknown()),occurredAt:y1.string().datetime()})});async function eC0($,Z,Q){if(Q===V8)return;if(!await $.db.selectFrom("member").select("id").where("organizationId","=",Z).where("userId","=",Q).executeTakeFirst())throw Error("assigneeId is not a member of the organization")}var WL1=L(()=>{jG()});async function $S0($,Z,Q){let Y=await $.storage.tags.listOrgTags(Z),X=new Set(Y.map((J)=>J.id));for(let J of Q)if(!X.has(J))throw Error(`Tag not found: ${J}`)}function Yr$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(hz6))continue;Z[Q]=Y}return Z}function ZS0($){return{taskBoardItemId:$.id,...EQ($)&&{[Zr$]:Qr$}}}function uz6($){return $?.[Zr$]===Qr$}function lz6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function cz6($,Z){let Q=P0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&HE.provisionKey){let J=await lQ(X,$.auth?.user?.email),G=await HE.provisionKey(J,lz6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function Xr$($,Z,Q){if(!P0().taskQuotaEnforced)return;if(!uz6(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!EQ(X))return;if(!await bh$($,Y))return;return await cz6($,Z)}function Jr$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var hz6="srv.",Zr$="srv.billing",Qr$="subscription";var d60=L(()=>{cd();IH();Y$();OK()});function i60($){let Z=$?.runClass;return Z&&Z in KL1?KL1[Z]:KL1.interactive}var KL1,rp="runClass";var sp=L(()=>{KL1={interactive:10,reviewer:20,retry:30,new_task:40}});async function QS0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),mz6)})])}finally{if(Y)clearTimeout(Y)}}function dz6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function YS0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function S6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=aE.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((j)=>IT(j.providerId)),F=await xf$($,Y,Z),U=F?H.find((j)=>j.providerId==="deco"):void 0;if(F&&U){let j=await QS0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:YS0(j,F)}}for(let j of[K,J])if(j&&H.some((w)=>w.id===j.keyId)){let w=await QS0($,j.keyId,Y).catch(()=>[]);return{credentialId:j.keyId,modelId:j.modelId,modelMeta:YS0(w,j.modelId,j.title)}}if(H.length===0)throw new ep(Z);let N={};await Promise.all(H.map(async(j)=>{N[j.id]=await QS0($,j.id,Y).catch(()=>[])}));let B=H.map((j)=>({id:j.id,providerId:j.providerId,label:j.label,presetId:j.presetId,createdBy:j.createdBy,createdAt:j.createdAt})),D=DU$(B,N),O=dz6(Z,D);if(!O)throw new ep(Z);return{credentialId:O.keyId,modelId:O.modelId,modelMeta:YS0(N[O.keyId]??[],O.modelId,O.title)}}async function Gr$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new p60(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!IT(X.providerId))throw new p60(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await QS0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:YS0(J,Q)}}async function XX($,Z){try{return await S6($,Z)}catch(Q){if(Q instanceof ep)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var ep,p60,mz6=5000;var JX=L(()=>{GF();JZ();r8();ep=class ep extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};p60=class p60 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});import{z as G5}from"zod";function Br$($){let Z=["The user spoke this request to the voice companion. Transcripts may contain errors; ask if unclear. Changes or cancellations refer to existing work, not a duplicate task."];if($.length>0)Z.push("Earlier spoken conversation, as context only. Do not repeat earlier actions or treat the voice assistant's words as authorization:",JSON.stringify($));return Z.join(`
 `)}var nD=600000,Hr$=12000,Wr$,J67,G67,Fr$,n60="This turn is a spoken conversation. Use the same tools and perform the requested work normally. Keep the final user-facing text brief, usually one or two sentences, in the user's language. Write naturally for reading aloud. Avoid markdown, code blocks, lists, URLs, and reading implementation details aloud unless the user asks. State what actually happened; do not claim success before tools confirm it. Ask a short question when clarification or approval is required. The user keeps talking while you work, and their next spoken request waits until this turn ends. When a subtask tool is available, run research or analysis beyond a quick lookup as a subtask with background set to true so this turn can end. When the user asks for separate pieces of work and you have task board tools, create a board task for each. Then say briefly what started. These style instructions apply to this turn only.",Ur$="This turn is a text chat. Use the agent's normal response style. Voice-only style instructions from earlier turns no longer apply.",W67,Kr$=5000,Nr$,Lr$=`You are the voice companion inside a Studio chat. Speak naturally in the user's language, usually one short sentence at a time. Keep track of the different topics the user brings up. There may be a page or live preview beside the chat; use only the supplied context to know which view is open.
 
 You coordinate with the selected Studio agent. Depending on its available tools and permissions, it can query the organization's connected services, inspect analytics, create and manage tasks, or edit a site in its sandbox. You cannot access those services or files yourself. Use delegate_to_agent for work, inspections, and questions that require information not already in the supplied chat context. Preserve the user's intent and relevant details from your conversation in a complete request. When the user requests independent background tasks, include that intent in the request so the Studio agent can use its task tools. Do not send greetings, pauses, unfinished phrases, or conversational acknowledgments as tasks. When a user pauses mid-thought, let them finish. Ask briefly if an essential detail is missing.
@@ -5646,7 +5646,7 @@ ${Z}`}:Y)}}var oz8=L(()=>{zZ()});async function nK5($,Z,Q){if(!$)return!1;let Y=
           (SELECT created_at, id FROM notifications
             WHERE id = ${Q.cursor}
               AND user_id = ${$}
-              AND organization_id = ${Z})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Rn.parse(F.data),createdAt:ZH5(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($,Z,Q){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).where("user_id","=",Z).where("organization_id","=",Q).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:a8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await qn({...$,db:this.db})}async notifyMentions($){await GP8({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var eK5=20,$H5=50,ZH5=($)=>$ instanceof Date?$.toISOString():$;var KP8=L(()=>{SY();M_0();I_0();WP8()});class hq1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class uq1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function QH5($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function YH5($){return typeof $.id==="string"&&!!$.architecture&&Array.isArray($.architecture.input_modalities)&&Array.isArray($.architecture.output_modalities)&&!!$.top_provider&&!!$.pricing}function XH5($){return{providerId:"openrouter",modelId:QH5($.id),title:$.name,description:$.description||null,logo:null,capabilities:ud($.architecture.input_modalities,$.architecture.output_modalities,$.supported_parameters,$.supported_parameters?.includes("reasoning")?["reasoning"]:[]),limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:Number($.pricing.prompt)||0,output:Number($.pricing.completion)||0}}}function FP8($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function JH5($){if($){let Z=await $.get(HP8,"openrouter");if(Z)return FP8(Z)}try{let Z=await dU("OpenRouter enrichment index","https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)await uY("OpenRouter enrichment index",Z);let{data:Q}=await Z.json(),Y=Q.filter(YH5).map(XH5);if($)await $.set(HP8,"openrouter",Y);return FP8(Y)}catch{return new Map}}function GH5($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function WH5($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function NP8($,Z){if(WH5(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function KH5($,Z){return $.map((Q)=>{let X=GH5(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=NP8(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class lq1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=d9()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listDecisionModels($,Z){let Q=await this.activate($,Z);if(!Q.decisions?.listModels)throw Error("Provider does not support decision model discovery");let Y=`${Q.info.id}:decisions`,X=await this.cache?.get(Z,Y);if(X)return X;let J=new Set,G=(await Q.decisions.listModels()).filter((W)=>{if(W.deprecated||!W.capabilities.includes("decisions")||J.has(W.modelId))return!1;return J.add(W.modelId),!0}).map((W)=>({...W,providerId:Q.info.id}));return await this.cache?.set(Z,Y,G),G}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=d9()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return UP8(U,J.create(Y))}let G=J.create(Y),W=await G.listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"&&X!=="deco"){let U=await JH5(this.cache);H=KH5(H,U)}else H=H.map((U)=>({...U,capabilities:NP8(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return UP8(F,G)}}function UP8($,Z){let Q=Z.asyncResearch;if(!Q)return $;return $.map((Y)=>Q.canHandle(Y.modelId)?{...Y,asyncResearch:!0}:Y)}var HP8="_global";var BP8=L(()=>{WK();CA()});import{SpanStatusCode as LP8}from"@opentelemetry/api";function FH5($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=HH5)break;if(typeof X==="string"&&Y.length<=DP8&&X.length<=DP8)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function UH5($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function NH5($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function dq1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return Tq1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(mZ(B))return!0;if(X&&!N)return Tq1(X,F);let D=mE8(U?.role,F,dE8());if(D!=="fallback")return D==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let O=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...O}}))?.success===!0)return!0;let w=cO$(F);return(await H({headers:Q,body:{permission:w,...O}}))?.success===!0}catch(j){let w=j?.statusCode;if(w!==401&&w!==403)console.error("[Auth] Permission check failed:",j instanceof Error?j.message:String(j));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!u9(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},listMembers:async(F)=>{return Z.api.listMembers({headers:Q,query:F?{organizationId:F.organizationId,limit:F.limit,offset:F.offset,filterField:F.filterField,filterValue:F.filterValue}:void 0})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function zR($,Z,Q){if(rm.