decocms 4.429.15 → 4.429.16

package/dist/server/server.js

@@ -995,7 +995,7 @@ ${N$}`,...Q$[K9].promptCacheBreakpoint!=null&&{prompt_cache_breakpoint:Q$[K9].pr
   `.execute($)).rows[0]?.exists)await z6`CREATE ROLE ${z6.id(Q)} NOLOGIN`.execute($);await z6`GRANT ${z6.id(Q)} TO CURRENT_USER`.execute($),await z6`GRANT USAGE, CREATE ON SCHEMA ${z6.id(Z)} TO ${z6.id(Q)}`.execute($),await z6`GRANT ALL ON ALL TABLES IN SCHEMA ${z6.id(Z)} TO ${z6.id(Q)}`.execute($),await z6`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${z6.id(Z)} TO ${z6.id(Q)}`.execute($),await z6`ALTER DEFAULT PRIVILEGES IN SCHEMA ${z6.id(Z)} GRANT ALL ON TABLES TO ${z6.id(Q)}`.execute($),await z6`ALTER DEFAULT PRIVILEGES IN SCHEMA ${z6.id(Z)} GRANT ALL ON SEQUENCES TO ${z6.id(Q)}`.execute($),await z6`REVOKE ALL ON SCHEMA public FROM ${z6.id(Q)}`.execute($)}async function RV4($,Z,Q,Y){try{return await $.transaction().execute(async(X)=>{return await z6`SET LOCAL ROLE ${z6.id(Q)}`.execute(X),await z6`SET LOCAL search_path TO ${z6.id(Z)}`.execute(X),await z6.raw(Y).execute(X)})}catch(X){if(AV4(X))return await TV4($,Z,Q),await $.transaction().execute(async(J)=>{return await z6`SET LOCAL ROLE ${z6.id(Q)}`.execute(J),await z6`SET LOCAL search_path TO ${z6.id(Z)}`.execute(J),await z6.raw(Y).execute(J)});throw X}}var wV4,EV4,dN$;var iN$=D(()=>{k0();wV4=DU.object({results:DU.array(DU.unknown()).optional(),success:DU.boolean().optional()});EV4=DU.object({sql:DU.string().describe("The SQL query to run"),params:DU.array(DU.unknown()).describe("The parameters to pass to the SQL query").optional()});dN$=c({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:EV4,outputSchema:DU.object({result:DU.array(wV4)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=jV4($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Y=zV4(Z.connectionId),X=PV4(Z.connectionId);return{result:[{results:(await RV4(Z.db,Y,X,Q)).rows,success:!0}]}}})});function IK0($){let Z=$.access.getRole();if(!CZ(Z))throw new t7("Only organization owners and admins can change org-wide pin status")}var U$1=D(()=>{DY();fK()});async function VK0($,Z,Q){let Y=[...new Set(Q)],X=await Promise.all(Y.map((G)=>$.storage.connections.findById(G,Z))),J=Y.filter((G,W)=>!X[W]);if(J.length>0)throw Error(`Connection not found: ${J.join(", ")}`)}function eB($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function kK0($){let Z=2166136261;for(let Q=0;Q<$.length;Q++)Z=Math.imul(Z^$.charCodeAt(Q),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function SK0($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function CK0($,Z){if(!Z)return $;let Q=`${kK0(Z)}_`;return $.startsWith(Q)?$.slice(Q.length):$}function MV4($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}function IV4($,Z,Q){let Y,X=new Promise((J,G)=>{Y=setTimeout(()=>G(Error(Q)),Z)});return Promise.race([$,X]).finally(()=>clearTimeout(Y))}var FA;var pN$=D(()=>{SF();FA=class FA extends sZ{static MAX_PAGES_PER_CLIENT=1000;static DEFAULT_LIST_TIMEOUT_MS=30000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;listTimeoutMs;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$,this.listTimeoutMs=Z?.listTimeoutMs??FA.DEFAULT_LIST_TIMEOUT_MS;for(let Q of Object.keys($)){let Y=kK0(Q);if(this.slugToKey.has(Y))throw Error(`GatewayClient: duplicate namespace code "${Y}" from keys "${this.slugToKey.get(Y)}" and "${Q}"`);this.slugToKey.set(Y,Q)}}namespace($,Z){return`${kK0($)}_${Z}`}async resolveNamespacedTarget($,Z,Q){let Y=$.indexOf("_");if(Y!==-1){let X=$.slice(0,Y),J=this.slugToKey.get(X);if(J)return[J,$.slice(Y+1)]}for(let X of await Q()){let J=SK0(X._meta);if(!J)continue;if(CK0(X.name,J)===$)return[J,$]}if(Y===-1)throw Error(`GatewayClient: could not resolve ${Z} "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Y)}" in "${$}" and not found by original name in any client`)}resolveToolTarget($){return this.resolveNamespacedTarget($,"tool",async()=>(await this.listTools()).tools)}resolvePromptTarget($){return this.resolveNamespacedTarget($,"prompt",async()=>(await this.listPrompts()).prompts)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let Q=this.clients[$];if(!Q)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Y=Q.client,X;try{X=typeof Y==="function"?Promise.resolve(Y()):Promise.resolve(Y)}catch(G){return Promise.reject(G)}let J=X.catch((G)=>{throw this.resolvedClients.delete($),G});return this.resolvedClients.set($,J),J}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,Q){try{return await IV4((async()=>{let Y=await this.resolveClient($);return await Z(Y)})(),this.listTimeoutMs,`timed out after ${this.listTimeoutMs}ms`)}catch(Y){return console.warn(`GatewayClient: skipping ${Q} from client "${$}" \u2014 ${Y?.message??Y}`),[]}}listFromAllClients($,Z){return Promise.all(Object.entries(this.clients).map(async([Q,Y])=>[Q,Y,await this.listFromClient(Q,(X)=>$(X,Q),Z)]))}async paginate($,Z,Q){let Y=[],X,J=0;do{let G=await Q(X);Y.push(...G.items),X=G.nextCursor,J++}while(X&&J<FA.MAX_PAGES_PER_CLIENT);if(X)console.warn(`GatewayClient: client "${$}" exceeded ${FA.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Y}fetchAllTools($,Z){return this.paginate(Z,"tools",async(Q)=>{let Y=await $.listTools(Q?{cursor:Q}:void 0);return{items:Y.tools,nextCursor:Y.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(Q)=>{let Y=await $.listResources(Q?{cursor:Q}:void 0);return{items:Y.resources,nextCursor:Y.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(Q)=>{let Y=await $.listResourceTemplates(Q?{cursor:Q}:void 0);return{items:Y.resourceTemplates,nextCursor:Y.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(Q)=>{let Y=await $.listPrompts(Q?{cursor:Q}:void 0);return{items:Y.prompts,nextCursor:Y.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[],Z=await this.listFromAllClients((Q,Y)=>this.fetchAllTools(Q,Y),"tools");for(let[Q,Y,X]of Z){let J=Y.tools,G=J?new Set(J):null;for(let W of X){if(G&&!G.has(W.name))continue;$.push({...W,name:this.namespace(Q,W.name),_meta:{...W._meta??{},gatewayClientId:Q}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],Q=new Map,Y=await this.listFromAllClients((X,J)=>this.fetchAllResources(X,J),"resources");for(let[X,J,G]of Y){let W=J.resources,K=W?new Set(W):null;for(let H of G){if(K&&!K.has(H.uri)&&!(H.name&&K.has(H.name)))continue;if($.has(H.uri)){console.warn(`GatewayClient: duplicate resource "${H.uri}" from client "${X}" \u2014 skipping`);continue}$.add(H.uri),Q.set(H.uri,X),Z.push({...H,_meta:{...H._meta??{},gatewayClientId:X}})}}return this.resourceRouteMap=Q,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[],Q=await this.listFromAllClients((Y,X)=>this.fetchAllResourceTemplates(Y,X),"resource templates");for(let[Y,X,J]of Q)for(let G of J){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${Y}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:Y}})}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[],Z=await this.listFromAllClients((Q,Y)=>this.fetchAllPrompts(Q,Y),"prompts");for(let[Q,Y,X]of Z){let J=Y.prompts,G=J?new Set(J):null;for(let W of X){if(G&&!G.has(W.name))continue;$.push({...W,name:this.namespace(Q,W.name),title:W.title??MV4(W.name),_meta:{...W._meta??{},gatewayClientId:Q}})}}return{prompts:$}}async callTool($,Z,Q){let[Y,X]=await this.resolveToolTarget($.name);return(await this.resolveClient(Y)).callTool({...$,name:X},Z,Q)}async readResource($,Z){let Q=await this.resolveResourceRoute($.uri);return(await this.resolveClient(Q)).readResource($)}async getPrompt($,Z){let[Q,Y]=await this.resolvePromptTarget($.name);return(await this.resolveClient(Q)).getPrompt({...$,name:Y})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((Q)=>Q.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var _K0=D(()=>{pN$()});function B$1($){return eB($)}function kV4($,Z){let Q=eB(Z)||"prompt";return`${String($).padStart(VV4,"0")}-${Q}`}async function D$1($,Z,Q){try{await $.delete(vK0,B$1(Z),{actor:Q})}catch(Y){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Y})}}async function bK0($,Z,Q,Y){let X=B$1(Z);await D$1($,Z,Q),await Promise.all(Y.slice(0,N$1).map(async(J,G)=>{let W=kV4(G,J.title),K={name:W,title:J.title,description:J.description,text:J.text};try{await $.write(vK0,`${X}/${W}.json`,JSON.stringify(K),{actor:Q,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function nN$($,Z){let Q=B$1(Z),Y;try{Y=await $.listDir(vK0,Q)}catch{return[]}let X=Y.filter((G)=>G.kind==="file"&&G.path.endsWith(".json")).slice(0,N$1),J=[];for(let G of X)try{let W=await $.read(vK0,G.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")J.push(K)}catch{}return J}var vK0="agent-prompts",N$1=20,VV4;var Y00=D(()=>{_K0();VV4=String(N$1-1).length});function ec($){if(!$)return $;let Z={...$};return delete Z.sandboxMap,Z}import{z as rN$}from"zod";function SV4(){let $=tN$[Math.floor(Math.random()*tN$.length)];return`icon://${oN$[Math.floor(Math.random()*oN$.length)]}?color=${$}`}var tN$,oN$,CV4,_V4,UA;var O$1=D(()=>{k0();Xj();U$1();Y00();tN$=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],oN$=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];CV4=rN$.object({data:lQ0.describe("Data for the new virtual MCP")}),_V4=rN$.object({item:KY.describe("The created virtual MCP entity")}),UA=c({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:CV4,outputSchema:_V4,handler:async($,Z)=>{n(Z);let Q=J0(Z);await Z.access.check();let Y=p0(Z);if(!Y)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)IK0(Z);let{prompts:X,metadata:J,...G}=$.data,W=ec(J);if(G.connections.length>0)await VK0(Z,Q.id,G.connections.map((F)=>F.connection_id));let K={...G,metadata:W,icon:G.icon??SV4()},H=await Z.storage.virtualMcps.create(Q.id,Y,K);if(X?.length&&Z.orgFs&&H.id)await bK0(Z.orgFs,H.id,Y,X);return{item:H}}})});function L$1($){if(!$)return null;let Z=$.projects;return Array.isArray(Z)?Z:null}function OU($,Z){if($===null)return!0;if($.includes("*"))return!0;return $.includes(Z)}async function LU($){if($.auth.apiKey)return null;let Z=$.organization?.id;if(!Z)return null;let Q=$.access.getRole()??$.organization?.role??$.auth.user?.role;if(!Q||CZ(Q))return null;if($.auth.permissions&&$.auth.permissionsOrganizationId===Z)return L$1($.auth.permissions);let Y=await NA($.db,Z,Q);return L$1(Y)}var $m=D(()=>{DY();wU()});function Wj($){return typeof $==="string"||typeof $==="number"}function w$1($,Z){let Q=Z.split("."),Y=$;for(let X of Q){if(Y==null||typeof Y!=="object")return;Y=Y[X]}return Y}function vV4($,Z){return $.connections.some((Q)=>Q.connection_id===Z)}function xK0($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;if(K.length===0)return!0;switch(W){case"and":return K.every((H)=>xK0($,H));case"or":return K.some((H)=>xK0($,H));case"not":return!K.every((H)=>xK0($,H));default:return!0}}let{field:Q,operator:Y,value:X}=Z,J=Q.join(".");if(J==="connection_id"){if(Y!=="eq"||typeof X!=="string")return!1;return vV4($,X)}let G=w$1($,J);switch(Y){case"eq":return G===X;case"gt":return Wj(G)&&Wj(X)&&G>X;case"gte":return Wj(G)&&Wj(X)&&G>=X;case"lt":return Wj(G)&&Wj(X)&&G<X;case"lte":return Wj(G)&&Wj(X)&&G<=X;case"in":return Array.isArray(X)&&X.includes(G);case"like":if(typeof G!=="string"||typeof X!=="string")return!1;if(X.length>100)return!1;return nc(X).test(G);case"contains":if(typeof G!=="string"||typeof X!=="string")return!1;return G.toLowerCase().includes(X.toLowerCase());default:return!0}}function bV4($,Z){return[...$].sort((Q,Y)=>{for(let X of Z){let J=X.field.join("."),G=w$1(Q,J),W=w$1(Y,J),K=0;if(G==null&&W==null)continue;if(G==null)K=X.nulls==="first"?-1:1;else if(W==null)K=X.nulls==="first"?1:-1;else if(typeof G==="string"&&typeof W==="string")K=G.localeCompare(W);else if(typeof G==="number"&&typeof W==="number")K=G-W;else K=String(G).localeCompare(String(W));if(K!==0)return X.direction==="desc"?-K:K}return 0})}var xV4,fV4,BA;var j$1=D(()=>{CJ();k0();$m();Xj();xV4=FH,fV4=sB(KY),BA=c({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xV4,outputSchema:fV4,handler:async($,Z)=>{await Z.access.check();let Q=J0(Z),Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,X=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,G=Y?await Z.storage.virtualMcps.listByConnectionId(Q.id,Y):await Z.storage.virtualMcps.list(Q.id,X!==void 0?{pinnedOnly:X}:void 0);if($.where)G=G.filter((B)=>xK0(B,$.where));let W=await LU(Z);if(W!==null)G=G.filter((B)=>OU(W,B.id));if($.orderBy&&$.orderBy.length>0)G=bV4(G,$.orderBy);let K=G.length,H=$.offset??0,F=$.limit??100,U=G.slice(H,H+F),N=H+F<K;return{items:U,totalCount:K,hasMore:N}}})});import{z as E$1}from"zod";var yV4,gV4,DA;var z$1=D(()=>{k0();$m();Xj();yV4=E$1.object({id:E$1.string().describe("ID of the virtual MCP to retrieve")}),gV4=E$1.object({item:KY.nullable().describe("The retrieved virtual MCP, or null if not found")}),DA=c({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:yV4,outputSchema:gV4,handler:async($,Z)=>{n(Z);let Q=J0(Z);await Z.access.check();let Y=await Z.storage.virtualMcps.findById($.id);if(Y&&Y.organization_id!==Q.id)return{item:null};if(!Y)return{item:null};let X=await LU(Z);if(!OU(X,Y.id))return{item:null};return{item:Y}}})});function wZ($){return P$1.test($)}function OA($){let Z=(Q)=>typeof Q==="string"?Q.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}function sN$($){let Z=typeof $?.metadata?.analyticsSiteSlug==="string"?$.metadata.analyticsSiteSlug.trim().toLowerCase():"";if(Z&&wZ(Z))return Z;return OA($)}var P$1;var aG=D(()=>{P$1=/^[a-z0-9][a-z0-9-]{0,59}$/});function aN$($){let{nextTitle:Z,currentTitle:Q,currentSiteSlug:Y}=$;if(Y?.trim())return null;if(Z===void 0||Z===Q)return null;let X=Q?.trim().toLowerCase()??"";return wZ(X)?X:null}var eN$=D(()=>{aG()});import{z as A$1}from"zod";var hV4,uV4,LA;var T$1=D(()=>{k0();$m();Y00();Xj();U$1();eN$();hV4=A$1.object({id:A$1.string().describe("ID of the virtual MCP to update"),data:cQ0.describe("Partial virtual MCP data to update")}),uV4=A$1.object({item:KY.describe("The updated virtual MCP entity")}),LA=c({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:hV4,outputSchema:uV4,handler:async($,Z)=>{n(Z);let Q=J0(Z);await Z.access.check();let Y=p0(Z);if(!Y)throw Error("User ID required to update virtual MCP");let X=await Z.storage.virtualMcps.findById($.id);if(!X)throw Error(`Virtual MCP not found: ${$.id}`);if(X.