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function LH5($,Z,Q){sm($,Z,Q)}function DH5($,Z,Q){em($,Z,Q)}async function jP8($,Z,Q,Y){let X=cq1.get(Q);if(X&&Date.now()-X.at<OP8)return X.value;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=u9(J);return LH5(cq1,Q,G),DH5(cq1,BH5,OP8),G}async function mq1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function OH5($,Z){if(!$)return!0;return Z===$}async function jH5($,Z,Q,Y,X){let J=ZU0($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>Y51(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!OH5(Y,W))return;let K=Y?await mq1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function wH5($,Z,Q,Y=EP8,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=NH5($),N=await Y.measure("auth_query_membership",()=>{let j=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return j.where("organization.slug","=",U).executeTakeFirst();if(H)return j.where("organization.id","=",H).executeTakeFirst();if(F)return j.where("organization.slug","=",F).executeTakeFirst();return j.orderBy("member.createdAt","asc").limit(2).execute().then((w)=>w.length===1?w[0]:void 0)});if(u9({metadata:N?.orgMetadata}))throw Error(sF0);let B=N?.role,D=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let O;if(N&&B)O=await Y.measure("auth_fetch_role_permissions",()=>zR(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:O,organization:D}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>Y51(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await mq1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await jP8(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let D=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(u9(D))return{user:void 0};F=D?{id:D.id,slug:D.slug,name:D.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await jP8(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await mq1(Q,Y,U,K.id,X);let N=await jH5($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(u9({metadata:N?.orgMetadata}))throw Error(sF0);if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N&&!u9(N))K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((D)=>D.userId===W.user.id)?.role;else if(!N)K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;if(W.message===sF0)throw G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function zP8($){let Z=new fX($.encryption.key),Q=P0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(HH()),H=W(BL()),F=(P)=>`read_ndjson('${K}/${P}/**/*.ndjson', auto_detect=true)`,U=(P)=>`read_ndjson('${H}/${P}/**/*.ndjson', auto_detect=true)`,N,B,D,O,j=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,D=F,O=U;else if(X){let P=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new f00(Y,P),B=new f00(Y,P),D=(T)=>"studio_monitoring_logs",O=(T)=>"studio_monitoring_logs"}else if(J){let P=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,T=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,q=Q.duckdbExtensionDirectory;if(!P||!T||!q)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let f={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:P,secretAccessKey:T,extensionDirectory:q},S=new x00(f,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=S,B=S;let V=Q.monitoringS3Bucket,u=Q.monitoringS3Prefix??"",g=(l,h)=>RO$({bucket:V,prefix:u,range:h});D=g,O=g,j=!0}else{let{engine:P}=await hZ1({basePath:HH()}),{engine:T}=await hZ1({basePath:BL()});N=P,B=T,D=F,O=U}let w=new nc($.db),E=new pZ0($.db),z=new h00($.db),A={connections:new Pe($.db,Z),connectionCredentialVault:new $91($.db),organizationSettings:new XA($.db),userModelPreferences:new lZ1($.db),monitoring:new W91(N,D,B,O,G,j),virtualMcps:new MU($.db),users:new Z71($.db),tags:new u00($.db),projectSidebar:new sZ1($.db),experiments:new eZ1($.db),organizationBilling:new K3($.db),aiProviderKeys:new o10($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new Vq1($.db,Z),secrets:new nB1($.db,Z),orgFileConfigs:new kq1($.db,Z),orgSites:new PO($.db),orgRepoSyncs:new uR($.db),gitProviderAccounts:new CR($.db),gitProviderAccountCredentials:new R40($.db,Z),gitProviderOAuthStates:new xq1($.db),githubConnectFlows:new _q1($.db),repositories:new q40($.db),jiraIntegrations:new TO($.db,Z),taskBoard:new p3($.db),columnAutomations:new fq1($.db),taskBoardPrompts:new bq1($.db),taskBoardAnalytics:new OE1($.db),threadAnalytics:new zE1($.db),notifications:new gq1($.db),orgFsEntries:new $e($.db),oauthPkceStates:new hq1($.db),claudeSubscriptions:new uq1($.db,Z),automations:iF0($.db),triggerCallbackTokens:new y00($.db),orgSsoConfig:new tZ1($.db,Z),orgSsoSessions:new oZ1($.db),brandContext:new g00($.db),organizationDomains:new W3($.db),organizationJoinRequests:new pm($.db),kv:z,interests:new nZ1(z)};return async(P,T)=>{let q=T?.timings??EP8,f=vy0(),S=P?await $.observability.tracer.startActiveSpan("studio.auth",async(a)=>{try{let s=await wH5(P,$.auth,$.db,q,$.memberRoleCache);return a.setStatus({code:LP8.OK}),s}catch(s){throw a.setStatus({code:LP8.ERROR,message:s.message}),a.recordException(s),s}finally{a.end()}}):{user:void 0},V=UH5(P,S.user),u=dq1({auth:$.auth,headers:P?.headers??new Headers,role:S.role,permissions:S.permissions,userId:S.user?.id,apiKeyId:S.apiKeyId,organizationId:S.organization?.id}),g={user:S.user,tokenOrganizationId:S.tokenOrganizationId,permissions:S.permissions,permissionsOrganizationId:S.permissions?S.organization?.id:void 0};if(S.apiKey)g.apiKey=S.apiKey;let l=S.organization,h=P?P0().baseUrl??`${new URL(P.url).origin}`:g9(),i=new GA(g.user?.id,void 0,u,S.role,"self",void 0,l?.id),H0={...A,virtualMcps:lU$(A.virtualMcps),threads:new a51(w,l?.id),asyncResearchJobs:new Mq1(E,l?.id)},R0=new lq1(H0.aiProviderKeys,$.modelListCache),X0=yQ(),N0=!l?null:X0?kX(X0,l.id):new _W(l.id,h),n=l&&N0?new vW(N0,H0.orgFsEntries,l.id):null;is0(H0,{objectStorage:N0,baseUrl:h,orgSlug:l?.slug});let t={timings:q,auth:g,connectionId:V,organization:l,storage:H0,vault:Z,authInstance:$.auth,boundAuth:u,access:i,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:h,objectStorage:N0,orgFs:n,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(EH5.map((a)=>[a,P?.headers.get(a)??null]).filter(([,a])=>a!==null)),userAgent:(P?ZU0(P.headers,"client"):null)||P?.headers.get("User-Agent")||void 0,ipAddress:(P?.headers.get("CF-Connecting-IP")||P?.headers.get("X-Forwarded-For"))??void 0,properties:FH5(P?ZU0(P.headers,"properties"):null)},aiProviders:R0,createMCPProxy:async(a)=>{return await az8(a,t)},invalidateMemberRole:$.memberRoleCache?(a,s)=>$.memberRoleCache.invalidate(a,s):void 0,getOrCreateClient:f,pendingRevalidations:[],firecrawlApiKey:P0().firecrawlApiKey};return t}}function $P($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=yQ();$.objectStorage=Q?kX(Q,Z.id):new _W(Z.id,$.baseUrl),$.orgFs=new vW($.objectStorage,$.storage.orgFsEntries,Z.id),is0($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var HH5=50,DP8=500,OP8=60000,BH5=1e4,cq1,wP8,GY,EP8,EH5;var MN=L(()=>{IH();$w();Y$();A9();r51();nH0();tH0();nU$();qO$();qW();uZ1();cZ1();mZ1();iZ1();aZ1();gO$();hO$();c00();fH();J71();sE1();fY();rR1();ze();Iq1();wq1();oX1();g60();sz8();Cq1();zO0();Jp();vq1();oZ0();jE1();PE1();$O();KP8();a61();qL();BP8();LL();kc();kW0();cq1=new Map;GY={set:($)=>{wP8=$},create:async($,Z)=>{return await wP8($,Z)}},EP8={measure:async($,Z)=>{return await Z()}},EH5=["x-hub-signature-256"]});import{DBOS as ly0,SchedulerMode as zH5}from"@dbos-inc/dbos-sdk";function PP8($){pq1=$}function TP8(){if(!pq1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return pq1}async function TH5($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await GY.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},$P(Y,{id:Q.id,slug:Q.slug}),Y}async function AH5($){try{let{db:Z}=TP8(),Q=await TH5(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await nO0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function RH5($,Z){let Q=await ly0.runStep(()=>new uR(TP8().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await ly0.runStep(()=>AH5(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function AP8(){if(iq1)return;iq1=ly0.registerWorkflow(RH5,{name:"orgRepoSyncWorkflow"}),ly0.registerScheduled(iq1,{name:"orgRepoSyncWorkflow",crontab:PH5,mode:zH5.ExactlyOncePerIntervalWhenActive})}var PH5="7-59/10 * * * *",pq1=null,iq1=null;var RP8=L(()=>{MN();tO0()});import{DBOS as cy0,SchedulerMode as qH5}from"@dbos-inc/dbos-sdk";function qP8($){tq1=$}function MP8(){if(!tq1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return tq1}async function kH5($,Z){try{let Q=await IF(MP8().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await v58(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function CH5($,Z){let Q=new Date($.getTime()-IH5),Y=await cy0.runStep(()=>new p3(MP8().db).listItemsAwaitingArchive(Q,VH5),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(S_0(Y).map(({organizationId:G,itemIds:W})=>cy0.runStep(()=>kH5(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function IP8(){if(nq1)return;nq1=cy0.registerWorkflow(CH5,{name:"taskBoardArchiveSweepWorkflow"}),cy0.registerScheduled(nq1,{name:"taskBoardArchiveSweepWorkflow",crontab:MH5,mode:qH5.ExactlyOncePerIntervalWhenActive})}var MH5="23 * * * *",IH5=432000000,VH5=200,tq1=null,nq1=null;var VP8=L(()=>{$O();kn();In()});import{createHmac as SH5,timingSafeEqual as _H5}from"crypto";function CP8($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>vH5)return!1;let W=SH5("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&_H5(K,F)})}function SP8($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=o7(Z),Y=o7(o7(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:mK(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function dy0($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function mK($){return typeof $==="string"?$:void 0}function o7($){return typeof $==="object"&&$!==null?$:void 0}function iy0($){return typeof $==="number"?new Date($*1000):null}function my0($){return mK($)??mK(o7($)?.id)}function xH5($){return my0($.subscription)??mK(o7(o7($.parent)?.subscription_details)?.subscription)}function fH5($){let Z=o7($.lines)?.data;if(Array.isArray(Z)){let Q=null;for(let Y of Z){let X=o7(o7(Y)?.period)?.end;if(typeof X==="number"&&(Q===null||X>Q))Q=X}if(Q!==null)return new Date(Q*1000)}return iy0($.period_end)}function bH5($,Z){let Q=o7($.items)?.data;if(!Array.isArray(Q))return;for(let Y of Q){let X=o7(Y)?.amount;if(typeof X==="number"&&X<=0)continue;let J=my0(o7(Y)?.price);if(J&&Z[J])return Z[J]}return}function rq1($,Z,Q){if($==="past_due")return;if($!=="active")return"free";return}function yH5($){let Z=iy0($.current_period_end);if(Z)return Z;let Q=o7($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=o7(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function oq1($,Z){let Q=iy0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function aq1($,Z){let Q=iy0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function gH5($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=mK(o7(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(mK(o7(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(mK(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let H=mK(Q.id);if(!H)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let F=Number(o7(Q.metadata)?.creditCents);if(!Number.isInteger(F)||F<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:o7(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:F,referenceId:`stripe-topup:${H}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(mK(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.ensureBilling(Y);if(!X)return console.error("stripe webhook: PAID checkout for an org that does not exist",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"unknown org"};let J=my0(Q.subscription);if(!J)return console.error("stripe webhook: subscription checkout without a sub id",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"subscription checkout without sub id"};if(oq1(Z,X))return{handled:!1,reason:"stale event"};if(X.stripeSubscriptionId&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let G=my0(Q.customer);if(!await $.bindSubscription(Y,{stripeSubscriptionId:J,...G?{stripeCustomerId:G}:{},status:"active",lastStripeEventAt:aq1(Z,X)}))return console.error("stripe webhook: lost the bind race",{organizationId:Y,subscriptionId:J,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let K=mK(o7(Q.metadata)?.planId);return{handled:!0,organizationId:Y,...K?{planChange:{planId:K,note:`stripe checkout ${mK(Q.id)??""}`.trim()}}:{}}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=mK(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&oq1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":dy0(Q.status);await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:yH5(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:aq1(Z,X)});let W=rq1(G,Q,P0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...W?{planChange:{planId:W,note:`stripe ${Z.type} (${G})`}}:{}}}case"invoice.paid":{let Y=xH5(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(oq1(Z,X))return{handled:!1,reason:"stale event"};await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:fH5(Q),lastStripeEventAt:aq1(Z,X)});let J=bH5({items:Q.lines},P0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...J?{planChange:{planId:J,note:"stripe invoice.paid"}}:{}}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function hH5($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:dy0(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function kP8($,Z){let Q=hH5($,Z);if(!Q)return;gY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:lR$(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function _P8($){let Z=new K3(Z8().db),Q=await gH5(Z,$);if(!(Q.handled&&Q.topUp))kP8($,Q);if(Q.handled&&Q.topUp)await HJ8({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),kP8($,Q);if(Q.handled&&Q.planChange){try{await jx0({organizationId:Q.organizationId,planId:Q.planChange.planId,note:Q.planChange.note})}catch(Y){if(!(Y instanceof Gt))throw Y;return console.error("stripe webhook: gateway REFUSED the plan change \u2014 the org has been "+"charged (or cancelled) and its entitlement did NOT move. Place it by hand through the gateway admin API.",{organizationId:Q.organizationId,planId:Q.planChange.planId,eventId:$.id,status:Y.status,error:Y.message}),Q}Kt(Q.organizationId)}if(!Q.handled&&Q.orphanSubscriptionId){let Y=Q.orphanSubscriptionId;try{await Eh$(Y)}catch(J){if(!(J instanceof sZ&&(J.status===400||J.status===404)))throw J}let{refundedCents:X}=await zh$(Y);console.error("stripe webhook: reversed orphan subscription",{subscriptionId:Y,refundedCents:X,eventId:$.id})}return Q}var vH5=300;var sq1=L(()=>{_90();bQ();F6();c00();RD();wx0();Y$()});import{DBOS as py0,SchedulerMode as uH5}from"@dbos-inc/dbos-sdk";function vP8($){$M1=$}function xP8(){if(!$M1)throw Error("[subscription-sweep] runtime not initialized \u2014 setSubscriptionSweepRuntime() must run before the workflow fires");return $M1}async function dH5($){let{organizationId:Z,stripeSubscriptionId:Q}=$;if(!Q)return{organizationId:Z,action:"ok"};let Y=new K3(xP8().db);try{let X,J,G=!1;try{let K=await $z(Q);X=dy0(K.status),J=iH5(K)}catch(K){if(!(K instanceof sZ)||K.status!==404)throw K;X="canceled",J=$.currentPeriodEnd,G=!0}let W=rq1(X,{},P0().stripePlanPriceIds);if(await Y.updateStripeState(Z,{status:X,currentPeriodEnd:J,...G&&{stripeSubscriptionId:null}}),!W)return{organizationId:Z,action:"ok"};return await jx0({organizationId:Z,planId:W,note:`studio subscription sweep (${X})`}),Kt(Z),console.warn("[subscription-sweep] revoked a paid tier whose webhook never arrived",{organizationId:Z,subscriptionId:Q,status:X}),{organizationId:Z,action:G?"gone":"revoked"}}catch(X){if(X instanceof Gt)console.error("[subscription-sweep] gateway REFUSED the revocation \u2014 the org still holds a tier it no longer pays for",{organizationId:Z,subscriptionId:Q,status:X.status});return{organizationId:Z,action:"failed",error:X instanceof Error?X.message:String(X)}}}function iH5($){if(typeof $.current_period_end==="number")return new Date($.current_period_end*1000);let Z=0;for(let Q of $.items?.data??[])if(typeof Q.current_period_end==="number")Z=Math.max(Z,Q.current_period_end);return Z>0?new Date(Z*1000):null}async function pH5($,Z){let Q=P0();if(!Q.plansEnabled||!Q.stripeSecretKey)return;let Y=new Date($.getTime()-cH5),X=await py0.runStep(()=>new K3(xP8().db).listSubscriptionsPastPeriodEnd(Y,mH5),{name:"loadLapsedSubscriptions"});if(X.length===0)return;let J=await Promise.all(X.map((W)=>py0.runStep(()=>dH5(W),{name:`sweepSubscription:${W.organizationId}`})));for(let W of J)if(W.action==="failed")console.warn(`[subscription-sweep] org ${W.organizationId} failed: ${W.error}`);let G=J.filter((W)=>W.action==="revoked"||W.action==="gone").length;if(G>0)console.warn(`[subscription-sweep] revoked ${G} of ${X.length} lapsed subscriptions`)}function fP8(){if(eq1)return;eq1=py0.registerWorkflow(pH5,{name:"subscriptionSweepWorkflow"}),py0.registerScheduled(eq1,{name:"subscriptionSweepWorkflow",crontab:lH5,mode:uH5.ExactlyOncePerIntervalWhenActive})}var lH5="41 * * * *",cH5=172800000,mH5=100,$M1=null,eq1=null;var bP8=L(()=>{_90();c00();RD();wx0();sq1();Y$()});async function nH5($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===ny0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,ny0,jO0(Q.length))).id}async function tH5($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!y58(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!dg(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await W5($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),P8(Z,K),!0}async function yP8($,Z,Q,Y=__0){let X=null,J=()=>X??=nH5($,Z),G=0;for(let W of Q)try{if(await tH5($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var ny0="merged";var gP8=L(()=>{u4();HX();kn();VF();m7();_9()});import{DBOS as ty0,SchedulerMode as oH5}from"@dbos-inc/dbos-sdk";function hP8($){QM1=$}function uP8(){if(!QM1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return QM1}async function sH5($,Z){try{let Q=await IF(uP8().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await yP8(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function eH5(){let $=await ty0.runStep(()=>new p3(uP8().db).listItemsAwaitingMergedTag(ny0,rH5),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(S_0($).map(({organizationId:Y,itemIds:X})=>ty0.runStep(()=>sH5(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function lP8(){if(ZM1)return;ZM1=ty0.registerWorkflow(eH5,{name:"taskBoardMergedTagSweepWorkflow"}),ty0.registerScheduled(ZM1,{name:"taskBoardMergedTagSweepWorkflow",crontab:aH5,mode:oH5.ExactlyOncePerIntervalWhenActive})}var aH5="41 * * * *",rH5=200,QM1=null,ZM1=null;var cP8=L(()=>{$O();kn();In();gP8()});function mP8($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"}catch{return!1}}var iP8,$F5,dP8=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},YM1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=dP8(X.substring(0,J));if(Z&&Z!==G||!iP8.test(G))continue;let W=dP8(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if($F5.test(W)){if(Y[G]=W.indexOf("%")!==-1?kd(W,M10):W,Z)break}}return Y},ZF5=($,Z,Q={})=>{if(!iP8.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},oy0=($,Z,Q)=>{return Z=encodeURIComponent(Z),ZF5($,Z,Q)};var pP8=L(()=>{sw();iP8=/^[\w!#$%&'*.^`|~+-]+$/,$F5=/^[ !#-:<-[\]-~]*$/});var Jo=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return YM1(Y,J)[J]}if(!Y)return{};return YM1(Y)},QF5=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=oy0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=oy0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=oy0($,Z,{path:"/",...Q});return Y},aZ0=($,Z,Q,Y)=>{let X=QF5(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var ay0=L(()=>{pP8()});var nP8=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var tP8=()=>{};function XM1($,Z){return`${$}:${Z}`}function oP8($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=XM1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=XM1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(XM1(J,G))}}}class JM1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=aP8.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of aP8)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var aP8;var rP8=L(()=>{aP8=["studio.sse.broadcast","mesh.sse.broadcast"]});async function YF5($,Z,Q=5){try{await O8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof k5?Y.cause:Y)}}function sP8($){let Z=new JM1({getConnection:()=>$.getConnection()});u5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{YF5("[NatsSSEBroadcast]",()=>Z.start())})}var GM1=L(()=>{$8();rP8();Tn();Tn()});var eP8=()=>{};var WM1=()=>{};var $28=()=>{};var XF5,Fd7;var Z28=L(()=>{eP8();WM1();sw();$28();XF5={br:".br",zstd:".zst",gzip:".gz"},Fd7=Object.keys(XF5)});var Q28=L(()=>{Z28()});var Y28=()=>{};var X28=L(()=>{Y28()});var J28=()=>{};var G28=L(()=>{fY1()});var KM1=L(()=>{ew();G28()});var HM1="x-hono-disable-ssg",kd7;var FM1=L(()=>{KM1();kd7=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[HM1]:"true"}})}catch{return null}})()});var W28=L(()=>{SN0()});var UM1=L(()=>{W28()});var K28=L(()=>{X28();J28();WM1();FM1();UM1();KM1()});var H28=L(()=>{FM1();UM1();K28()});var Ui7;var F28=L(()=>{H28();({write:Ui7}=Bun)});var WF5=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},U28=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var N28=()=>{};var rZ0=($)=>("server"in $.env)?