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${$.id}`);let J=await LU(Z);if(!OU(J,X.id))throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,metadata:W,...K}=$.data,H=ec(W);if(H&&X.metadata)H={...X.metadata,...H};else if(H===null&&X.metadata?.sandboxMap)H={sandboxMap:X.metadata.sandboxMap};let F={...K,...W!==void 0?{metadata:H}:{}},U=aN$({nextTitle:F.title,currentTitle:X.title,currentSiteSlug:X.metadata?.siteSlug});if(U)F.metadata={...X.metadata,...F.metadata,siteSlug:U};if(F.pinned!==void 0&&F.pinned!==X.pinned)IK0(Z);if(F.connections?.length)await VK0(Z,Q.id,F.connections.map((B)=>B.connection_id));let N=await Z.storage.virtualMcps.update($.id,Y,F);if(G!==void 0&&Z.orgFs)await bK0(Z.orgFs,$.id,Y,G);return{item:N}}})});function q$1($){if(!$)return!1;let Z=X00.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function $B$($){let Z={...$};for(let Q of X00)Z[Q]="read";return Z}async function ZB$($,Z){let Q={...Z};for(;;){let Y=await $(Q);if(!Y.isError)return{result:Y,grantedPermissions:Q};let X=Y.content?.find((K)=>K.type==="text")?.text,J=X00.find((K)=>(K in Q));if(!J||!q$1(X))return{result:Y,grantedPermissions:Q};let{[J]:G,...W}=Q;Q=W}}function lV4($){if(!$||typeof $!=="object"||Array.isArray($))return fK0;let Z=$;if(Object.values(Z).some((Q)=>typeof Q!=="string"))return fK0;return Z}function cV4($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function n9($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let Q=cV4(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:Q,owner:Z.owner,repo:Z.repo,permissions:lV4(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function Kj($){return $.metadata?.orgShared===!0}function QB$($){let Z=new Set,Q=[];for(let Y of $??[]){if(Y.status!=="active")continue;let X=n9(Y);if(X===null)continue;let J=R$1(X.owner,X.repo);if(Z.has(J))continue;Z.add(J),Q.push(`${X.owner}/${X.repo}`)}return Q}function yK0($,Z,Q){let Y=R$1(Z,Q),X=($??[]).filter((J)=>{if(J.status&&J.status!=="active")return!1;let G=n9(J);return G!==null&&R$1(G.owner,G.repo)===Y});return X.find(Kj)??X[0]??null}var fK0,X00,R$1=($,Z)=>`${$}/${Z}`.toLowerCase();var _J=D(()=>{fK0={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read",statuses:"read"},X00=["statuses","deployments","checks"]});function YB$($){return MQ($)!==null||BY0($)!==null}var XB$=D(()=>{p8()});import{z as M$1}from"zod";var mV4,dV4,wA;var I$1=D(()=>{_J();UH();k0();$m();Y00();Xj();XB$();mV4=M$1.object({id:M$1.string().describe("ID of the virtual MCP to delete")}),dV4=M$1.object({item:KY.describe("The deleted virtual MCP entity")}),wA=c({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:mV4,outputSchema:dV4,handler:async($,Z)=>{n(Z);let Q=J0(Z);if(await Z.access.check(),YB$($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${$.id}`);let X=await LU(Z);if(!OU(X,Y.id))throw Error(`Virtual MCP not found: ${$.id}`);if(await Z.storage.virtualMcps.delete($.id),Z.orgFs)await D$1(Z.orgFs,$.id,p0(Z)??"system");let J=Y.metadata?.repository?.connectionId;if(J)try{let G=await Z.storage.connections.findById(J,Q.id),W=G&&(Kj(G)||(await Z.storage.virtualMcps.listByConnectionId(Q.id,J)).length>0||await Z.storage.connections.isReferencedByThread(J));if(G&&n9(G)&&!W){let H=await new w9(Z.db,Z.vault).get(J);if(H?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${H.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(J)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:J,error:G.message})}return{item:Y}}})});function JB$($,Z){let Q=$!==null&&typeof $==="object"&&!Array.isArray($)?$:null;if(Z===void 0)return Q;return{...Q??{},...Z}}import{z as IX}from"zod";var iV4,jA;var V$1=D(()=>{k0();$m();Xj();iV4=IX.object({connectionId:IX.string(),toolName:IX.string(),label:IX.string(),icon:IX.string().nullable().optional()}),jA=c({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:IX.object({virtualMcpId:IX.string().describe("Virtual MCP ID"),pinnedViews:IX.array(iV4).describe("Pinned views to set for the virtual MCP sidebar"),layout:IX.object({defaultMainView:IX.object({type:IX.string(),id:IX.string().optional(),toolName:IX.string().optional()}).nullable().optional(),chatDefaultOpen:IX.boolean().nullable().optional()}).optional()}),outputSchema:IX.object({item:KY.nullable()}),handler:async($,Z)=>{n(Z);let Q=J0(Z);await Z.access.check();let{virtualMcpId:Y,pinnedViews:X,layout:J}=$,G=p0(Z),W=await Z.storage.virtualMcps.findById(Y);if(!W)throw Error(`Virtual MCP not found: ${Y}`);if(W.organization_id!==Q.id)throw Error(`Virtual MCP not found: ${Y}`);let K=await LU(Z);if(!OU(K,W.id))throw Error(`Virtual MCP not found: ${Y}`);let H=W.metadata?.ui??{},F={...H,pinnedViews:X.length>0?X:null,layout:JB$(H.layout,J)};return{item:await Z.storage.virtualMcps.update(Y,G??"system",{metadata:{...W.metadata,ui:F}})}}})});import{z as $D}from"zod";var pV4,nV4,k$1;var GB$=D(()=>{k0();pV4=$D.object({ids:$D.array($D.string()).max(1000).describe("Virtual MCP ids to look up")}),nV4=$D.object({items:$D.array($D.object({id:$D.string(),last_used_at:$D.string().optional(),last_used_by:$D.string().optional()}))}),k$1=c({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pV4,outputSchema:nV4,handler:async($,Z)=>{n(Z),J0(Z),await Z.access.check();let Q=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Y)=>({id:Y,last_used_at:Q.get(Y)?.last_used_at,last_used_by:Q.get(Y)?.last_used_by}))}}})});var WB$=D(()=>{O$1();j$1();z$1();T$1();I$1();V$1();GB$()});import{z as VY}from"zod";var S$1;var KB$=D(()=>{k6();k0();S$1=c({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:VY.object({startDate:VY.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:VY.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:VY.array(VY.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:VY.array(VY.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:VY.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:VY.object({cells:VY.array(VY.object({virtualMcpId:VY.string().nullable(),toolName:VY.string(),calls:VY.number(),errors:VY.number(),outputSize:VY.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let Q=J0(Z);return await Z.access.check(),await oX(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:Q.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as j9}from"zod";var C$1;var HB$=D(()=>{k6();k0();C$1=c({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j9.object({id:j9.string().describe("Log ID to fetch")}),outputSchema:j9.object({log:j9.object({id:j9.string().optional(),organizationId:j9.string(),connectionId:j9.string(),toolName:j9.string(),input:j9.record(j9.string(),j9.unknown()),output:j9.record(j9.string(),j9.unknown()),isError:j9.boolean(),errorMessage:j9.string().nullish(),durationMs:j9.number(),timestamp:j9.string(),userId:j9.string().nullish(),requestId:j9.string(),userAgent:j9.string().nullish(),virtualMcpId:j9.string().nullish(),properties:j9.record(j9.string(),j9.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await oX();let Q=J0(Z),Y=await Z.storage.monitoring.getById(Q.id,$.id);if(!Y)return{log:null};return{log:{...Y,timestamp:Y.timestamp instanceof Date?Y.timestamp.toISOString():Y.timestamp}}}})});import{z as t8}from"zod";var oV4,_$1;var FB$=D(()=>{k6();k0();oV4=t8.object({id:t8.string().optional().describe("Unique log identifier"),organizationId:t8.string().describe("Organization ID"),connectionId:t8.string().describe("Connection ID"),toolName:t8.string().describe("Name of the tool that was called"),isError:t8.boolean().describe("Whether the call resulted in an error"),errorMessage:t8.string().nullish().describe("Error message if applicable"),durationMs:t8.number().describe("Call duration in milliseconds"),timestamp:t8.string().describe("ISO 8601 timestamp of the call"),userId:t8.string().nullish().describe("User who triggered the call"),requestId:t8.string().describe("Unique request identifier"),userAgent:t8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:t8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:t8.record(t8.string(),t8.string()).nullish().describe("Custom key-value metadata attached to the log")}),_$1=c({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:t8.object({connectionId:t8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:t8.array(t8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:t8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:t8.string().optional().describe("Filter by tool name"),isError:t8.boolean().optional().describe("Filter by error status"),startDate:t8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:t8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:t8.number().default(20).describe("Maximum number of results"),offset:t8.number().default(0).describe("Offset for pagination"),properties:t8.record(t8.string(),t8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:t8.array(t8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:t8.record(t8.string(),t8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:t8.record(t8.string(),t8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:t8.object({logs:t8.array(oV4).describe("Array of monitoring logs"),total:t8.number().describe("Total number of logs matching filters"),offset:t8.number().describe("Current offset for pagination"),limit:t8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await oX();let Q=J0(Z),X=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,J={organizationId:Q.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:X},G=await Z.storage.monitoring.query(J);return{logs:G.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:G.total,offset:$.offset,limit:$.limit}}})});import{z as _$}from"zod";var v$1;var UB$=D(()=>{k6();k0();v$1=c({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_$.object({startDate:_$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:_$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:_$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:_$.array(_$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:_$.array(_$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:_$.array(_$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:_$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:_$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:_$.array(_$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:_$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:_$.object({totalCalls:_$.number().describe("Total number of tool calls"),errorRate:_$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:_$.number().describe("Average call duration in milliseconds"),errorRatePercent:_$.string().optional().describe("Error rate as a percentage string"),totalErrors:_$.number().optional().describe("Total number of errors"),p50DurationMs:_$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:_$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:_$.array(_$.object({connectionId:_$.string(),calls:_$.number(),errors:_$.number(),errorRate:_$.number(),avgDurationMs:_$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:_$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:_$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:_$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:_$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:_$.array(_$.object({toolName:_$.string(),connectionId:_$.string().nullable(),calls:_$.number(),inputTokens:_$.number().optional(),outputTokens:_$.number().optional(),costUsd:_$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:_$.array(_$.object({timestamp:_$.string(),toolName:_$.string(),calls:_$.number(),errors:_$.number(),avg:_$.number(),p95:_$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:_$.array(_$.object({timestamp:_$.string(),calls:_$.number(),errors:_$.number(),errorRate:_$.number(),avg:_$.number(),p50:_$.number(),p95:_$.number(),inputTokens:_$.number().optional(),outputTokens:_$.number().optional(),totalTokens:_$.number().optional(),costUsd:_$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let Q=J0(Z);if(await Z.access.check(),await oX(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:Q.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let X=await Z.storage.monitoring.queryMetricTimeseries({organizationId:Q.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return X;let J=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:Q.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...X,topTools:J.topTools,topToolsTimeseries:J.timeseries}}let Y=await Z.storage.monitoring.getStats({organizationId:Q.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Y,errorRatePercent:(Y.errorRate*100).toFixed(2)}}})});import{z as VX}from"zod";var b$1;var NB$=D(()=>{k6();k0();b$1=c({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:VX.object({threadIds:VX.array(VX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:VX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:VX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:VX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:VX.object({items:VX.array(VX.object({threadId:VX.string(),calls:VX.number(),inputTokens:VX.number(),outputTokens:VX.number(),totalTokens:VX.number(),costUsd:VX.number()}))}),handler:async($,Z)=>{let Q=J0(Z);return await Z.access.check(),await oX(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:Q.