$.env.server:$.env;var ry0=()=>{};var KF5;var B28=L(()=>{N28();ry0();KF5=U28(($,Z)=>{let Q=rZ0($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var sZ0=($)=>{let Z=rZ0($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var L28=L(()=>{ry0()});var NM1=L(()=>{Q28();F28();B28();L28();ry0()});var D28;var O28=L(()=>{D28={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function j28(){let $=Object.keys(v4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:D28[X].icon})),Y=P0().localMode;return{emailAndPassword:{enabled:v4.emailAndPassword?.enabled??!1},magicLink:{enabled:v4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:v4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:Cy0},socialProviders:{enabled:Z,providers:Q},sso:v4.ssoConfig?{enabled:!0,providerId:v4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:XO()}}async function HF5($,Z,Q){try{if(!v4.inviteEmailProviderId||!v4.emailProviders||v4.emailProviders.length===0)return;let Y=F3(v4.emailProviders,v4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=m00,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=H3(Y),K=`${g9()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:U3({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:MA("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var AO,w28;var BM1=L(()=>{F8();NM1();F6();Y$();v3();bQ();Qq1();FH1();Iy0();qA();fY();A9();iZ1();O28();og();am();AO=new Y1;AO.post("/local-session",async($)=>{if(!XO())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=sZ0($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (og(),Zv0));await Y();let{auth:X}=await Promise.resolve().then(() => (v3(),Kz8)),J=await Ij1();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await $v0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});AO.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await h8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(mZ(G))return $.json({role:G,capabilities:lO$()});if(G==="user")return $.json({role:G,capabilities:Y71({self:[...aF0]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:Y71(K)})});AO.get("/domain-lookup",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new W3(Z8().db).getAllByDomain(Q)).filter(My0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await Z8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(u9(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});AO.post("/domain-join",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=Z8().db,K=(await new W3(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!u9(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let D=F.get(B.organizationId);return D?[D]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((D)=>D.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await h8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!eE(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return h1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return h1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});AO.post("/domain-setup",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=Z8().db,K=new W3(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((A)=>A.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let A=0;A<3;A++){let P=A===0?"":`-${Math.random().toString(36).slice(2,6)}`,T=A===0?U:`${U}${P}`,q=`${N}${P}`;try{B=await h8.api.createOrganization({body:{name:T,slug:q,userId:Z.user.id}});break}catch(f){if(!(f instanceof Error&&("body"in f)&&f.body?.code==="ORGANIZATION_ALREADY_EXISTS")||A===2)throw f}}if(!B?.id)throw Error("Failed to create organization");let D=B.id;if(G)await K.add(D,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let O=!1,j=null,w=null;try{let z=P0().firecrawlApiKey;if(z){let A=await NO0(Q,z,U);if(A){let P=new g00(Z8().db),T=await P.create(D,A);if(await P.setDefault(T.id,D),O=!0,A.name&&A.name!==U)j=A.name;w=A.favicon??A.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let E={};if(!X&&j)E.name=j;if(J)E.logo=J;else if(w)E.logo=w;if(Object.keys(E).length>0)try{await h8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:E}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return h1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),h1.groupIdentify({groupType:"organization",groupKey:D,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:O,created_at:new Date().toISOString()}}),h1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:B.slug??N,email_domain:Q,brand_extracted:O}}),$.json({success:!0,slug:B.slug??N,brandExtracted:O})}catch(W){return h1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});AO.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await h8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await h8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!BF.has(W)){let K=await new W3(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new pm(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});AO.post("/domain-request-join",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=Z8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new W3(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new pm(J).create(G.id,Z.user.id),await HF5(J,G,Z.user.email),h1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return h1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});AO.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await h8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await Vy0({db:Z8().db,authApi:h8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)h1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});w28=AO});import{createHmac as FF5}from"crypto";function E28($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function z28($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function UF5($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function NF5($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return z28($.key)}async function P28($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await h8.api.getMcpSession({headers:Z}).catch(()=>null),Y=z28(Q);if(Y)return Y;let X=await h8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return NF5(X)}function BF5($,Z){let Q=FF5("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var LM1,T28;var A28=L(()=>{F8();v3();LM1=new Y1;LM1.get("/me",async($)=>{let Z=E28($.req.raw.headers),Q;if(Z)Q=await P28(Z);else{let Y=await h8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=UF5(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});LM1.post("/session-from-oauth",async($)=>{let Z=E28($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await P28(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await h8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=BF5(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});T28=LM1});var Go=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function LF5($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function DM1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function OF5($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return DF5.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var DF5,Wo=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=OF5($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst().then((F)=>F??YB0(X,Q));if(!G){if(Go($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=DM1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(u9(G)){if(Go($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(F)H=F.role;else if(await cO1(X,K))ZO({action:"org_scope_admit",actorUserId:K,targetOrgId:G.id,method:$.req.method,route:$.req.path}),H="owner";else if(!LF5($)){if(Go($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),$P(Y,G),await Z()};var sy0=L(()=>{MN();Mn();DF5=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","task-board","resolve"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"],["internal","repositories","resolve"],["internal","repositories","*","tree"],["internal","repositories","*","file"],["internal","repositories","*","search"],["internal","repositories","*","change-requests"],["internal","repositories","*","commits"]]});function jF5($){if(dQ($.id)!==null)return!0;if(FU$($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function wF5($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function EF5($){let Z=$.auth?.apiKey?.id?DM1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return ey0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return ey0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return ey0;return Y}var R28="/api/_me",ey0,zF5=256,PF5=20,TF5=50,AF5=10,RF5=5,q28=()=>{let $=new Y1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=t0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=EF5(Q);if(X===ey0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>zF5)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,TF5):PF5,K=wF5(Q,Y),H=W+AF5,F=[];for(let U=0;U<RF5&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((D)=>!jF5(D)).filter((D)=>!u9({metadata:D.organization_metadata})).map((D)=>({id:D.id,title:D.title,icon:D.icon,orgId:D.organization_id,orgName:D.organization_name,orgSlug:D.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var M28=L(()=>{F8();r8();sy0();ey0=Symbol("deny")});var I28="Payload Too Large",V28,m5=($)=>{let Z=$.onError||(()=>{let Y=new Response(I28,{status:413});throw new V1(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:D}=await H.read();if(B)break;if(K+=D.length,K>Q){N.error(new V28(I28));break}N.enqueue(D)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof V28)X.res=await Z(X)}};var dK=L(()=>{dJ();V28=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as qF5}from"crypto";function eZ0($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function C28($){if(eZ0($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(eZ0($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(eZ0($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(eZ0($,[82,73,70,70])&&eZ0($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function jM1($){return OU($)}function VF5($,Z){let Q=qF5("sha256").update($).digest("hex");return`${$g0}/${Q}.${Z}`}function Qg0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${Zg0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Ko($){let Z=yQ(),Q=Z?kX(Z,OM1):new _W(OM1,$.baseUrl);return new vW(Q,$.storage.orgFsEntries,OM1,MF5)}async function $70($,Z){return(await $.listDir(Z,$g0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function S28($,Z){return(await $70($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function kF5($,Z){if((await $.stat(Z,$g0))?.readPublic)await $.setReadPublic(Z,$g0,!1,{actor:Z})}async function wM1($,Z,Q){let Y=await $70($,Z);if(!Y.some((X)=>X.path===Q))throw new xX(`No such avatar: ${Q}`);await kF5($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function CF5($,Z,Q){try{let X=(await $70($,Z)).filter((J)=>J.path!==Q).slice(IF5-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function _28($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=VF5(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await wM1($,Q,G),await CF5($,Q,G),G}async function v28($,Z,Q){if(!(await $70($,Z)).some((X)=>X.path===Q))throw new xX(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function x28($,Z){try{let Q=await $70($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var OM1="org_user_fs",Zg0="/api/_users",$g0="avatars",MF5,k28=2097152,IF5=5;var EM1=L(()=>{kc();LL();qL();TT();MF5={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function Z70($,Z,Q,Y){let X=QQ(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var zM1=L(()=>{FH()});function Yg0($,Z){if(Z instanceof xX)return $.json({error:Z.message},404);if(Z instanceof Y3)return $.json({error:Z.message},400);if(Z instanceof AT)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function Xg0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!jM1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var f28=()=>{let $=new Y1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!jM1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Ko(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return Z70(Z,await J.read(Q,Y),Y,W)}catch(K){return Yg0(Z,K)}}),$.post("/avatar",m5({maxSize:k28,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=C28(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await _28(Ko(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:Qg0(X.baseUrl,Y,W)})}catch(W){return Yg0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await S28(Ko(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:Qg0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await wM1(Ko(Y),Q.userId,X.path),Z.json({url:Qg0(Y.baseUrl,Q.userId,X.path)})}catch(J){return Yg0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Ko(Y),J=Z.req.query("path");if(!J)return await x28(X,Q.userId),Z.json({ok:!0});try{return await v28(X,Q.userId,J),Z.json({ok:!0})}catch(G){return Yg0(Z,G)}}),$};var b28=L(()=>{F8();dK();qL();EM1();zM1()});import{z as Ho}from"zod";var SF5,_F5,vF5=200,xF5=2000,fF5=60,bF5=2000,yF5,Jg0;var PM1=L(()=>{SF5=["warn","block"],_F5=Ho.enum(SF5),yF5=Ho.string().max(bF5).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),Jg0=Ho.object({severity:_F5,title:Ho.string().trim().min(1).max(vF5),message:Ho.string().trim().min(1).max(xF5),ctaLabel:Ho.string().trim().max(fF5).nullable().optional(),ctaUrl:yF5.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as TM1}from"zod";function AM1($){let Z=$??{},Q=new Set([...Object.keys(IR.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=CZ(Z,X);return{flags:Z,effective:Y}}var gF5,y28;var g28=L(()=>{JZ();gF5=TM1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),y28=TM1.record(gF5,TM1.boolean())});function h28($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
+              AND organization_id = ${Z})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Rn.parse(F.data),createdAt:ZH5(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($,Z,Q){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).where("user_id","=",Z).where("organization_id","=",Q).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:a8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await qn({...$,db:this.db})}async notifyMentions($){await GP8({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var eK5=20,$H5=50,ZH5=($)=>$ instanceof Date?$.toISOString():$;var KP8=L(()=>{SY();M_0();I_0();WP8()});class hq1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class uq1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function QH5($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function YH5($){return typeof $.id==="string"&&!!$.architecture&&Array.isArray($.architecture.input_modalities)&&Array.isArray($.architecture.output_modalities)&&!!$.top_provider&&!!$.pricing}function XH5($){return{providerId:"openrouter",modelId:QH5($.id),title:$.name,description:$.description||null,logo:null,capabilities:ud($.architecture.input_modalities,$.architecture.output_modalities,$.supported_parameters,$.supported_parameters?.includes("reasoning")?["reasoning"]:[]),limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:Number($.pricing.prompt)||0,output:Number($.pricing.completion)||0}}}function FP8($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function JH5($){if($){let Z=await $.get(HP8,"openrouter");if(Z)return FP8(Z)}try{let Z=await dU("OpenRouter enrichment index","https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)await uY("OpenRouter enrichment index",Z);let{data:Q}=await Z.json(),Y=Q.filter(YH5).map(XH5);if($)await $.set(HP8,"openrouter",Y);return FP8(Y)}catch{return new Map}}function GH5($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function WH5($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function NP8($,Z){if(WH5(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function KH5($,Z){return $.map((Q)=>{let X=GH5(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=NP8(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class lq1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=d9()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listDecisionModels($,Z){let Q=await this.activate($,Z);if(!Q.decisions?.listModels)throw Error("Provider does not support decision model discovery");let Y=`${Q.info.id}:decisions`,X=await this.cache?.get(Z,Y);if(X)return X;let J=new Set,G=(await Q.decisions.listModels()).filter((W)=>{if(W.deprecated||!W.capabilities.includes("decisions")||J.has(W.modelId))return!1;return J.add(W.modelId),!0}).map((W)=>({...W,providerId:Q.info.id}));return await this.cache?.set(Z,Y,G),G}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=d9()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return UP8(U,J.create(Y))}let G=J.create(Y),W=await G.listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"&&X!=="deco"){let U=await JH5(this.cache);H=KH5(H,U)}else H=H.map((U)=>({...U,capabilities:NP8(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return UP8(F,G)}}function UP8($,Z){let Q=Z.asyncResearch;if(!Q)return $;return $.map((Y)=>Q.canHandle(Y.modelId)?{...Y,asyncResearch:!0}:Y)}var HP8="_global";var BP8=L(()=>{WK();CA()});import{SpanStatusCode as LP8}from"@opentelemetry/api";function FH5($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=HH5)break;if(typeof X==="string"&&Y.length<=DP8&&X.length<=DP8)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function UH5($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function NH5($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function dq1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return Tq1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(mZ(B))return!0;if(X&&!N)return Tq1(X,F);let D=mE8(U?.role,F,dE8());if(D!=="fallback")return D==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let O=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...O}}))?.success===!0)return!0;let w=cO$(F);return(await H({headers:Q,body:{permission:w,...O}}))?.success===!0}catch(j){let w=j?.statusCode;if(w!==401&&w!==403)console.error("[Auth] Permission check failed:",j instanceof Error?j.message:String(j));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!u9(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function zR($,Z,Q){if(rm.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function LH5($,Z,Q){sm($,Z,Q)}function DH5($,Z,Q){em($,Z,Q)}async function jP8($,Z,Q,Y){let X=cq1.get(Q);if(X&&Date.now()-X.at<OP8)return X.value;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=u9(J);return LH5(cq1,Q,G),DH5(cq1,BH5,OP8),G}async function mq1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function OH5($,Z){if(!$)return!0;return Z===$}async function jH5($,Z,Q,Y,X){let J=ZU0($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>Y51(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!OH5(Y,W))return;let K=Y?await mq1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function wH5($,Z,Q,Y=EP8,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=NH5($),N=await Y.measure("auth_query_membership",()=>{let j=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return j.where("organization.slug","=",U).executeTakeFirst();if(H)return j.where("organization.id","=",H).executeTakeFirst();if(F)return j.where("organization.slug","=",F).executeTakeFirst();return j.orderBy("member.createdAt","asc").limit(2).execute().then((w)=>w.length===1?w[0]:void 0)});if(u9({metadata:N?.orgMetadata}))throw Error(sF0);let B=N?.role,D=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let O;if(N&&B)O=await Y.measure("auth_fetch_role_permissions",()=>zR(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:O,organization:D}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>Y51(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await mq1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await jP8(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let D=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(u9(D))return{user:void 0};F=D?{id:D.id,slug:D.slug,name:D.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await jP8(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await mq1(Q,Y,U,K.id,X);let N=await jH5($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(u9({metadata:N?.orgMetadata}))throw Error(sF0);if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N&&!u9(N))K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((D)=>D.userId===W.user.id)?.role;else if(!N)K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;if(W.message===sF0)throw G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function zP8($){let Z=new fX($.encryption.key),Q=P0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(HH()),H=W(BL()),F=(P)=>`read_ndjson('${K}/${P}/**/*.ndjson', auto_detect=true)`,U=(P)=>`read_ndjson('${H}/${P}/**/*.ndjson', auto_detect=true)`,N,B,D,O,j=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,D=F,O=U;else if(X){let P=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new f00(Y,P),B=new f00(Y,P),D=(T)=>"studio_monitoring_logs",O=(T)=>"studio_monitoring_logs"}else if(J){let P=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,T=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,q=Q.duckdbExtensionDirectory;if(!P||!T||!q)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let f={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:P,secretAccessKey:T,extensionDirectory:q},S=new x00(f,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=S,B=S;let V=Q.monitoringS3Bucket,u=Q.monitoringS3Prefix??"",g=(l,h)=>RO$({bucket:V,prefix:u,range:h});D=g,O=g,j=!0}else{let{engine:P}=await hZ1({basePath:HH()}),{engine:T}=await hZ1({basePath:BL()});N=P,B=T,D=F,O=U}let w=new nc($.db),E=new pZ0($.db),z=new h00($.db),A={connections:new