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var BB$=D(()=>{KB$();HB$();FB$();UB$();NB$()});function gK0($){return typeof $==="string"&&sV4.has($.trim().toLowerCase())}var sV4;var x$1=D(()=>{sV4=new Set([".well-known","_admin","_users","api","auth","choose-editor","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reports-onboarding","reset-password"])});import{z as eG}from"zod";var f$1;var DB$=D(()=>{k0();x$1();f$1=c({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:eG.object({slug:eG.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!gK0($),"Slug is reserved by Studio"),name:eG.string().min(1).max(255),description:eG.string().max(500).optional()}),outputSchema:eG.object({id:eG.string(),name:eG.string(),slug:eG.string(),logo:eG.string().nullable().optional(),metadata:eG.any().optional(),createdAt:eG.string().datetime().describe("ISO 8601 timestamp"),members:eG.array(eG.any()).optional()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=p0(Z);if(!Q)throw Error("User ID required to create organization");let Y=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:Q});if(!Y)throw Error("Failed to create organization");return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as jU}from"zod";var y$1;var OB$=D(()=>{k0();y$1=c({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:jU.object({}),outputSchema:jU.object({organizations:jU.array(jU.object({id:jU.string(),name:jU.string(),slug:jU.string(),logo:jU.string().nullable().optional(),metadata:jU.any().optional(),createdAt:jU.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(n(Z),await Z.access.check(),!p0(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Y)=>({...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}))}}})});import{z as qW}from"zod";var g$1;var LB$=D(()=>{k0();g$1=c({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:qW.object({}),outputSchema:qW.object({id:qW.string(),name:qW.string(),slug:qW.string(),logo:qW.string().nullable().optional(),metadata:qW.any().optional(),createdAt:qW.string().datetime().describe("ISO 8601 timestamp"),members:qW.array(qW.any()).optional(),invitations:qW.array(qW.any()).optional()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.boundAuth.organization.get(Q);if(!Y)throw Error("No active organization found");let X=new Date,J=Y.invitations?.filter((G)=>new Date(G.expiresAt)>X);return{...Y,invitations:J,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as NH}from"zod";var h$1;var wB$=D(()=>{k0();h$1=c({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:NH.object({id:NH.string(),name:NH.string().min(1).max(255).optional(),description:NH.string().max(500).optional()}),outputSchema:NH.object({id:NH.string(),name:NH.string(),slug:NH.string(),logo:NH.string().nullable().optional(),metadata:NH.any().optional(),createdAt:NH.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(n(Z),await Z.access.check(),$.id!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q={};if($.name)Q.name=$.name;if($.description!==void 0){let X=await Z.boundAuth.organization.get($.id);Q.metadata={...X?.metadata,description:$.description}}let Y=await Z.boundAuth.organization.update({organizationId:$.id,data:Q});if(!Y)throw Error("Failed to update organization");return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{sql as aV4}from"kysely";import{z as J00}from"zod";var u$1;var jB$=D(()=>{p8();k0();GK0();u$1=c({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:J00.object({id:J00.string()}),outputSchema:J00.object({success:J00.boolean(),id:J00.string()}),handler:async($,Z)=>{if(n(Z),await Z.access.check(),$.id!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=(await Z.boundAuth.organization.get($.id))?.metadata??{};if(Y.archived===!0)return{success:!0,id:$.id};let X=await Z.storage.connections.findById(Y4.REPORTS($.id),$.id);await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...Y,archived:!0,archivedAt:new Date().toISOString()}}}),await aV4`
       update session set "activeOrganizationId" = null
       where "activeOrganizationId" = ${$.id}
-    `.execute(Z.db);let J=X?.metadata?.siteUrl;if(typeof J==="string")ic({siteUrl:J,orgId:$.id,cause:"organization_deleted"});return{success:!0,id:$.id}}})});import{z as G$}from"zod";function jZ($,Z){let Q=$?.[Z];return $k4.has(Z)?Q!==!1:Q===!0}function PB$($){let Z=$?.auto_resolve_conflicts;return typeof Z==="boolean"?Z:$?.auto_merge===!0}var QD=500,G00,ZD,EB$,Hj,W00,K00,zB$=50,eV4,H00,F00,EA,$k4,hK0=262144,Zk4=50,$3=500,Qk4=5000,Fj;var t9=D(()=>{G00=G$.object({title:G$.string().max(QD),url:G$.string().max(QD),icon:G$.string().max(QD)}),ZD=G$.object({keyId:G$.string().max(QD),modelId:G$.string().max(QD),title:G$.string().max(QD).optional()}).nullable(),EB$=G$.enum(["fast","smart","thinking","image","web_search","deep_research"]),Hj=G$.enum(["fast","smart","thinking"]),W00=G$.object({tiers:G$.object({fast:ZD,smart:ZD,thinking:ZD,image:ZD,web_search:ZD,deep_research:ZD})}),K00=G$.object({tiers:G$.object({fast:ZD.optional(),smart:ZD.optional(),thinking:ZD.optional()})}),eV4=/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/,H00=G$.object({host:G$.string().min(1).max(QD).regex(eV4).describe("Git host, e.g. 'github.com' (bare hostname, no scheme)."),secretId:G$.string().min(1).max(QD).describe("Vault secret id holding the PAT used to authenticate this host.")}),F00=G$.object({ids:G$.array(G$.string().max(QD)).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),EA=G$.object({voice_mode:G$.boolean().optional(),home_task_intake_enabled:G$.boolean().optional().describe("Show Task mode on the Home composer and allow reports to start tasks."),demo_mode:G$.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:G$.boolean().optional().describe("Curated Deco Score look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),reviewer_enabled:G$.boolean().optional().describe("Run the Reviewer on a task's pull request once it's In Review \u2014 it reviews the code with the repo's stack-appropriate skills, fixes what it finds on the PR's own branch, then exercises the change on the deploy preview and approves or hands the card to a human."),qa_agent_enabled:G$.boolean().optional().describe("Deprecated: see reviewer_enabled."),code_reviewer_enabled:G$.boolean().optional().describe("Deprecated: see reviewer_enabled."),auto_merge:G$.boolean().optional().describe("When the Reviewer approves a task's pull request, merge it automatically instead of leaving the merge to a human."),auto_resolve_conflicts:G$.boolean().optional().describe("When an approved pull request can't be merged because it conflicts with its base branch, hand it back to the Super Agent to resolve the conflict (check out the branch, merge the base, push). Unset, it follows `auto_merge`; set it explicitly to run one without the other."),cheap_reviewer_model:G$.boolean().optional().describe("Run the Reviewer on a cheaper model than the Super Agent that wrote the code. On by default \u2014 turning it off trades cost for some review depth."),coding_agent_org_mcps:G$.boolean().optional().describe("Give a coding-agent run (the claude-code harness in a sandbox) every MCP connection in the org as its own MCP server, on top of the narrow task-run surface it always gets. Off by default: each connection is one more server the agent connects to at session start, and all of their tools land in its context."),coding_agents_claude_code:G$.boolean().optional().describe("Run chats on a Code Agent (an agent imported from a GitHub repo) with the claude-code harness inside its sandbox, instead of hosted Decopilot. Off by default: it changes the runtime of every such chat, and claude-code flushes whole turns rather than streaming tokens."),auto_assign_report_tasks_to_super_agent:G$.boolean().optional().describe("When a Deco Score import creates a task board item without an assignee, delegate it to the Super Agent automatically instead of leaving it unassigned."),hosting_enabled:G$.boolean().optional().describe("Per-site Hosting tab (deployments, domains, deploy outcomes). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),deco_analytics_enabled:G$.boolean().optional().describe("Per-site Deco Analytics tab (traffic, realtime, usage & limits). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),e2e_enabled:G$.boolean().optional().describe("Per-site E2E tab (end-to-end test runs). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),experiments_enabled:G$.boolean().optional().describe("Per-site Experiments tab (A/B tests + variant results). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org."),monitor_enabled:G$.boolean().optional().describe("Per-site Monitor tab (CDN Performance + Audience from the stats-lake warehouse). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. Its own deployment-wide switch `MONITOR_GA` opens it to every org at once (independent of the control-plane trio)."),site_create_enabled:G$.boolean().optional().describe('The "Create a new site" option under New project: generates a GitHub repository from a site template in an account the org connected, and opens it as a project. Off by default, for every org \u2014 deco.cx staff included.'),delivery_lanes_enabled:G$.boolean().optional().describe("Board lanes for shipping: Approved, Merged and Post-deploy Validation sit between In Review and Done, and a merged pull request lands on Merged instead of Done. For teams whose release process continues after the merge. Off by default \u2014 with it off the board and the state machine behave exactly as if the lanes did not exist."),new_blocks_editor:G$.boolean().optional().describe("Use the redesigned blocks editor for every member of the organization. Off by default \u2014 the classic editor stays until an admin opts the org in.")}),$k4=new Set(["reviewer_enabled","cheap_reviewer_model"]);Fj=G$.object({id:G$.string().describe("Brand context ID"),name:G$.string().max($3).describe("Company name"),domain:G$.string().max($3).describe("Company domain (e.g. example.com)"),overview:G$.string().max(Qk4).describe("Company overview / description"),logo:G$.string().max($3).nullable().optional().describe("Logo URL"),favicon:G$.string().max($3).nullable().optional().describe("Favicon URL"),ogImage:G$.string().max($3).nullable().optional().describe("OG image URL"),fonts:G$.object({heading:G$.string().max($3).optional().describe("Font family for headings"),body:G$.string().max($3).optional().describe("Font family for body text"),code:G$.string().max($3).optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:G$.object({primary:G$.string().max($3).optional().describe("Primary brand color (hex)"),secondary:G$.string().max($3).optional().describe("Secondary brand color (hex)"),accent:G$.string().max($3).optional().describe("Accent / highlight color (hex)"),background:G$.string().max($3).optional().describe("Background color (hex)"),foreground:G$.string().max($3).optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:G$.array(G$.record(G$.string(),G$.unknown())).max(Zk4).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=hK0,{message:`images must serialize to at most ${hK0} bytes`}).describe("Brand images"),metadata:G$.record(G$.string(),G$.unknown()).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=hK0,{message:`metadata must serialize to at most ${hK0} bytes`}).describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:G$.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:G$.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as YD}from"zod";var l$1;var AB$=D(()=>{k0();t9();l$1=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:YD.object({}),outputSchema:YD.object({organizationId:YD.string(),sidebar_items:YD.array(G00).nullable().optional(),coding_agent_mcp_excluded:YD.array(YD.string()).nullable().optional(),simple_mode:W00.nullable().optional(),default_home_agents:F00.nullable().optional(),flags:EA.nullable().optional(),submodule_credentials:YD.array(H00).nullable().optional(),createdAt:YD.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:YD.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.organizationSettings.get(Q);if(!Y)return{organizationId:Q};return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as c$1}from"zod";var m$1;var TB$=D(()=>{k0();m$1=c({name:"ORGANIZATION_HAS_SITE",description:"Whether this organization owns at least one legacy deco.cx site. Boolean only \u2014 does not expose site slugs.",annotations:{title:"Has Owned Site",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:c$1.object({}),outputSchema:c$1.object({hasSite:c$1.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{hasSite:(await Z.storage.orgSites.listByOrg(Q.id)).length>0}}})});import{z as kY}from"zod";var Yk4=50,Xk4=100,Jk4=500,RB$=500,d$1;var qB$=D(()=>{k0();t9();d$1=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:kY.object({organizationId:kY.string().min(1,"organizationId is required"),sidebar_items:kY.array(G00).max(Yk4).optional(),coding_agent_mcp_excluded:kY.array(kY.string().max(RB$)).max(Jk4).optional().describe("Connection ids a coding-agent run must not mount, even with `coding_agent_org_mcps` on. Replaces the stored list; pass [] to clear it."),simple_mode:W00.optional(),default_home_agents:F00.extend({ids:kY.array(kY.string().max(RB$)).max(Xk4)}).optional(),flags:EA.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),submodule_credentials:kY.array(H00).max(zB$).refine(($)=>new Set($.map((Z)=>Z.host)).size===$.length,"Each git credential host must be unique.").optional().describe("Per-host PATs (as vault secret ids) every sandbox in the org installs in its git config. Replaces the stored list; pass [] to clear it.")