Pe($.db,Z),connectionCredentialVault:new $91($.db),organizationSettings:new XA($.db),userModelPreferences:new lZ1($.db),monitoring:new W91(N,D,B,O,G,j),virtualMcps:new MU($.db),users:new Z71($.db),tags:new u00($.db),projectSidebar:new sZ1($.db),experiments:new eZ1($.db),organizationBilling:new K3($.db),aiProviderKeys:new o10($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new Vq1($.db,Z),secrets:new nB1($.db,Z),orgFileConfigs:new kq1($.db,Z),orgSites:new PO($.db),orgRepoSyncs:new uR($.db),gitProviderAccounts:new CR($.db),gitProviderAccountCredentials:new R40($.db,Z),gitProviderOAuthStates:new xq1($.db),githubConnectFlows:new _q1($.db),repositories:new q40($.db),jiraIntegrations:new TO($.db,Z),taskBoard:new p3($.db),columnAutomations:new fq1($.db),taskBoardPrompts:new bq1($.db),taskBoardAnalytics:new OE1($.db),threadAnalytics:new zE1($.db),notifications:new gq1($.db),orgFsEntries:new $e($.db),oauthPkceStates:new hq1($.db),claudeSubscriptions:new uq1($.db,Z),automations:iF0($.db),triggerCallbackTokens:new y00($.db),orgSsoConfig:new tZ1($.db,Z),orgSsoSessions:new oZ1($.db),brandContext:new g00($.db),organizationDomains:new W3($.db),organizationJoinRequests:new pm($.db),kv:z,interests:new nZ1(z)};return async(P,T)=>{let q=T?.timings??EP8,f=vy0(),S=P?await $.observability.tracer.startActiveSpan("studio.auth",async(a)=>{try{let s=await wH5(P,$.auth,$.db,q,$.memberRoleCache);return a.setStatus({code:LP8.OK}),s}catch(s){throw a.setStatus({code:LP8.ERROR,message:s.message}),a.recordException(s),s}finally{a.end()}}):{user:void 0},V=UH5(P,S.user),u=dq1({auth:$.auth,headers:P?.headers??new Headers,role:S.role,permissions:S.permissions,userId:S.user?.id,apiKeyId:S.apiKeyId,organizationId:S.organization?.id}),g={user:S.user,tokenOrganizationId:S.tokenOrganizationId,permissions:S.permissions,permissionsOrganizationId:S.permissions?S.organization?.id:void 0};if(S.apiKey)g.apiKey=S.apiKey;let l=S.organization,h=P?P0().baseUrl??`${new URL(P.url).origin}`:g9(),i=new GA(g.user?.id,void 0,u,S.role,"self",void 0,l?.id),H0={...A,virtualMcps:lU$(A.virtualMcps),threads:new a51(w,l?.id),asyncResearchJobs:new Mq1(E,l?.id)},R0=new lq1(H0.aiProviderKeys,$.modelListCache),X0=yQ(),N0=!l?null:X0?kX(X0,l.id):new _W(l.id,h),n=l&&N0?new vW(N0,H0.orgFsEntries,l.id):null;is0(H0,{objectStorage:N0,baseUrl:h,orgSlug:l?.slug});let t={timings:q,auth:g,connectionId:V,organization:l,storage:H0,vault:Z,authInstance:$.auth,boundAuth:u,access:i,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:h,objectStorage:N0,orgFs:n,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(EH5.map((a)=>[a,P?.headers.get(a)??null]).filter(([,a])=>a!==null)),userAgent:(P?ZU0(P.headers,"client"):null)||P?.headers.get("User-Agent")||void 0,ipAddress:(P?.headers.get("CF-Connecting-IP")||P?.headers.get("X-Forwarded-For"))??void 0,properties:FH5(P?ZU0(P.headers,"properties"):null)},aiProviders:R0,createMCPProxy:async(a)=>{return await az8(a,t)},invalidateMemberRole:$.memberRoleCache?(a,s)=>$.memberRoleCache.invalidate(a,s):void 0,getOrCreateClient:f,pendingRevalidations:[],firecrawlApiKey:P0().firecrawlApiKey};return t}}function $P($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=yQ();$.objectStorage=Q?kX(Q,Z.id):new _W(Z.id,$.baseUrl),$.orgFs=new vW($.objectStorage,$.storage.orgFsEntries,Z.id),is0($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var HH5=50,DP8=500,OP8=60000,BH5=1e4,cq1,wP8,GY,EP8,EH5;var MN=L(()=>{IH();$w();Y$();A9();r51();nH0();tH0();nU$();qO$();qW();uZ1();cZ1();mZ1();iZ1();aZ1();gO$();hO$();c00();fH();J71();sE1();fY();rR1();ze();Iq1();wq1();oX1();g60();sz8();Cq1();zO0();Jp();vq1();oZ0();jE1();PE1();$O();KP8();a61();qL();BP8();LL();kc();kW0();cq1=new Map;GY={set:($)=>{wP8=$},create:async($,Z)=>{return await wP8($,Z)}},EP8={measure:async($,Z)=>{return await Z()}},EH5=["x-hub-signature-256"]});import{DBOS as ly0,SchedulerMode as zH5}from"@dbos-inc/dbos-sdk";function PP8($){pq1=$}function TP8(){if(!pq1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return pq1}async function TH5($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await GY.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},$P(Y,{id:Q.id,slug:Q.slug}),Y}async function AH5($){try{let{db:Z}=TP8(),Q=await TH5(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await nO0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function RH5($,Z){let Q=await ly0.runStep(()=>new uR(TP8().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await ly0.runStep(()=>AH5(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function AP8(){if(iq1)return;iq1=ly0.registerWorkflow(RH5,{name:"orgRepoSyncWorkflow"}),ly0.registerScheduled(iq1,{name:"orgRepoSyncWorkflow",crontab:PH5,mode:zH5.ExactlyOncePerIntervalWhenActive})}var PH5="7-59/10 * * * *",pq1=null,iq1=null;var RP8=L(()=>{MN();tO0()});import{DBOS as cy0,SchedulerMode as qH5}from"@dbos-inc/dbos-sdk";function qP8($){tq1=$}function MP8(){if(!tq1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return tq1}async function kH5($,Z){try{let Q=await IF(MP8().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await v58(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function CH5($,Z){let Q=new Date($.getTime()-IH5),Y=await cy0.runStep(()=>new p3(MP8().db).listItemsAwaitingArchive(Q,VH5),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(S_0(Y).map(({organizationId:G,itemIds:W})=>cy0.runStep(()=>kH5(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function IP8(){if(nq1)return;nq1=cy0.registerWorkflow(CH5,{name:"taskBoardArchiveSweepWorkflow"}),cy0.registerScheduled(nq1,{name:"taskBoardArchiveSweepWorkflow",crontab:MH5,mode:qH5.ExactlyOncePerIntervalWhenActive})}var MH5="23 * * * *",IH5=432000000,VH5=200,tq1=null,nq1=null;var VP8=L(()=>{$O();kn();In()});import{createHmac as SH5,timingSafeEqual as _H5}from"crypto";function CP8($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>vH5)return!1;let W=SH5("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&_H5(K,F)})}function SP8($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=o7(Z),Y=o7(o7(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:mK(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function dy0($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function mK($){return typeof $==="string"?$:void 0}function o7($){return typeof $==="object"&&$!==null?$:void 0}function iy0($){return typeof $==="number"?new Date($*1000):null}function my0($){return mK($)??mK(o7($)?.id)}function xH5($){return my0($.subscription)??mK(o7(o7($.parent)?.subscription_details)?.subscription)}function fH5($){let Z=o7($.lines)?.data;if(Array.isArray(Z)){let Q=null;for(let Y of Z){let X=o7(o7(Y)?.period)?.end;if(typeof X==="number"&&(Q===null||X>Q))Q=X}if(Q!==null)return new Date(Q*1000)}return iy0($.period_end)}function bH5($,Z){let Q=o7($.items)?.data;if(!Array.isArray(Q))return;for(let Y of Q){let X=o7(Y)?.amount;if(typeof X==="number"&&X<=0)continue;let J=my0(o7(Y)?.price);if(J&&Z[J])return Z[J]}return}function rq1($,Z,Q){if($==="past_due")return;if($!=="active")return"free";return}function yH5($){let Z=iy0($.current_period_end);if(Z)return Z;let Q=o7($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=o7(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function oq1($,Z){let Q=iy0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function aq1($,Z){let Q=iy0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function gH5($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=mK(o7(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if(mK(o7(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(mK(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let H=mK(Q.id);if(!H)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let F=Number(o7(Q.metadata)?.creditCents);if(!Number.isInteger(F)||F<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:o7(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:F,referenceId:`stripe-topup:${H}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(mK(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.ensureBilling(Y);if(!X)return console.error("stripe webhook: PAID checkout for an org that does not exist",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"unknown org"};let J=my0(Q.subscription);if(!J)return console.error("stripe webhook: subscription checkout without a sub id",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"subscription checkout without sub id"};if(oq1(Z,X))return{handled:!1,reason:"stale event"};if(X.stripeSubscriptionId&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let G=my0(Q.customer);if(!await $.bindSubscription(Y,{stripeSubscriptionId:J,...G?{stripeCustomerId:G}:{},status:"active",lastStripeEventAt:aq1(Z,X)}))return console.error("stripe webhook: lost the bind race",{organizationId:Y,subscriptionId:J,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let K=mK(o7(Q.metadata)?.planId);return{handled:!0,organizationId:Y,...K?{planChange:{planId:K,note:`stripe checkout ${mK(Q.id)??""}`.trim()}}:{}}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=mK(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&oq1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":dy0(Q.status);await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:yH5(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:aq1(Z,X)});let W=rq1(G,Q,P0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...W?{planChange:{planId:W,note:`stripe ${Z.type} (${G})`}}:{}}}case"invoice.paid":{let Y=xH5(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(oq1(Z,X))return{handled:!1,reason:"stale event"};await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:fH5(Q),lastStripeEventAt:aq1(Z,X)});let J=bH5({items:Q.lines},P0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...J?{planChange:{planId:J,note:"stripe invoice.paid"}}:{}}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function hH5($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:dy0(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function kP8($,Z){let Q=hH5($,Z);if(!Q)return;gY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:lR$(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function _P8($){let Z=new K3(Z8().db),Q=await gH5(Z,$);if(!(Q.handled&&Q.topUp))kP8($,Q);if(Q.handled&&Q.topUp)await HJ8({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),kP8($,Q);if(Q.handled&&Q.planChange){try{await jx0({organizationId:Q.organizationId,planId:Q.planChange.planId,note:Q.planChange.note})}catch(Y){if(!(Y instanceof Gt))throw Y;return console.error("stripe webhook: gateway REFUSED the plan change \u2014 the org has been "+"charged (or cancelled) and its entitlement did NOT move. Place it by hand through the gateway admin API.",{organizationId:Q.organizationId,planId:Q.planChange.planId,eventId:$.id,status:Y.status,error:Y.message}),Q}Kt(Q.organizationId)}if(!Q.handled&&Q.orphanSubscriptionId){let Y=Q.orphanSubscriptionId;try{await Eh$(Y)}catch(J){if(!