}),outputSchema:kY.object({organizationId:kY.string(),sidebar_items:kY.array(G00).nullable().optional(),coding_agent_mcp_excluded:kY.array(kY.string()).nullable().optional(),simple_mode:W00.nullable().optional(),default_home_agents:F00.nullable().optional(),flags:EA.nullable().optional(),submodule_credentials:kY.array(H00).nullable().optional(),createdAt:kY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:kY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(n(Z),await Z.access.check(),J0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Y=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,coding_agent_mcp_excluded:$.coding_agent_mcp_excluded,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,submodule_credentials:$.submodule_credentials});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as uK0}from"zod";var i$1;var MB$=D(()=>{t9();k0();i$1=c({name:"ORGANIZATION_BLOCKS_EDITOR_SET",description:"Turn the redesigned blocks editor on or off for every member of the organization.",annotations:{title:"Set Blocks Editor",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:uK0.object({enabled:uK0.boolean().describe("Whether the org uses the new blocks editor.")}),outputSchema:uK0.object({enabled:uK0.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationSettings.upsert(Q.id,{flags:{new_blocks_editor:$.enabled}});return{enabled:jZ(Y.flags,"new_blocks_editor")}}})});import{z as BH}from"zod";var IB$,p$1,n$1;var VB$=D(()=>{k0();t9();IB$=Fj.extend({organizationId:BH.string(),archivedAt:BH.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:BH.string().describe("ISO 8601 timestamp"),updatedAt:BH.string().describe("ISO 8601 timestamp")}),p$1=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BH.object({includeArchived:BH.boolean().optional().describe("Include archived brands in the list")}),outputSchema:BH.object({items:BH.array(IB$)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q,{includeArchived:$.includeArchived})).map((X)=>({...X,archivedAt:X.archivedAt instanceof Date?X.archivedAt.toISOString():X.archivedAt,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,updatedAt:X.updatedAt instanceof Date?X.updatedAt.toISOString():X.updatedAt}))}}}),n$1=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BH.object({id:BH.string().describe("Brand context ID")}),outputSchema:IB$.extend({organizationId:BH.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.get($.id,Q);if(!Y)throw Error("Brand context not found");return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as zA}from"zod";var kB$,t$1,o$1,r$1;var SB$=D(()=>{k0();t9();kB$=Fj.extend({organizationId:zA.string(),createdAt:zA.string().describe("ISO 8601 timestamp"),updatedAt:zA.string().describe("ISO 8601 timestamp")}),t$1=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:Fj.omit({id:!0}),outputSchema:kB$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.create(Q,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}}),o$1=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Fj.partial().required({id:!0}),outputSchema:kB$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");let{id:X,...J}=$;if(J.isDefault===!0)await Z.storage.brandContext.setDefault(X,Q);let G=await Z.storage.brandContext.update(X,Q,{name:J.name,domain:J.domain,overview:J.overview,logo:J.logo!==void 0?J.logo??null:void 0,favicon:J.favicon!==void 0?J.favicon??null:void 0,ogImage:J.ogImage!==void 0?J.ogImage??null:void 0,fonts:J.fonts!==void 0?J.fonts??null:void 0,colors:J.colors!==void 0?J.colors??null:void 0,images:J.images!==void 0?J.images??null:void 0,metadata:J.metadata!==void 0?J.metadata??null:void 0,archivedAt:J.archivedAt!==void 0?J.archivedAt??null:void 0,isDefault:J.isDefault===!1?!1:void 0});return{...G,archivedAt:G.archivedAt instanceof Date?G.archivedAt.toISOString():G.archivedAt,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,updatedAt:G.updatedAt instanceof Date?G.updatedAt.toISOString():G.updatedAt}}}),r$1=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:zA.object({id:zA.string().describe("Brand context ID")}),outputSchema:zA.object({success:zA.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,Q,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function lK0($,Z,Q){let Y=$.trim();if(!Y.startsWith("http"))Y=`https://${Y}`;let X=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Y,formats:["branding"]})});if(!X.ok){let N=await X.text().catch(()=>"");throw Error(`Firecrawl API error: ${X.status} ${N.slice(0,200)}`)}let J=await X.json();if(!J.success||!J.data?.branding)return null;let G=J.data.branding,W=J.data.metadata??{},K=Kk4(G,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??W.ogSiteName??Q??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function Kk4($,Z){let Q=$.images??{},Y=$.colors??{},X={};for(let[F,U]of Object.entries(Y))if(typeof U==="string"&&U&&Gk4.has(F))X[F]=U;let J={},W=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(W))if(typeof U==="string"&&U){let N=Wk4[F.toLowerCase()];if(N&&!J[N])J[N]=U}let K=$.fonts;if(Array.isArray(K))for(let F of K){let U=F.family;if(typeof U==="string"&&U&&!J.body)J.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:Q.logo??null,favicon:Q.favicon??null,ogImage:Q.ogImage??Z.ogImage??null,fonts:Object.keys(J).length>0?J:null,colors:Object.keys(X).length>0?X:null,metadata:H}}var Gk4,Wk4;var s$1=D(()=>{Gk4=new Set(["primary","secondary","accent","background","foreground"]),Wk4={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as cK0}from"zod";var Hk4,a$1;var CB$=D(()=>{k0();s$1();t9();Hk4=Fj.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:cK0.boolean()}),a$1=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:cK0.object({domain:cK0.string().describe("Website domain to extract brand from"),brandId:cK0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Hk4,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=Z.firecrawlApiKey;if(!Y)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let X=await lK0($.domain,Y,$.domain);if(!X)throw Error("Firecrawl did not return branding data for this URL");let J={name:X.name,domain:X.domain,overview:X.overview,logo:X.logo,favicon:X.favicon,ogImage:X.ogImage,fonts:X.fonts,colors:X.colors,images:X.images,metadata:X.metadata},G=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,Q))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,Q,J)})():await Z.storage.brandContext.create(Q,J);return{id:G.id,name:G.name,domain:G.domain,overview:G.overview,logo:G.logo,favicon:G.favicon,ogImage:G.ogImage,fonts:G.fonts,colors:G.colors,success:!0}}})});function _B$($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let Q=Object.fromEntries(Object.entries(Z).filter(([Y])=>Y!=="tagline"&&Y!=="tone"));return Object.keys(Q).length>0?Q:void 0})()}}var e$1,$81;var vB$=D(()=>{s11();k0();e$1=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BK0,outputSchema:ne,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=$.id?await Z.storage.brandContext.get($.id,Q):await Z.storage.brandContext.getDefault(Q);if(!Y)throw Error($.id?"Brand not found":"No default brand configured");return _B$(Y)}}),$81=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:DK0,outputSchema:OK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q)).map(_B$)}}})});import{resolveTxt as Fk4}from"dns/promises";function Z81($){return`${Uk4}.${$.toLowerCase()}`}function bB$(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xB$($,Z,Q=Fk4){if(!Z)return!1;try{return(await Q(Z81($))).some((X)=>X.join("").trim()===Z)}catch{return!1}}var Uk4="_deco-verify";var fB$=()=>{};import{z as b9}from"zod";function Uj($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?Z81($.domain):null,recordValue:Z?$.verificationToken:null}}function Bk4($){let Z=$.toLowerCase().trim();if(!Nk4.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(DH.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var Nk4,yB$=50,Q81,mK0,Y81,X81,J81,G81,W81;var gB$=D(()=>{Z3();fB$();k0();Nk4=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,Q81=b9.enum(["off","auto","request"]),mK0=b9.object({id:b9.string(),domain:b9.string(),joinMode:Q81,verificationStatus:b9.enum(["pending","verified"]),verificationMethod:b9.enum(["email","dns"]).nullable(),verifiedAt:b9.string().nullable(),recordName:b9.string().nullable(),recordValue:b9.string().nullable()});Y81=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({}),outputSchema:b9.object({domains:b9.array(mK0)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(Q.id)).map(Uj)}}}),X81=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({domain:b9.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:Q81.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:mK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=Bk4($.domain),J=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),G=Boolean(Z.auth.user?.emailVerified)&&J===Y,W=await Z.storage.organizationDomains.getByOrgAndDomain(Q.id,Y);if(W){if(W.verificationStatus!=="verified"&&G){let F=await Z.storage.organizationDomains.markVerified(W.id,"email");return Uj(F)}return Uj(W)}if((await Z.storage.organizationDomains.listByOrganizationId(Q.id)).length>=yB$)throw Error(`An organization can claim at most ${yB$} domains.`);let H=G?await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:"off",verificationStatus:"pending",verificationToken:bB$()});return Uj(H)}}),J81=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({id:b9.string(),joinMode:Q81}),outputSchema:mK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if($.joinMode!=="off"&&Y.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let X=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return Uj(X)}}),G81=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:b9.object({id:b9.string()}),outputSchema:b9.object({verified:b9.boolean(),domain:mK0}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if(Y.verificationStatus==="verified")return{verified:!0,domain:Uj(Y)};if(!Y.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xB$(Y.domain,Y.verificationToken))return{verified:!1,domain:Uj(Y)};let J=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:Uj(J)}}}),W81=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({id:b9.string()}),outputSchema:b9.object({success:b9.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function Nj($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as hZ}from"zod";var Dk4,K81,H81,F81;var hB$=D(()=>{k0();G6();Dk4=hZ.object({id:hZ.string(),userId:hZ.string(),status:hZ.enum(["pending","approved","denied"]),createdAt:hZ.string(),user:hZ.object({id:hZ.string(),name:hZ.string(),email:hZ.string(),image:hZ.string().nullable()}).nullable()}),K81=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({}),outputSchema:hZ.object({requests:hZ.array(Dk4)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(Q.id)).map((X)=>({id:X.id,userId:X.userId,status:X.status,createdAt:new Date(X.createdAt).toISOString(),user:X.user}))}}}),H81=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({requestId:hZ.string()}),outputSchema:hZ.object({success:hZ.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=p0(Z);if(!await Z.storage.organizationJoinRequests.decide(Y.id,"approved",X??Y.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:Q.id,userId:Y.userId,role:["user"]})}catch(G){if(!Nj(G))throw G}if(X)f1.capture({distinctId:X,event:"organization_join_request_approved",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}}),F81=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({requestId:hZ.string()}),outputSchema:hZ.object({success:hZ.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=p0(Z);if(await Z.storage.organizationJoinRequests.decide(Y.id,"denied",X??Y.userId)&&X)f1.capture({distinctId:X,event:"organization_join_request_denied",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}})});import{z as vJ}from"zod";var U81;var uB$=D(()=>{G6();k0();DY();U81=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:vJ.object({organizationId:vJ.string().optional(),userId:vJ.string(),role:vJ.array(vJ.string())}),outputSchema:vJ.object({id:vJ.string(),organizationId:vJ.string(),userId:vJ.string(),role:vJ.union([vJ.string(),vJ.array(vJ.string())]),createdAt:vJ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",p0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!qX0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let X=await Z.boundAuth.organization.addMember({organizationId:Q,userId:$.userId,role:$.role});if(!X)throw Error("Failed to add member");let J=p0(Z);if(J)f1.capture({distinctId:J,event:"organization_member_added",groups:{organization:Q},properties:{organization_id:Q,added_user_id:$.userId,role:$.role}});return{...X,role:X.role,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});import{z as Zm}from"zod";var N81;var lB$=D(()=>{G6();k0();N81=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zm.object({organizationId:Zm.string().optional(),memberIdOrEmail:Zm.string()}),outputSchema:Zm.object({success:Zm.boolean(),memberIdOrEmail:Zm.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.boundAuth.organization.removeMember({organizationId:Q,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Y.member.userId,Q);let X=p0(Z);if(X)f1.capture({distinctId:X,event:"organization_member_removed",groups:{organization:Q},properties:{organization_id:Q,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as SY}from"zod";var B81;var cB$=D(()=>{k0();B81=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SY.object({limit:SY.number().int().min(1).max(1000).optional(),offset:SY.number().int().min(0).optional()}),outputSchema:SY.object({members:SY.array(SY.object({id:SY.string(),organizationId:SY.string(),userId:SY.string(),role:SY.string(),createdAt:SY.string().datetime().describe("ISO 8601 timestamp"),user:SY.object({id:SY.string(),name:SY.string(),email:SY.string(),image:SY.string().optional()}).optional()}))}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:Q,limit:$.limit,offset:$.offset}))?.members??[]).map((J)=>({...J,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt}))}}})});import{z as YQ}from"zod";var D81;var mB$=D(()=>{G6();k0();DY();D81=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:YQ.object({organizationId:YQ.string().optional(),memberId:YQ.string(),role:YQ.array(YQ.string())}),outputSchema:YQ.object({id:YQ.string(),organizationId:YQ.string(),userId:YQ.string(),role:YQ.union([YQ.string(),YQ.array(YQ.string())]),createdAt:YQ.string().datetime().describe("ISO 8601 timestamp"),user:YQ.object({email:YQ.string(),name:YQ.string(),image:YQ.string().optional()})}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",p0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!qX0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);if(!$.role.includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("id","=",$.memberId).where("organizationId","=",Q).executeTakeFirst())?.role.split(",").includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("organizationId","=",Q).execute()).filter((H)=>H.role.split(",").includes("owner")).length<=1)throw Error("Cannot remove the organization's last owner. Assign another owner first.")}}let X=await Z.boundAuth.organization.updateMemberRole({organizationId:Q,memberId:$.memberId,role:$.role});if(!X)throw Error("Failed to update member role");Z.invalidateMemberRole?.(X.userId,Q);let J=p0(Z);if(J)f1.capture({distinctId:J,event:"organization_member_role_updated",groups:{organization:Q},properties:{organization_id:Q,member_id:$.memberId,target_user_id:X.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...X,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});async function dB$(){if(U00&&Date.now()-U00.fetchedAt<600000)return U00.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),Q=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(Q)||Q<=0)throw Error("Invalid rate");return U00={rate:Q,fetchedAt:Date.now()},Q}catch{return U00?.rate??5.5}}function iB$($,Z,Q){if(Z==="brl")return Math.round($/Q);return $}var U00=null;function O81($,Z="",Q=new URLSearchParams){for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;let J=Z?`${Z}[${Y}]`:Y;if(Array.isArray(X))X.forEach((G,W)=>{if(typeof G==="object"&&G!==null)O81(G,`${J}[${W}]`,Q);else Q.append(`${J}[${W}]`,String(G))});else if(typeof X==="object")O81(X,J,Q);else Q.append(J,String(X))}return Q}async function XD($,Z){let Q=E0().stripeSecretKey;if(!Q)throw new uZ(503,"billing is not configured");let Y=Z?.params?O81(Z.params).toString():void 0,X=await fetch(`${Ok4}${$}`,{method:Z?.method??(Y?"POST":"GET"),headers:{Authorization:`Bearer ${Q}`,...Y&&{"Content-Type":"application/x-www-form-urlencoded"},...Z?.idempotencyKey&&{"Idempotency-Key":Z.idempotencyKey}},body:Y,signal:AbortSignal.timeout(Lk4)}),J=await X.json().catch(()=>({}));if(!X.ok){let G=J.error?.message??`HTTP ${X.status}`;throw new uZ(X.status,G)}return J}function pB$($){return{billing_address_collection:"required",custom_fields:[{key:wk4,label:{type:"custom",custom:"CPF / CNPJ"},type:"text",optional:!1,text:{minimum_length:jk4,maximum_length:Ek4}}],...$&&{customer_update:{address:"auto",name:"auto"}}}}function nB$($){return Boolean((E0().stripePlanPriceIds??{})[$])}function L81($){let Z=E0().stripePlanPriceIds??{};return Object.entries(Z).find(([,Q])=>Q===$)?.[0]}function zk4($){return["checkout",$.organizationId,$.planId??"flat",$.lastStripeEventAt?.getTime()??0].join(":")}async function tB$($){let Z=E0(),Q=$.planId?L81($.planId):Z.stripeOrgPriceId;if(!Q)throw new uZ(503,$.planId?`plan '${$.planId}' has no Stripe price configured`:"billing is not configured");let Y=await XD("/checkout/sessions",{idempotencyKey:zk4({organizationId:$.organizationId,...$.planId?{planId:$.planId}:{},...$.lastStripeEventAt!==void 0&&{lastStripeEventAt:$.lastStripeEventAt}}),params:{mode:"subscription",...pB$(null),line_items:[{price:Q,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}},subscription_data:{billing_cycle_anchor_config:{day_of_month:1,hour:0,minute:0,second:0},metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}}}}});if(!Y.url)throw new uZ(500,"checkout session lacks url");return{url:Y.url}}function Pk4($,Z){return Math.round($*(1+Z/100))}function Tk4($){let Z=Math.floor(($.nowMs??Date.now())/Ak4);return["topup",$.organizationId,$.currency,$.amountCents,Z].join(":")}async function oB$($){let Z=Pk4($.amountCents,$.feePercent),Q=iB$($.amountCents,$.currency,await dB$()),Y=E0().stripeTopupProductId,X={kind:"topup",orgId:$.organizationId,creditCents:Q},J=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,G=await XD("/checkout/sessions",{idempotencyKey:Tk4({organizationId:$.organizationId,amountCents:$.amountCents,currency:$.currency}),params:{mode:"payment",...$.customerId&&{customer:$.customerId},...pB$($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Y?{product:Y}:{product_data:{name:J}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:X,payment_intent_data:{metadata:X}}});if(!G.url)throw new uZ(500,"checkout session lacks url");return{url:G.url}}async function dK0($){let Z=await XD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new uZ(500,"portal session lacks url");return{url:Z.url}}async function rB$($){let Z=await XD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl,...E0().stripePortalConfigurationId&&{configuration:E0().stripePortalConfigurationId},flow_data:{type:"subscription_update_confirm",subscription_update_confirm:{subscription:$.subscriptionId,items:[{id:$.subscriptionItemId,price:$.priceId}]},after_completion:{type:"redirect",redirect:{return_url:$.returnUrl}}}}});if(!Z.url)throw new uZ(500,"portal session lacks url");return{url:Z.url}}async function sB$($){return XD(`/prices/${encodeURIComponent($)}`)}async function Bj($){return XD(`/subscriptions/${encodeURIComponent($)}`)}async function aB$($){await XD(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}async function eB$($){let Z=await XD(`/invoices?subscription=${encodeURIComponent($)}&status=paid&limit=100`),Q=Rk4($,Z.data??[]);for(let Y of Q)await XD("/refunds",{params:{payment_intent:Y.paymentIntent,reason:"duplicate"},idempotencyKey:Y.idempotencyKey});return{refundedCents:Q.reduce((Y,X)=>Y+X.amountCents,0)}}function Rk4($,Z){let Q=[];for(let Y of Z){let X=Y.amount_paid??0;if(X<=0)continue;let J=typeof Y.payment_intent==="string"?Y.payment_intent:Y.payment_intent?.id;if(!J)continue;Q.push({paymentIntent:J,amountCents:X,idempotencyKey:`orphan-refund:${$}:${Y.id??J}`})}return Q}var Ok4="https://api.stripe.com/v1",uZ,Lk4=15000,wk4="taxid",jk4=11,Ek4=18,Ak4=120000;var JD=D(()=>{X$();uZ=class uZ extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as iK0}from"zod";async function qk4($){if(!$.planId)throw Error("This organization already has an active subscription.");let Z=L81($.planId);if(!Z)throw new uZ(503,`plan '${$.planId}' has no Stripe price configured`);let Q=await Bj($.subscriptionId),Y=(Q.items?.data??[]).filter((G)=>G.price?.id?nB$(G.price.id):!1),X=Y[0];if(Y.length>1)throw Error("This organization's subscription has more than one plan line \u2014 change it in Stripe, not here.");if(!X?.id)throw new uZ(500,"subscription has no plan line to move to another price");if(X.price?.id===Z)throw Error("This organization is already on that plan.");let{url:J}=await rB$({customerId:Q.customer,subscriptionId:$.subscriptionId,subscriptionItemId:X.id,priceId:Z,returnUrl:$.returnUrl});return J}var w81;var $D$=D(()=>{JD();I9();k0();G6();w81=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:iK0.object({planId:iK0.string().optional()}),outputSchema:iK0.object({url:iK0.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id,Y=Z.organization?.slug;if(!Q||!Y)throw Error("Organization context required");let X=await Z.storage.organizationBilling.getBilling(Q),J=`${m5()}${Yj(Y,"members")}`;if(X?.status==="active"&&X.stripeSubscriptionId){let W=await qk4({subscriptionId:X.stripeSubscriptionId,planId:$.planId,returnUrl:`${J}?checkout=updated`});return wY({event:"subscription_plan_change_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:W}}if(X?.status==="active")throw Error("This organization already has an active subscription.");if(X?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let{url:G}=await tB$({organizationId:Q,successUrl:`${J}?checkout=success`,cancelUrl:`${J}?checkout=canceled`,...$.planId?{planId:$.planId}:{},lastStripeEventAt:X?.lastStripeEventAt??null});return wY({event:"subscription_checkout_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:G}}})});import{z as Dj}from"zod";async function kk4(){if(N00&&Date.now()-N00.at<N00.ttlMs)return N00.prices;let $=new Set,Z=Object.entries(E0().stripePlanPriceIds??{}).filter(([,J])=>{if($.has(J))return!1;return $.add(J),!0}),Y=(await Promise.all(Z.map(async([J,G])=>{try{let W=await sB$(J);if(W.unit_amount===null)return null;return{planId:G,amountCents:W.unit_amount,currency:W.currency,interval:W.recurring?.interval??null}}catch(W){return console.warn(`plan price ${J} (${G}) unreadable:`,W instanceof uZ?W.message:W),null}}))).filter((J)=>J!==null),X=Y.length===Z.length;return N00={at:Date.now(),prices:Y,ttlMs:X?Ik4:Vk4},Y}var Mk4,Ik4=600000,Vk4=30000,N00=null,j81;var ZD$=D(()=>{JD();k0();X$();Mk4=Dj.object({planId:Dj.string(),amountCents:Dj.number(),currency:Dj.string(),interval:Dj.string().nullable()});j81=c({name:"ORGANIZATION_BILLING_PLAN_PRICES",description:"The monthly price of each purchasable plan, read from Stripe. Empty when no plan prices are configured.",annotations:{title:"Plan Prices",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Dj.object({}),outputSchema:Dj.object({prices:Dj.array(Mk4)}),handler:async($,Z)=>{return n(Z),await Z.access.check(),{prices:await kk4()}}})});import{z as E81}from"zod";var z81;var QD$=D(()=>{JD();I9();k0();z81=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:E81.object({}),outputSchema:E81.object({url:E81.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);if(!Q.slug)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(Q.id);if(!Y?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await dK0({customerId:Y.stripeCustomerId,returnUrl:`${m5()}${Yj(Q.slug,"members")}`})}catch(X){if(X instanceof uZ)throw Error(X.message);throw X}}})});function pK0($){return P81[$%P81.length]??Sk4}function XQ($){return $.createdBy==="system"}function _k4($){if($?.reviewer_enabled===void 0&&$?.qa_agent_enabled===!1&&$?.code_reviewer_enabled===!1)return!1;return jZ($,"reviewer_enabled")}function GD($){return _k4($)?MW:[]}function vk4($){return jZ($,"delivery_lanes_enabled")}function zU($){return vk4($)?"merged":"done"}function Lj($,Z){if(!$)return!1;return[EU[Z],...Ck4].some((Q)=>$.startsWith(`${Q}:`))}function WD($,Z){if(Z)return new Date(Z).getTime();let Q=0;for(let Y of $){if(Y.action!=="status_changed")continue;if(Y.data?.to!=="in_review")continue;Q=Math.max(Q,new Date(Y.occurredAt).getTime())}return Q}function JD$($,Z,Q){let X=$.filter((J)=>J.action==="status_changed").at(-1);if(!X)return Q;return X.data?.to===Z?X.occurredAt:null}function wj($,Z){let Q=WD($,Z.cycleStartedAt),Y=new Map;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;if(new Date(X.occurredAt).getTime()<Q)continue;let J=X.data??{};if(J.reviewer!=="reviewer")continue;if(X.action==="review_approved"){if(Z?.verifiedOnly&&J.verified!==!0)continue;Y.set("reviewer","approved")}else Y.set("reviewer","changes_requested")}return Y}function Oj($,Z,Q){if(Z.length===0)return!1;let Y=wj($,Q);return Z.every((X)=>Y.get(X)==="approved")}function GD$($,Z,Q){return Oj($,Z,Q)&&!Oj($,Z,{...Q,verifiedOnly:!0})}function WD$($){let Z=null;for(let Q of $){if(Q.action!=="review_approved"&&Q.action!=="review_changes_requested")continue;let Y=new Date(Q.occurredAt).getTime();if(Z&&Y<Z.at)continue;let X=Q.data?.notes;Z={at:Y,notes:Q.action==="review_changes_requested"&&typeof X==="string"?X:null}}return Z?.notes??null}function ND$($,Z=Date.now()){if($.state!==null&&$.state!=="open")return!1;if($.state===null)return!0;if($.checksStatus==="pending")return!0;if($.previewUrl!==null)return!1;let Q=$.updatedAt?Date.parse($.updatedAt):Number.NaN;return Number.isFinite(Q)&&Z-Q<bk4}var R8="super-agent",P81,Sk4,B00='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',YD$,A81="chore",MW,EU,Ck4,D00="NO VISUAL SURFACE",OH,R$,XD$,nK0,KD$="task-board.item.updated",HD$="task-board.item.deleted",FD$="task-board.item.prs.updated",UD$=4000,bk4=600000;var x4=D(()=>{t9();P81=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],Sk4=P81[0];YD$="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",MW=["reviewer"],EU={reviewer:"Reviewer"},Ck4=["QA Agent","Code Reviewer"];OH=["triage","todo","in_progress","in_review","approved","merged","post_deploy_validation","done","archived"],R$={intake:"triage",queue:"todo",progress:"in_progress",review:"in_review",archive:"archived"},XD$=OH.map(($,Z)=>({key:$,title:$,position:Z})),nK0=["approved","merged","post_deploy_validation"]});function T81($){return $==="trial"?"trial":"subscription"}function O00($,Z,Q,Y={}){wY({event:Z,organizationId:Q.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:Q.id,...Y}})}function R81($){return $?.status==="active"||$?.status==="past_due"}function tK0($,Z){if(R81($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function L00(){let $=E0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function jj(){return{...L00(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function Qm($,Z,Q=L00()){if(!Q.enforced||!XQ(Z))return;let Y=await $.storage.organizationBilling.taskClaim(Z.id);if(Y&&Y.runCount>=Q.maxRunsPerTask)throw O00($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new kX("runs_exhausted");if(Y&&Y.state!