(J instanceof sZ&&(J.status===400||J.status===404)))throw J}let{refundedCents:X}=await zh$(Y);console.error("stripe webhook: reversed orphan subscription",{subscriptionId:Y,refundedCents:X,eventId:$.id})}return Q}var vH5=300;var sq1=L(()=>{_90();bQ();F6();c00();RD();wx0();Y$()});import{DBOS as py0,SchedulerMode as uH5}from"@dbos-inc/dbos-sdk";function vP8($){$M1=$}function xP8(){if(!$M1)throw Error("[subscription-sweep] runtime not initialized \u2014 setSubscriptionSweepRuntime() must run before the workflow fires");return $M1}async function dH5($){let{organizationId:Z,stripeSubscriptionId:Q}=$;if(!Q)return{organizationId:Z,action:"ok"};let Y=new K3(xP8().db);try{let X,J,G=!1;try{let K=await $z(Q);X=dy0(K.status),J=iH5(K)}catch(K){if(!(K instanceof sZ)||K.status!==404)throw K;X="canceled",J=$.currentPeriodEnd,G=!0}let W=rq1(X,{},P0().stripePlanPriceIds);if(await Y.updateStripeState(Z,{status:X,currentPeriodEnd:J,...G&&{stripeSubscriptionId:null}}),!W)return{organizationId:Z,action:"ok"};return await jx0({organizationId:Z,planId:W,note:`studio subscription sweep (${X})`}),Kt(Z),console.warn("[subscription-sweep] revoked a paid tier whose webhook never arrived",{organizationId:Z,subscriptionId:Q,status:X}),{organizationId:Z,action:G?"gone":"revoked"}}catch(X){if(X instanceof Gt)console.error("[subscription-sweep] gateway REFUSED the revocation \u2014 the org still holds a tier it no longer pays for",{organizationId:Z,subscriptionId:Q,status:X.status});return{organizationId:Z,action:"failed",error:X instanceof Error?X.message:String(X)}}}function iH5($){if(typeof $.current_period_end==="number")return new Date($.current_period_end*1000);let Z=0;for(let Q of $.items?.data??[])if(typeof Q.current_period_end==="number")Z=Math.max(Z,Q.current_period_end);return Z>0?new Date(Z*1000):null}async function pH5($,Z){let Q=P0();if(!Q.plansEnabled||!Q.stripeSecretKey)return;let Y=new Date($.getTime()-cH5),X=await py0.runStep(()=>new K3(xP8().db).listSubscriptionsPastPeriodEnd(Y,mH5),{name:"loadLapsedSubscriptions"});if(X.length===0)return;let J=await Promise.all(X.map((W)=>py0.runStep(()=>dH5(W),{name:`sweepSubscription:${W.organizationId}`})));for(let W of J)if(W.action==="failed")console.warn(`[subscription-sweep] org ${W.organizationId} failed: ${W.error}`);let G=J.filter((W)=>W.action==="revoked"||W.action==="gone").length;if(G>0)console.warn(`[subscription-sweep] revoked ${G} of ${X.length} lapsed subscriptions`)}function fP8(){if(eq1)return;eq1=py0.registerWorkflow(pH5,{name:"subscriptionSweepWorkflow"}),py0.registerScheduled(eq1,{name:"subscriptionSweepWorkflow",crontab:lH5,mode:uH5.ExactlyOncePerIntervalWhenActive})}var lH5="41 * * * *",cH5=172800000,mH5=100,$M1=null,eq1=null;var bP8=L(()=>{_90();c00();RD();wx0();sq1();Y$()});async function nH5($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===ny0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,ny0,jO0(Q.length))).id}async function tH5($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!y58(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!dg(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await W5($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),P8(Z,K),!0}async function yP8($,Z,Q,Y=__0){let X=null,J=()=>X??=nH5($,Z),G=0;for(let W of Q)try{if(await tH5($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var ny0="merged";var gP8=L(()=>{u4();HX();kn();VF();m7();_9()});import{DBOS as ty0,SchedulerMode as oH5}from"@dbos-inc/dbos-sdk";function hP8($){QM1=$}function uP8(){if(!QM1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return QM1}async function sH5($,Z){try{let Q=await IF(uP8().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await yP8(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function eH5(){let $=await ty0.runStep(()=>new p3(uP8().db).listItemsAwaitingMergedTag(ny0,rH5),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(S_0($).map(({organizationId:Y,itemIds:X})=>ty0.runStep(()=>sH5(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function lP8(){if(ZM1)return;ZM1=ty0.registerWorkflow(eH5,{name:"taskBoardMergedTagSweepWorkflow"}),ty0.registerScheduled(ZM1,{name:"taskBoardMergedTagSweepWorkflow",crontab:aH5,mode:oH5.ExactlyOncePerIntervalWhenActive})}var aH5="41 * * * *",rH5=200,QM1=null,ZM1=null;var cP8=L(()=>{$O();kn();In();gP8()});function mP8($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"}catch{return!1}}var iP8,$F5,dP8=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},YM1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=dP8(X.substring(0,J));if(Z&&Z!==G||!iP8.test(G))continue;let W=dP8(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if($F5.test(W)){if(Y[G]=W.indexOf("%")!==-1?kd(W,M10):W,Z)break}}return Y},ZF5=($,Z,Q={})=>{if(!iP8.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},oy0=($,Z,Q)=>{return Z=encodeURIComponent(Z),ZF5($,Z,Q)};var pP8=L(()=>{sw();iP8=/^[\w!#$%&'*.^`|~+-]+$/,$F5=/^[ !#-:<-[\]-~]*$/});var Jo=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return YM1(Y,J)[J]}if(!Y)return{};return YM1(Y)},QF5=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=oy0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=oy0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=oy0($,Z,{path:"/",...Q});return Y},aZ0=($,Z,Q,Y)=>{let X=QF5(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var ay0=L(()=>{pP8()});var nP8=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var tP8=()=>{};function XM1($,Z){return`${$}:${Z}`}function oP8($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=XM1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=XM1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(XM1(J,G))}}}class JM1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=aP8.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of aP8)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var aP8;var rP8=L(()=>{aP8=["studio.sse.broadcast","mesh.sse.broadcast"]});async function YF5($,Z,Q=5){try{await O8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof k5?Y.cause:Y)}}function sP8($){let Z=new JM1({getConnection:()=>$.getConnection()});u5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{YF5("[NatsSSEBroadcast]",()=>Z.start())})}var GM1=L(()=>{$8();rP8();Tn();Tn()});var eP8=()=>{};var WM1=()=>{};var $28=()=>{};var XF5,Fd7;var Z28=L(()=>{eP8();WM1();sw();$28();XF5={br:".br",zstd:".zst",gzip:".gz"},Fd7=Object.keys(XF5)});var Q28=L(()=>{Z28()});var Y28=()=>{};var X28=L(()=>{Y28()});var J28=()=>{};var G28=L(()=>{fY1()});var KM1=L(()=>{ew();G28()});var HM1="x-hono-disable-ssg",kd7;var FM1=L(()=>{KM1();kd7=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[HM1]:"true"}})}catch{return null}})()});var W28=L(()=>{SN0()});var UM1=L(()=>{W28()});var K28=L(()=>{X28();J28();WM1();FM1();UM1();KM1()});var H28=L(()=>{FM1();UM1();K28()});var Ui7;var F28=L(()=>{H28();({write:Ui7}=Bun)});var WF5=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},U28=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var N28=()=>{};var rZ0=($)=>("server"in $.env)?$.env.server:$.env;var ry0=()=>{};var KF5;var B28=L(()=>{N28();ry0();KF5=U28(($,Z)=>{let Q=rZ0($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var sZ0=($)=>{let Z=rZ0($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var L28=L(()=>{ry0()});var NM1=L(()=>{Q28();F28();B28();L28();ry0()});var D28;var O28=L(()=>{D28={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function j28(){let $=Object.keys(v4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:D28[X].icon})),Y=P0().localMode;return{emailAndPassword:{enabled:v4.emailAndPassword?.enabled??!1},magicLink:{enabled:v4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:v4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:Cy0},socialProviders:{enabled:Z,providers:Q},sso:v4.ssoConfig?{enabled:!0,providerId:v4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:XO()}}async function HF5($,Z,Q){try{if(!v4.inviteEmailProviderId||!v4.emailProviders||v4.emailProviders.length===0)return;let Y=F3(v4.emailProviders,v4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=m00,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=H3(Y),K=`${g9()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:U3({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:MA("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var AO,w28;var BM1=L(()=>{F8();NM1();F6();Y$();v3();bQ();Qq1();FH1();Iy0();qA();fY();A9();iZ1();O28();og();am();AO=new Y1;AO.post("/local-session",async($)=>{if(!XO())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=sZ0($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (og(),Zv0));await Y();let{auth:X}=await Promise.resolve().then(() => (v3(),Kz8)),J=await Ij1();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await $v0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});AO.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await h8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(mZ(G))return $.json({role:G,capabilities:lO$()});if(G==="user")return $.json({role:G,capabilities:Y71({self:[...aF0]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:Y71(K)})});AO.get("/domain-lookup",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new W3(Z8().db).getAllByDomain(Q)).filter(My0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await Z8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(u9(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});AO.post("/domain-join",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=Z8().db,K=(await new W3(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!u9(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let D=F.get(B.organizationId);return D?[D]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((D)=>D.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await h8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!eE(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return h1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return h1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});AO.post("/domain-setup",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=Z8().db,K=new W3(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((A)=>A.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let A=0;A<3;A++){let P=A===0?"":`-${Math.random().toString(36).slice(2,6)}`,T=A===0?U:`${U}${P}`,q=`${N}${P}`;try{B=await h8.api.createOrganization({body:{name:T,slug:q,userId:Z.user.id}});break}catch(f){if(!