=="released")return;let X=await $.storage.organizationBilling.getBilling(Z.organizationId),J=tK0(X,Q);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,J.periodKey)>=J.limit)throw O00($,"task_quota_blocked",Z,{phase:"precheck",reason:J.exhaustedReason,billing_mode:T81(J.periodKey),limit:J.limit}),new kX(J.exhaustedReason)}async function BD$($,Z,Q=L00()){if(!Q.enforced||!XQ(Z))return"skipped";let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),X=tK0(Y,Q),J=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,X.periodKey,X.limit,Q.maxRunsPerTask);if(J==="exhausted")throw O00($,"task_quota_blocked",Z,{phase:"claim",reason:X.exhaustedReason,billing_mode:T81(X.periodKey),limit:X.limit}),new kX(X.exhaustedReason);if(J==="runs_exhausted")throw O00($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new kX("runs_exhausted");if(J==="claimed")O00($,"task_quota_claimed",Z,{billing_mode:T81(X.periodKey),period_key:X.periodKey,limit:X.limit});return J}async function DD$($,Z,Q,Y){if(Y==="skipped")return;await $.rollbackTaskClaim(Z,Q,{releaseSlot:Y==="claimed"}).catch((X)=>console.error("[task-quota] rollback failed (stays charged)",X))}async function OD$($,Z){let Q=await $.storage.organizationBilling.taskClaim(Z);return!!Q&&Q.state!=="released"}async function LD$($,Z,Q){if(await $.releaseTaskClaim(Z,Q).catch((X)=>{return console.error("[task-quota] refund failed (stays charged)",X),!1}))wY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:Q}})}var xk4="[SUBSCRIPTION_REQUIRED]",fk4,kX;var IW=D(()=>{x4();G6();X$();fk4={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};kX=class kX extends Error{reason;constructor($){super(`${xk4} ${fk4[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as KD}from"zod";var q81;var wD$=D(()=>{k0();IW();q81=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:KD.object({}),outputSchema:KD.object({enforced:KD.boolean(),billingStatus:KD.string(),subscribed:KD.boolean(),hasBillingAccount:KD.boolean(),used:KD.number(),limit:KD.number(),currentPeriodEnd:KD.string().datetime().nullable()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=L00(),X=await Z.storage.organizationBilling.getBilling(Q.id),J=tK0(X,Y),G=await Z.storage.organizationBilling.countTaskClaims(Q.id,J.periodKey);return{enforced:Y.enforced,billingStatus:X?.status??"none",subscribed:R81(X),hasBillingAccount:!!X?.stripeCustomerId,used:G,limit:J.limit,currentPeriodEnd:X?.currentPeriodEnd?.toISOString()??null}}})});var jD$=D(()=>{DB$();OB$();LB$();wB$();jB$();AB$();TB$();qB$();MB$();VB$();SB$();CB$();vB$();gB$();hB$();uB$();lB$();cB$();mB$();$D$();ZD$();QD$();wD$()});function VW($){let Z=$?.status;return typeof Z==="number"?Z:null}function ED$($){let Z=$;if(Z?.isRateLimited!==!0)return;return typeof Z.retryAfterMs==="number"?Z.retryAfterMs:null}async function bJ($,Z){let Q=await $.getBranch(Z);if(Q)return Q.sha;throw new f0({provider:$.repo.provider,status:404,message:`Branch ${Z} does not exist in ${$.repo.path}`})}var s6;var w00=D(()=>{T5();s6=class s6 extends Error{constructor($,Z){super($,Z);this.name="RepoWriteConflict"}}});function Ym($){if($.length===0)return null;let Z=!1;for(let Q of $){if(Q.state!=="completed"){Z=!0;continue}if(Q.conclusion&&gk4.has(Q.conclusion))return"failing"}return Z?"pending":"passing"}var gk4,PA;var j00=D(()=>{gk4=new Set(["failure","cancelled","timed_out","action_required"]);PA=class PA extends Error{existing;constructor($,Z){super($);this.name="ChangeRequestExists",this.existing=Z}}});function Xm($){return hk4.test($.trim())}function lZ($,Z,Q){if($===void 0||!Number.isFinite($)||$<=0)return Math.min(Z,Q);return Math.min(Math.floor($),Q)}async function Jm($,Z){let Q=$.headers.get("content-length"),Y=Q===null?Number.NaN:Number(Q),X=Number.isFinite(Y)&&Y>=0?Y:null,J=$.body;if(!J)return{content:"",size:X??0,truncated:!1};let G=J.getReader(),W=[],K=0,H=!1;try{for(;;){let{done:U,value:N}=await G.read();if(U)break;if(!N)continue;let B=Z-K;if(N.byteLength>=B){W.push(N.subarray(0,B)),K+=B,H=N.byteLength>B||!(await G.read()).done;break}W.push(N),K+=N.byteLength}}finally{await G.cancel().catch(()=>{})}return{content:new TextDecoder().decode(uk4(W,K)),size:X??K,truncated:H||X!==null&&X>K}}function uk4($,Z){let Q=new Uint8Array(Z),Y=0;for(let X of $)Q.set(X,Y),Y+=X.byteLength;return Q}function Q3($){return $.split("/").map(encodeURIComponent).join("/")}function M81($){let Z=Number($);return Number.isInteger(Z)&&Z>1?Z:1}var Ej=400,HD=2000,zj=60000,FD=200000,Pj=50,Aj=50,LH=100,hk4;var Gm=D(()=>{hk4=/\[bot\]$|[-_.]bot$|^bot[-_.]|^(dependabot|renovate)$/i});var PU;var I81=D(()=>{PU={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});import{sql as E00}from"kysely";function zD$($){return $ instanceof Date?$.toISOString():String($)}function z00($){let Z=$.installation_id===null||$.installation_id===void 0?null:Number($.installation_id);return{id:$.id,organizationId:$.organization_id,type:$.type,host:$.host,authKind:$.auth_kind,externalAccountId:$.external_account_id,login:$.login,avatarUrl:$.avatar_url,installationId:Number.isFinite(Z)?Z:null,status:$.status,installationAuthorizedBy:$.installation_authorized_by??null,installationRepositoryIds:$.installation_repository_ids??null,credentialConnectionId:$.credential_connection_id,connectedBy:$.connected_by_name?{name:$.connected_by_name}:null,createdAt:zD$($.created_at),updatedAt:zD$($.updated_at)}}class AA{db;constructor($){this.db=$}async upsert($){let Z=new Date,Q=await this.db.insertInto("git_provider_accounts").values({organization_id:$.organizationId,type:$.type,host:$.host.toLowerCase(),auth_kind:$.authKind,external_account_id:$.externalAccountId,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",created_by:$.createdBy??null}).onConflict((Y)=>Y.columns(["organization_id","host","external_account_id"]).doUpdateSet({type:$.type,auth_kind:$.authKind,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",updated_at:E00`GREATEST(${Z}, git_provider_accounts.updated_at + interval '1 millisecond')`})).returningAll().executeTakeFirstOrThrow();return z00(Q)}async get($,Z){let Q=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?z00(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).executeTakeFirst();return Z?z00(Z):null}async listByOrg($){return(await this.db.selectFrom("git_provider_accounts").leftJoin("user as connector","connector.id","git_provider_accounts.created_by").selectAll("git_provider_accounts").select("connector.name as connected_by_name").where("git_provider_accounts.organization_id","=",$).orderBy("git_provider_accounts.created_at","asc").execute()).map(z00)}async findByExternalId($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("organization_id","=",$.organizationId).where("host","=",$.host.toLowerCase()).where("external_account_id","=",$.externalAccountId).executeTakeFirst();return Z?z00(Z):null}async setStatus($,Z,Q){await this.db.updateTable("git_provider_accounts").set({status:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).execute()}async grantRepository($,Z,Q){let Y=E00`jsonb_build_array(${Q}::bigint)`;await this.db.updateTable("git_provider_accounts").set({installation_repository_ids:E00`installation_repository_ids || ${Y}`,updated_at:E00`GREATEST(${new Date}, updated_at + interval '1 millisecond')`}).where("id","=",$).where("organization_id","=",Z).where("installation_repository_ids","is not",null).where(E00`NOT installation_repository_ids @> ${Y}`).execute()}async delete($,Z){return(await this.db.deleteFrom("git_provider_accounts").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}}var oK0=()=>{};class P00{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("git_provider_account_credentials").selectAll().where("account_id","=",$).executeTakeFirst();if(!Z)return null;return lk4(this.vault,Z)}async upsert($){let Z=new Date,Q=await this.vault.encrypt($.accessToken),Y=$.refreshToken?await this.vault.encrypt($.refreshToken):null,X=$.clientSecret?await this.vault.encrypt($.clientSecret):null;await this.db.insertInto("git_provider_account_credentials").values({account_id:$.connectionId,access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint}).onConflict((J)=>J.column("account_id").doUpdateSet({access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint,updated_at:Z})).execute()}async delete($){await this.db.deleteFrom("git_provider_account_credentials").where("account_id","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Y=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Y))return!0;return Y-Z<Date.now()}}async function lk4($,Z){try{let Q=await $.decrypt(Z.access_token),Y=Z.refresh_token?await $.decrypt(Z.refresh_token):null,X=Z.client_secret?await $.decrypt(Z.client_secret):null;return{id:Z.account_id,connectionId:Z.account_id,accessToken:Q,refreshToken:Y,scope:Z.scope,expiresAt:Z.expires_at,createdAt:Z.created_at,updatedAt:Z.updated_at,clientId:Z.client_id,clientSecret:X,tokenEndpoint:Z.token_endpoint}}catch(Q){return console.warn("[GitProviderAccountCredential] failed to decrypt credential row",{accountId:Z.account_id,message:Q instanceof Error?Q.message:String(Q)}),null}}import{sql as ck4}from"kysely";function PD$($){return $ instanceof Date?$.toISOString():String($)}function TA($){return{id:$.id,organizationId:$.organization_id,accountId:$.account_id,provider:$.provider,host:$.host,path:$.path,externalId:$.external_id,defaultBranch:$.default_branch,webUrl:$.web_url,visibility:$.visibility,sandboxImage:FU.catch("default").parse($.sandbox_image),legacyConnectionId:$.legacy_connection_id,createdAt:PD$($.created_at),updatedAt:PD$($.updated_at)}}function UD($){return{provider:$.provider,host:$.host,path:$.path}}class A00{db;constructor($){this.db=$}async upsert($){let Z=$.ref.host.toLowerCase(),Q=await this.findByRef($.organizationId,$.ref);if(Q){let X=await this.db.updateTable("repositories").set({path:$.ref.path,provider:$.ref.provider,web_url:kJ({...$.ref,host:Z}),...$.accountId!==void 0?{account_id:$.accountId}:{},...$.externalId!==void 0?{external_id:$.externalId}:{},...$.defaultBranch!==void 0?{default_branch:$.defaultBranch}:{},...$.visibility!==void 0?{visibility:$.visibility}:{},...$.sandboxImage!==void 0?{sandbox_image:$.sandboxImage}:{},...$.legacyConnectionId!==void 0?{legacy_connection_id:$.legacyConnectionId}:{},updated_at:new Date}).where("id","=",Q.id).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return TA(X)}let Y=await this.db.insertInto("repositories").values({organization_id:$.organizationId,account_id:$.accountId??null,provider:$.ref.provider,host:Z,path:$.ref.path,external_id:$.externalId??null,default_branch:$.defaultBranch??null,web_url:kJ({...$.ref,host:Z}),visibility:$.visibility??null,sandbox_image:$.sandboxImage??null,legacy_connection_id:$.legacyConnectionId??null,created_by:$.createdBy??null}).returningAll().executeTakeFirstOrThrow();return TA(Y)}async get($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?TA(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("repositories").selectAll().where("id","=",$).executeTakeFirst();return Z?TA(Z):null}async findByRef($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("organization_id","=",$).where("host","=",Z.host.toLowerCase()).where(ck4`lower(path)`,"=",Z.path.toLowerCase()).executeTakeFirst();return Q?TA(Q):null}async listByOrg($,Z){let Q=this.db.selectFrom("repositories").selectAll().where("organization_id","=",$);if(Z?.accountId)Q=Q.where("account_id","=",Z.accountId);return(await Q.orderBy("path","asc").execute()).map(TA)}async setSandboxImage($,Z,Q){let Y=await this.db.updateTable("repositories").set({sandbox_image:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).returningAll().executeTakeFirst();return Y?TA(Y):null}async delete($,Z){try{return(await this.db.deleteFrom("repositories").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}catch(Q){if(Q instanceof Error&&"constraint"in Q&&Q.constraint==="org_repo_sync_source_present")throw Error("Remove this repository's sync configurations before unlinking it");throw Q}}}var Wm=D(()=>{i4()});function TD$($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function mk4($,Z){let{owner:Q}=k5(Z),Y=TD$(Z.host),X=new RegExp(`(?:https?://(?:[^@\\s/]*@)?${Y}/|git@${Y}:)${TD$(Q)}/([A-Za-z0-9._-]+)`,"gi");return[...$.matchAll(X)].flatMap((J)=>J[1]?.replace(/\.git$/i,"")||[])}async function RD$($,Z){let{owner:Q,name:Y}=k5(Z),X=new Set,J=[Z.path];while(J.length>0&&X.size<AD$){let G=J.shift();if(!G)break;let W=await $(G,"pubspec.yaml").catch(()=>null);if(!W)continue;for(let K of mk4(W,Z)){if(K===Y||X.has(K))continue;if(X.size>=AD$)break;X.add(K),J.push(`${Q}/${K}`)}}return[...X]}var AD$=20;var qD$=D(()=>{i4()});function ID$($){return Bun.hash($).toString(36)}function dk4($){for(let[Z,Q]of Tj)if(Q.expiresAt<=$)Tj.delete(Z);while(Tj.size>=512){let Z=Tj.keys().next();if(Z.done)break;Tj.delete(Z.value)}}function k81($,Z,Q,Y=Date.now()){dk4(Y),Tj.set(ID$($),{owner:Z,expiresAt:Q})}function Km($,Z=Date.now()){let Q=ID$($),Y=Tj.get(Q);if(!Y)return"unknown";if(Y.expiresAt<=Z)return Tj.delete(Q),"unknown";return Y.owner}var MD$="app",V81="user",Tj;var Hm=D(()=>{Tj=new Map});function Rj($=process.env){let Z=$.GITHUB_APP_ID?.trim(),Q=$.GITHUB_APP_PRIVATE_KEY?.trim(),Y=$.GITHUB_APP_CLIENT_ID?.trim(),X=$.GITHUB_APP_CLIENT_SECRET?.trim(),J=$.GITHUB_APP_SLUG?.trim();if(!Z||!Q||!Y||!X||!J)return null;return{appId:Z,privateKeyPem:Q.replace(/\\n/g,`
+    `.execute(Z.db);let J=X?.metadata?.siteUrl;if(typeof J==="string")ic({siteUrl:J,orgId:$.id,cause:"organization_deleted"});return{success:!0,id:$.id}}})});import{z as G$}from"zod";function jZ($,Z){let Q=$?.[Z];return $k4.has(Z)?Q!==!1:Q===!0}function PB$($){let Z=$?.auto_resolve_conflicts;return typeof Z==="boolean"?Z:$?.auto_merge===!0}var QD=500,G00,ZD,EB$,Hj,W00,K00,zB$=50,eV4,H00,F00,EA,$k4,hK0=262144,Zk4=50,$3=500,Qk4=5000,Fj;var t9=D(()=>{G00=G$.object({title:G$.string().max(QD),url:G$.string().max(QD),icon:G$.string().max(QD)}),ZD=G$.object({keyId:G$.string().max(QD),modelId:G$.string().max(QD),title:G$.string().max(QD).optional()}).nullable(),EB$=G$.enum(["fast","smart","thinking","image","web_search","deep_research"]),Hj=G$.enum(["fast","smart","thinking"]),W00=G$.object({tiers:G$.object({fast:ZD,smart:ZD,thinking:ZD,image:ZD,web_search:ZD,deep_research:ZD})}),K00=G$.object({tiers:G$.object({fast:ZD.optional(),smart:ZD.optional(),thinking:ZD.optional()})}),eV4=/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/,H00=G$.object({host:G$.string().min(1).max(QD).regex(eV4).describe("Git host, e.g. 'github.com' (bare hostname, no scheme)."),secretId:G$.string().min(1).max(QD).describe("Vault secret id holding the PAT used to authenticate this host.")}),F00=G$.object({ids:G$.array(G$.string().max(QD)).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),EA=G$.object({voice_mode:G$.boolean().optional(),home_task_intake_enabled:G$.boolean().optional().describe("Show Task mode on the Home composer and allow reports to start tasks."),demo_mode:G$.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:G$.boolean().optional().describe("Curated Deco Score look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),reviewer_enabled:G$.boolean().optional().describe("Run the Reviewer on a task's pull request once it's In Review \u2014 it reviews the code with the repo's stack-appropriate skills, fixes what it finds on the PR's own branch, then exercises the change on the deploy preview and approves or hands the card to a human."),qa_agent_enabled:G$.boolean().optional().describe("Deprecated: see reviewer_enabled."),code_reviewer_enabled:G$.boolean().optional().describe("Deprecated: see reviewer_enabled."),auto_merge:G$.boolean().optional().describe("When the Reviewer approves a task's pull request, merge it automatically instead of leaving the merge to a human."),auto_resolve_conflicts:G$.boolean().optional().describe("When an approved pull request can't be merged because it conflicts with its base branch, hand it back to the Super Agent to resolve the conflict (check out the branch, merge the base, push). Unset, it follows `auto_merge`; set it explicitly to run one without the other."),cheap_reviewer_model:G$.boolean().optional().describe("Run the Reviewer on a cheaper model than the Super Agent that wrote the code. On by default \u2014 turning it off trades cost for some review depth."),coding_agent_org_mcps:G$.boolean().optional().describe("Give a coding-agent run (the claude-code harness in a sandbox) every MCP connection in the org as its own MCP server, on top of the narrow task-run surface it always gets. Off by default: each connection is one more server the agent connects to at session start, and all of their tools land in its context."),coding_agents_claude_code:G$.boolean().optional().describe("Run chats on a Code Agent (an agent imported from a GitHub repo) with the claude-code harness inside its sandbox, instead of hosted Decopilot. Off by default: it changes the runtime of every such chat, and claude-code flushes whole turns rather than streaming tokens."),auto_assign_report_tasks_to_super_agent:G$.boolean().optional().describe("When a Deco Score import creates a task board item without an assignee, delegate it to the Super Agent automatically instead of leaving it unassigned."),hosting_enabled:G$.boolean().optional().describe("Per-site Hosting tab (deployments, domains, deploy outcomes). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),deco_analytics_enabled:G$.boolean().optional().describe("Per-site Deco Analytics tab (traffic, realtime, usage & limits). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),e2e_enabled:G$.boolean().optional().describe("Per-site E2E tab (end-to-end test runs). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. `HOSTING_CONTROL_PLANE_GA` opens it (and its peers) to every org at once."),experiments_enabled:G$.boolean().optional().describe("Per-site Experiments tab (A/B tests + variant results). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org."),monitor_enabled:G$.boolean().optional().describe("Per-site Monitor tab (CDN Performance + Audience from the stats-lake warehouse). Off by default. deco.cx staff and local dev always see it; this flag is the per-client lever to open it to one external org. Its own deployment-wide switch `MONITOR_GA` opens it to every org at once (independent of the control-plane trio)."),site_create_enabled:G$.boolean().optional().describe('The "Create a new site" option under New project: generates a GitHub repository from a site template in an account the org connected, and opens it as a project. Off by default, for every org \u2014 deco.cx staff included.'),delivery_lanes_enabled:G$.boolean().optional().describe("Board lanes for shipping: Approved, Merged and Post-deploy Validation sit between In Review and Done, and a merged pull request lands on Merged instead of Done. For teams whose release process continues after the merge. Off by default \u2014 with it off the board and the state machine behave exactly as if the lanes did not exist."),new_blocks_editor:G$.boolean().optional().describe("Use the redesigned blocks editor for every member of the organization. Off by default \u2014 the classic editor stays until an admin opts the org in.")}),$k4=new Set(["reviewer_enabled","cheap_reviewer_model"]);Fj=G$.object({id:G$.string().describe("Brand context ID"),name:G$.string().max($3).describe("Company name"),domain:G$.string().max($3).describe("Company domain (e.g. example.com)"),overview:G$.string().max(Qk4).describe("Company overview / description"),logo:G$.string().max($3).nullable().optional().describe("Logo URL"),favicon:G$.string().max($3).nullable().optional().describe("Favicon URL"),ogImage:G$.string().max($3).nullable().optional().describe("OG image URL"),fonts:G$.object({heading:G$.string().max($3).optional().describe("Font family for headings"),body:G$.string().max($3).optional().describe("Font family for body text"),code:G$.string().max($3).optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:G$.object({primary:G$.string().max($3).optional().describe("Primary brand color (hex)"),secondary:G$.string().max($3).optional().describe("Secondary brand color (hex)"),accent:G$.string().max($3).optional().describe("Accent / highlight color (hex)"),background:G$.string().max($3).optional().describe("Background color (hex)"),foreground:G$.string().max($3).optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:G$.array(G$.record(G$.string(),G$.unknown())).max(Zk4).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=hK0,{message:`images must serialize to at most ${hK0} bytes`}).describe("Brand images"),metadata:G$.record(G$.string(),G$.unknown()).nullable().optional().refine(($)=>$===null||$===void 0||JSON.stringify($).length<=hK0,{message:`metadata must serialize to at most ${hK0} bytes`}).describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:G$.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:G$.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as YD}from"zod";var l$1;var AB$=D(()=>{k0();t9();l$1=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:YD.object({}),outputSchema:YD.object({organizationId:YD.string(),sidebar_items:YD.array(G00).nullable().optional(),coding_agent_mcp_excluded:YD.array(YD.string()).nullable().optional(),simple_mode:W00.nullable().optional(),default_home_agents:F00.nullable().optional(),flags:EA.nullable().optional(),submodule_credentials:YD.array(H00).nullable().optional(),createdAt:YD.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:YD.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.organizationSettings.get(Q);if(!Y)return{organizationId:Q};return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as c$1}from"zod";var m$1;var TB$=D(()=>{k0();m$1=c({name:"ORGANIZATION_HAS_SITE",description:"Whether this organization owns at least one legacy deco.cx site. Boolean only \u2014 does not expose site slugs.",annotations:{title:"Has Owned Site",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:c$1.object({}),outputSchema:c$1.object({hasSite:c$1.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{hasSite:(await Z.storage.orgSites.listByOrg(Q.id)).length>0}}})});import{z as kY}from"zod";var Yk4=50,Xk4=100,Jk4=500,RB$=500,d$1;var qB$=D(()=>{k0();t9();d$1=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:kY.object({organizationId:kY.string().min(1,"organizationId is required"),sidebar_items:kY.array(G00).max(Yk4).optional(),coding_agent_mcp_excluded:kY.array(kY.string().max(RB$)).max(Jk4).optional().describe("Connection ids a coding-agent run must not mount, even with `coding_agent_org_mcps` on. Replaces the stored list; pass [] to clear it."),simple_mode:W00.optional(),default_home_agents:F00.extend({ids:kY.array(kY.string().max(RB$)).max(Xk4)}).optional(),flags:EA.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),submodule_credentials:kY.array(H00).max(zB$).refine(($)=>new Set($.map((Z)=>Z.host)).size===$.length,"Each git credential host must be unique.").optional().describe("Per-host PATs (as vault secret ids) every sandbox in the org installs in its git config. Replaces the stored list; pass [] to clear it.")}),outputSchema:kY.object({organizationId:kY.string(),sidebar_items:kY.array(G00).nullable().optional(),coding_agent_mcp_excluded:kY.array(kY.string()).nullable().optional(),simple_mode:W00.nullable().optional(),default_home_agents:F00.nullable().optional(),flags:EA.nullable().optional(),submodule_credentials:kY.array(H00).nullable().optional(),createdAt:kY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:kY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(n(Z),await Z.access.check(),J0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Y=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,coding_agent_mcp_excluded:$.coding_agent_mcp_excluded,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,submodule_credentials:$.submodule_credentials});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as uK0}from"zod";var i$1;var MB$=D(()=>{t9();k0();i$1=c({name:"ORGANIZATION_BLOCKS_EDITOR_SET",description:"Turn the redesigned blocks editor on or off for every member of the organization.",annotations:{title:"Set Blocks Editor",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:uK0.object({enabled:uK0.boolean().describe("Whether the org uses the new blocks editor.")}),outputSchema:uK0.object({enabled:uK0.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationSettings.upsert(Q.id,{flags:{new_blocks_editor:$.enabled}});return{enabled:jZ(Y.flags,"new_blocks_editor")}}})});import{z as BH}from"zod";var IB$,p$1,n$1;var VB$=D(()=>{k0();t9();IB$=Fj.extend({organizationId:BH.string(),archivedAt:BH.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:BH.string().describe("ISO 8601 timestamp"),updatedAt:BH.string().describe("ISO 8601 timestamp")}),p$1=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BH.object({includeArchived:BH.boolean().optional().describe("Include archived brands in the list")}),outputSchema:BH.object({items:BH.array(IB$)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q,{includeArchived:$.includeArchived})).map((X)=>({...X,archivedAt:X.archivedAt instanceof Date?X.archivedAt.toISOString():X.archivedAt,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,updatedAt:X.updatedAt instanceof Date?X.updatedAt.toISOString():X.updatedAt}))}}}),n$1=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BH.object({id:BH.string().describe("Brand context ID")}),outputSchema:IB$.extend({organizationId:BH.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.get($.id,Q);if(!Y)throw Error("Brand context not found");return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}})});import{z as zA}from"zod";var kB$,t$1,o$1,r$1;var SB$=D(()=>{k0();t9();kB$=Fj.extend({organizationId:zA.string(),createdAt:zA.string().describe("ISO 8601 timestamp"),updatedAt:zA.string().describe("ISO 8601 timestamp")}),t$1=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:Fj.omit({id:!0}),outputSchema:kB$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=await Z.storage.brandContext.create(Q,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}}}),o$1=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Fj.partial().required({id:!0}),outputSchema:kB$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");let{id:X,...J}=$;if(J.isDefault===!0)await Z.storage.brandContext.setDefault(X,Q);let G=await Z.storage.brandContext.update(X,Q,{name:J.name,domain:J.domain,overview:J.overview,logo:J.logo!==void 0?J.logo??null:void 0,favicon:J.favicon!==void 0?J.favicon??null:void 0,ogImage:J.ogImage!==void 0?J.ogImage??null:void 0,fonts:J.fonts!==void 0?J.fonts??null:void 0,colors:J.colors!==void 0?J.colors??null:void 0,images:J.images!==void 0?J.images??null:void 0,metadata:J.metadata!==void 0?J.metadata??null:void 0,archivedAt:J.archivedAt!==void 0?J.archivedAt??null:void 0,isDefault:J.isDefault===!1?!1:void 0});return{...G,archivedAt:G.archivedAt instanceof Date?G.archivedAt.toISOString():G.archivedAt,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt,updatedAt:G.updatedAt instanceof Date?G.updatedAt.toISOString():G.updatedAt}}}),r$1=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:zA.object({id:zA.string().describe("Brand context ID")}),outputSchema:zA.object({success:zA.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,Q))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,Q,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function lK0($,Z,Q){let Y=$.trim();if(!Y.startsWith("http"))Y=`https://${Y}`;let X=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Y,formats:["branding"]})});if(!X.ok){let N=await X.text().catch(()=>"");throw Error(`Firecrawl API error: ${X.status} ${N.slice(0,200)}`)}let J=await X.json();if(!J.success||!J.data?.branding)return null;let G=J.data.branding,W=J.data.metadata??{},K=Kk4(G,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??W.ogSiteName??Q??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function Kk4($,Z){let Q=$.images??{},Y=$.colors??