(f instanceof Error&&("body"in f)&&f.body?.code==="ORGANIZATION_ALREADY_EXISTS")||A===2)throw f}}if(!B?.id)throw Error("Failed to create organization");let D=B.id;if(G)await K.add(D,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let O=!1,j=null,w=null;try{let z=P0().firecrawlApiKey;if(z){let A=await NO0(Q,z,U);if(A){let P=new g00(Z8().db),T=await P.create(D,A);if(await P.setDefault(T.id,D),O=!0,A.name&&A.name!==U)j=A.name;w=A.favicon??A.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let E={};if(!X&&j)E.name=j;if(J)E.logo=J;else if(w)E.logo=w;if(Object.keys(E).length>0)try{await h8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:E}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return h1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),h1.groupIdentify({groupType:"organization",groupKey:D,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:O,created_at:new Date().toISOString()}}),h1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:B.slug??N,email_domain:Q,brand_extracted:O}}),$.json({success:!0,slug:B.slug??N,brandExtracted:O})}catch(W){return h1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});AO.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await h8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=Z8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await h8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!BF.has(W)){let K=await new W3(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new pm(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});AO.post("/domain-request-join",async($)=>{let Z=await h8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||BF.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=Z8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new W3(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new pm(J).create(G.id,Z.user.id),await HF5(J,G,Z.user.email),h1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return h1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});AO.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await h8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await Vy0({db:Z8().db,authApi:h8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)h1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});w28=AO});import{createHmac as FF5}from"crypto";function E28($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function z28($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function UF5($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function NF5($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return z28($.key)}async function P28($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await h8.api.getMcpSession({headers:Z}).catch(()=>null),Y=z28(Q);if(Y)return Y;let X=await h8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return NF5(X)}function BF5($,Z){let Q=FF5("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var LM1,T28;var A28=L(()=>{F8();v3();LM1=new Y1;LM1.get("/me",async($)=>{let Z=E28($.req.raw.headers),Q;if(Z)Q=await P28(Z);else{let Y=await h8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=UF5(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});LM1.post("/session-from-oauth",async($)=>{let Z=E28($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await P28(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await h8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=BF5(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});T28=LM1});var Go=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function LF5($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function DM1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function OF5($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return DF5.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var DF5,Wo=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=OF5($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst().then((F)=>F??YB0(X,Q));if(!G){if(Go($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=DM1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(u9(G)){if(Go($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(F)H=F.role;else if(await cO1(X,K))ZO({action:"org_scope_admit",actorUserId:K,targetOrgId:G.id,method:$.req.method,route:$.req.path}),H="owner";else if(!LF5($)){if(Go($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),$P(Y,G),await Z()};var sy0=L(()=>{MN();Mn();DF5=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","task-board","resolve"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"],["internal","repositories","resolve"],["internal","repositories","*","tree"],["internal","repositories","*","file"],["internal","repositories","*","search"],["internal","repositories","*","change-requests"],["internal","repositories","*","commits"]]});function jF5($){if(dQ($.id)!==null)return!0;if(FU$($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function wF5($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function EF5($){let Z=$.auth?.apiKey?.id?DM1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return ey0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return ey0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return ey0;return Y}var R28="/api/_me",ey0,zF5=256,PF5=20,TF5=50,AF5=10,RF5=5,q28=()=>{let $=new Y1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=t0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=EF5(Q);if(X===ey0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>zF5)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,TF5):PF5,K=wF5(Q,Y),H=W+AF5,F=[];for(let U=0;U<RF5&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((D)=>!jF5(D)).filter((D)=>!u9({metadata:D.organization_metadata})).map((D)=>({id:D.id,title:D.title,icon:D.icon,orgId:D.organization_id,orgName:D.organization_name,orgSlug:D.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var M28=L(()=>{F8();r8();sy0();ey0=Symbol("deny")});var I28="Payload Too Large",V28,m5=($)=>{let Z=$.onError||(()=>{let Y=new Response(I28,{status:413});throw new V1(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:D}=await H.read();if(B)break;if(K+=D.length,K>Q){N.error(new V28(I28));break}N.enqueue(D)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof V28)X.res=await Z(X)}};var dK=L(()=>{dJ();V28=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as qF5}from"crypto";function eZ0($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function C28($){if(eZ0($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(eZ0($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(eZ0($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(eZ0($,[82,73,70,70])&&eZ0($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function jM1($){return OU($)}function VF5($,Z){let Q=qF5("sha256").update($).digest("hex");return`${$g0}/${Q}.${Z}`}function Qg0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${Zg0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Ko($){let Z=yQ(),Q=Z?kX(Z,OM1):new _W(OM1,$.baseUrl);return new vW(Q,$.storage.orgFsEntries,OM1,MF5)}async function $70($,Z){return(await $.listDir(Z,$g0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function S28($,Z){return(await $70($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function kF5($,Z){if((await $.stat(Z,$g0))?.readPublic)await $.setReadPublic(Z,$g0,!1,{actor:Z})}async function wM1($,Z,Q){let Y=await $70($,Z);if(!Y.some((X)=>X.path===Q))throw new xX(`No such avatar: ${Q}`);await kF5($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function CF5($,Z,Q){try{let X=(await $70($,Z)).filter((J)=>J.path!==Q).slice(IF5-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function _28($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=VF5(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await wM1($,Q,G),await CF5($,Q,G),G}async function v28($,Z,Q){if(!(await $70($,Z)).some((X)=>X.path===Q))throw new xX(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function x28($,Z){try{let Q=await $70($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var OM1="org_user_fs",Zg0="/api/_users",$g0="avatars",MF5,k28=2097152,IF5=5;var EM1=L(()=>{kc();LL();qL();TT();MF5={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function Z70($,Z,Q,Y){let X=QQ(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var zM1=L(()=>{FH()});function Yg0($,Z){if(Z instanceof xX)return $.json({error:Z.message},404);if(Z instanceof Y3)return $.json({error:Z.message},400);if(Z instanceof AT)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function Xg0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!jM1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var f28=()=>{let $=new Y1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!jM1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Ko(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return Z70(Z,await J.read(Q,Y),Y,W)}catch(K){return Yg0(Z,K)}}),$.post("/avatar",m5({maxSize:k28,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=C28(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await _28(Ko(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:Qg0(X.baseUrl,Y,W)})}catch(W){return Yg0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await S28(Ko(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:Qg0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await wM1(Ko(Y),Q.userId,X.path),Z.json({url:Qg0(Y.baseUrl,Q.userId,X.path)})}catch(J){return Yg0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=Xg0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Ko(Y),J=Z.req.query("path");if(!J)return await x28(X,Q.userId),Z.json({ok:!0});try{return await v28(X,Q.userId,J),Z.json({ok:!0})}catch(G){return Yg0(Z,G)}}),$};var b28=L(()=>{F8();dK();qL();EM1();zM1()});import{z as Ho}from"zod";var SF5,_F5,vF5=200,xF5=2000,fF5=60,bF5=2000,yF5,Jg0;var PM1=L(()=>{SF5=["warn","block"],_F5=Ho.enum(SF5),yF5=Ho.string().max(bF5).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),Jg0=Ho.object({severity:_F5,title:Ho.string().trim().min(1).max(vF5),message:Ho.string().trim().min(1).max(xF5),ctaLabel:Ho.string().trim().max(fF5).nullable().optional(),ctaUrl:yF5.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as TM1}from"zod";function AM1($){let Z=$??{},Q=new Set([...Object.keys(IR.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=CZ(Z,X);return{flags:Z,effective:Y}}var gF5,y28;var g28=L(()=>{JZ();gF5=TM1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),y28=TM1.record(gF5,TM1.boolean())});function h28($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
 `||X==="\r")return Y;Y+=Z.length}}function u28($,Z){let Q=h28($,hF5(Z),0);if(Q===-1)return null;let Y=$.indexOf(`
 `,Q);if(Y===-1)return null;let X=h28($,uF5(Z),Y);if(X===-1)return null;let J=$.lastIndexOf(`
 `,X);return{from:Y+1,to:J+1}}function l28($,Z){let Q=u28($,Z);return Q?$.slice(Q.from,Q.to):null}function c28($,Z,Q){let Y=u28($,Z);if(!Y)throw Error(`prompt region "${Z}" not found in source`);let X=Q.endsWith(`