{},X={};for(let[F,U]of Object.entries(Y))if(typeof U==="string"&&U&&Gk4.has(F))X[F]=U;let J={},W=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(W))if(typeof U==="string"&&U){let N=Wk4[F.toLowerCase()];if(N&&!J[N])J[N]=U}let K=$.fonts;if(Array.isArray(K))for(let F of K){let U=F.family;if(typeof U==="string"&&U&&!J.body)J.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:Q.logo??null,favicon:Q.favicon??null,ogImage:Q.ogImage??Z.ogImage??null,fonts:Object.keys(J).length>0?J:null,colors:Object.keys(X).length>0?X:null,metadata:H}}var Gk4,Wk4;var s$1=D(()=>{Gk4=new Set(["primary","secondary","accent","background","foreground"]),Wk4={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as cK0}from"zod";var Hk4,a$1;var CB$=D(()=>{k0();s$1();t9();Hk4=Fj.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:cK0.boolean()}),a$1=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:cK0.object({domain:cK0.string().describe("Website domain to extract brand from"),brandId:cK0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Hk4,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=Z.firecrawlApiKey;if(!Y)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let X=await lK0($.domain,Y,$.domain);if(!X)throw Error("Firecrawl did not return branding data for this URL");let J={name:X.name,domain:X.domain,overview:X.overview,logo:X.logo,favicon:X.favicon,ogImage:X.ogImage,fonts:X.fonts,colors:X.colors,images:X.images,metadata:X.metadata},G=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,Q))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,Q,J)})():await Z.storage.brandContext.create(Q,J);return{id:G.id,name:G.name,domain:G.domain,overview:G.overview,logo:G.logo,favicon:G.favicon,ogImage:G.ogImage,fonts:G.fonts,colors:G.colors,success:!0}}})});function _B$($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let Q=Object.fromEntries(Object.entries(Z).filter(([Y])=>Y!=="tagline"&&Y!=="tone"));return Object.keys(Q).length>0?Q:void 0})()}}var e$1,$81;var vB$=D(()=>{s11();k0();e$1=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:BK0,outputSchema:ne,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");let Y=$.id?await Z.storage.brandContext.get($.id,Q):await Z.storage.brandContext.getDefault(Q);if(!Y)throw Error($.id?"Brand not found":"No default brand configured");return _B$(Y)}}),$81=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:DK0,outputSchema:OK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(Q)).map(_B$)}}})});import{resolveTxt as Fk4}from"dns/promises";function Z81($){return`${Uk4}.${$.toLowerCase()}`}function bB$(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xB$($,Z,Q=Fk4){if(!Z)return!1;try{return(await Q(Z81($))).some((X)=>X.join("").trim()===Z)}catch{return!1}}var Uk4="_deco-verify";var fB$=()=>{};import{z as b9}from"zod";function Uj($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?Z81($.domain):null,recordValue:Z?$.verificationToken:null}}function Bk4($){let Z=$.toLowerCase().trim();if(!Nk4.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(DH.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var Nk4,yB$=50,Q81,mK0,Y81,X81,J81,G81,W81;var gB$=D(()=>{Z3();fB$();k0();Nk4=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,Q81=b9.enum(["off","auto","request"]),mK0=b9.object({id:b9.string(),domain:b9.string(),joinMode:Q81,verificationStatus:b9.enum(["pending","verified"]),verificationMethod:b9.enum(["email","dns"]).nullable(),verifiedAt:b9.string().nullable(),recordName:b9.string().nullable(),recordValue:b9.string().nullable()});Y81=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({}),outputSchema:b9.object({domains:b9.array(mK0)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(Q.id)).map(Uj)}}}),X81=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({domain:b9.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:Q81.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:mK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=Bk4($.domain),J=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),G=Boolean(Z.auth.user?.emailVerified)&&J===Y,W=await Z.storage.organizationDomains.getByOrgAndDomain(Q.id,Y);if(W){if(W.verificationStatus!=="verified"&&G){let F=await Z.storage.organizationDomains.markVerified(W.id,"email");return Uj(F)}return Uj(W)}if((await Z.storage.organizationDomains.listByOrganizationId(Q.id)).length>=yB$)throw Error(`An organization can claim at most ${yB$} domains.`);let H=G?await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(Q.id,Y,{joinMode:"off",verificationStatus:"pending",verificationToken:bB$()});return Uj(H)}}),J81=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({id:b9.string(),joinMode:Q81}),outputSchema:mK0,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if($.joinMode!=="off"&&Y.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let X=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return Uj(X)}}),G81=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:b9.object({id:b9.string()}),outputSchema:b9.object({verified:b9.boolean(),domain:mK0}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");if(Y.verificationStatus==="verified")return{verified:!0,domain:Uj(Y)};if(!Y.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xB$(Y.domain,Y.verificationToken))return{verified:!1,domain:Uj(Y)};let J=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:Uj(J)}}}),W81=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:b9.object({id:b9.string()}),outputSchema:b9.object({success:b9.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationDomains.getById($.id);if(!Y||Y.organizationId!==Q.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function Nj($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as hZ}from"zod";var Dk4,K81,H81,F81;var hB$=D(()=>{k0();G6();Dk4=hZ.object({id:hZ.string(),userId:hZ.string(),status:hZ.enum(["pending","approved","denied"]),createdAt:hZ.string(),user:hZ.object({id:hZ.string(),name:hZ.string(),email:hZ.string(),image:hZ.string().nullable()}).nullable()}),K81=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({}),outputSchema:hZ.object({requests:hZ.array(Dk4)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(Q.id)).map((X)=>({id:X.id,userId:X.userId,status:X.status,createdAt:new Date(X.createdAt).toISOString(),user:X.user}))}}}),H81=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({requestId:hZ.string()}),outputSchema:hZ.object({success:hZ.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=p0(Z);if(!await Z.storage.organizationJoinRequests.decide(Y.id,"approved",X??Y.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:Q.id,userId:Y.userId,role:["user"]})}catch(G){if(!Nj(G))throw G}if(X)f1.capture({distinctId:X,event:"organization_join_request_approved",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}}),F81=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:hZ.object({requestId:hZ.string()}),outputSchema:hZ.object({success:hZ.boolean()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Y||Y.organizationId!==Q.id)throw Error("Join request not found");if(Y.status!=="pending")throw Error("Join request has already been decided");let X=p0(Z);if(await Z.storage.organizationJoinRequests.decide(Y.id,"denied",X??Y.userId)&&X)f1.capture({distinctId:X,event:"organization_join_request_denied",groups:{organization:Q.id},properties:{organization_id:Q.id,user_id:Y.userId}});return{success:!0}}})});import{z as vJ}from"zod";var U81;var uB$=D(()=>{G6();k0();DY();U81=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:vJ.object({organizationId:vJ.string().optional(),userId:vJ.string(),role:vJ.array(vJ.string())}),outputSchema:vJ.object({id:vJ.string(),organizationId:vJ.string(),userId:vJ.string(),role:vJ.union([vJ.string(),vJ.array(vJ.string())]),createdAt:vJ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",p0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!qX0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let X=await Z.boundAuth.organization.addMember({organizationId:Q,userId:$.userId,role:$.role});if(!X)throw Error("Failed to add member");let J=p0(Z);if(J)f1.capture({distinctId:J,event:"organization_member_added",groups:{organization:Q},properties:{organization_id:Q,added_user_id:$.userId,role:$.role}});return{...X,role:X.role,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});import{z as Zm}from"zod";var N81;var lB$=D(()=>{G6();k0();N81=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zm.object({organizationId:Zm.string().optional(),memberIdOrEmail:Zm.string()}),outputSchema:Zm.object({success:Zm.boolean(),memberIdOrEmail:Zm.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.boundAuth.organization.removeMember({organizationId:Q,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Y.member.userId,Q);let X=p0(Z);if(X)f1.capture({distinctId:X,event:"organization_member_removed",groups:{organization:Q},properties:{organization_id:Q,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as SY}from"zod";var B81;var cB$=D(()=>{k0();B81=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SY.object({limit:SY.number().int().min(1).max(1000).optional(),offset:SY.number().int().min(0).optional()}),outputSchema:SY.object({members:SY.array(SY.object({id:SY.string(),organizationId:SY.string(),userId:SY.string(),role:SY.string(),createdAt:SY.string().datetime().describe("ISO 8601 timestamp"),user:SY.object({id:SY.string(),name:SY.string(),email:SY.string(),image:SY.string().optional()}).optional()}))}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{members:(await Z.db.selectFrom("member").innerJoin("user","user.id","member.userId").select(["member.id as id","member.organizationId as organizationId","member.userId as userId","member.role as role","member.createdAt as createdAt","user.name as name","user.email as email","user.image as image"]).where("member.organizationId","=",Q).orderBy("member.createdAt","asc").orderBy("member.id","asc").limit($.limit??100).offset($.offset??0).execute()).map((J)=>({id:J.id,organizationId:J.organizationId,userId:J.userId,role:J.role,createdAt:new Date(J.createdAt).toISOString(),user:{id:J.userId,name:J.name,email:J.email,image:J.image??void 0}}))}}})});import{z as YQ}from"zod";var D81;var mB$=D(()=>{G6();k0();DY();D81=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:YQ.object({organizationId:YQ.string().optional(),memberId:YQ.string(),role:YQ.array(YQ.string())}),outputSchema:YQ.object({id:YQ.string(),organizationId:YQ.string(),userId:YQ.string(),role:YQ.union([YQ.string(),YQ.array(YQ.string())]),createdAt:YQ.string().datetime().describe("ISO 8601 timestamp"),user:YQ.object({email:YQ.string(),name:YQ.string(),image:YQ.string().optional()})}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=$.organizationId||Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");if(Q!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Y=await Z.db.selectFrom("member").select(["role"]).where("userId","=",p0(Z)??"").where("organizationId","=",Q).executeTakeFirst();if(!qX0(Y?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);if(!$.role.includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("id","=",$.memberId).where("organizationId","=",Q).executeTakeFirst())?.role.split(",").includes("owner")){if((await Z.db.selectFrom("member").select(["role"]).where("organizationId","=",Q).execute()).filter((H)=>H.role.split(",").includes("owner")).length<=1)throw Error("Cannot remove the organization's last owner. Assign another owner first.")}}let X=await Z.boundAuth.organization.updateMemberRole({organizationId:Q,memberId:$.memberId,role:$.role});if(!X)throw Error("Failed to update member role");Z.invalidateMemberRole?.(X.userId,Q);let J=p0(Z);if(J)f1.capture({distinctId:J,event:"organization_member_role_updated",groups:{organization:Q},properties:{organization_id:Q,member_id:$.memberId,target_user_id:X.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...X,createdAt:X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt}}})});async function dB$(){if(U00&&Date.now()-U00.fetchedAt<600000)return U00.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),Q=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(Q)||Q<=0)throw Error("Invalid rate");return U00={rate:Q,fetchedAt:Date.now()},Q}catch{return U00?.rate??5.5}}function iB$($,Z,Q){if(Z==="brl")return Math.round($/Q);return $}var U00=null;function O81($,Z="",Q=new URLSearchParams){for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;let J=Z?`${Z}[${Y}]`:Y;if(Array.isArray(X))X.forEach((G,W)=>{if(typeof G==="object"&&G!==null)O81(G,`${J}[${W}]`,Q);else Q.append(`${J}[${W}]`,String(G))});else if(typeof X==="object")O81(X,J,Q);else Q.append(J,String(X))}return Q}async function XD($,Z){let Q=E0().stripeSecretKey;if(!Q)throw new uZ(503,"billing is not configured");let Y=Z?.params?O81(Z.params).toString():void 0,X=await fetch(`${Ok4}${$}`,{method:Z?.method??(Y?"POST":"GET"),headers:{Authorization:`Bearer ${Q}`,...Y&&{"Content-Type":"application/x-www-form-urlencoded"},...Z?.idempotencyKey&&{"Idempotency-Key":Z.idempotencyKey}},body:Y,signal:AbortSignal.timeout(Lk4)}),J=await X.json().catch(()=>({}));if(!X.ok){let G=J.error?.message??`HTTP ${X.status}`;throw new uZ(X.status,G)}return J}function pB$($){return{billing_address_collection:"required",custom_fields:[{key:wk4,label:{type:"custom",custom:"CPF / CNPJ"},type:"text",optional:!1,text:{minimum_length:jk4,maximum_length:Ek4}}],...$&&{customer_update:{address:"auto",name:"auto"}}}}function nB$($){return Boolean((E0().stripePlanPriceIds??{})[$])}function L81($){let Z=E0().stripePlanPriceIds??{};return Object.entries(Z).find(([,Q])=>Q===$)?.[0]}function zk4($){return["checkout",$.organizationId,$.planId??"flat",$.lastStripeEventAt?.getTime()??0].join(":")}async function tB$($){let Z=E0(),Q=$.planId?L81($.planId):Z.stripeOrgPriceId;if(!Q)throw new uZ(503,$.planId?`plan '${$.planId}' has no Stripe price configured`:"billing is not configured");let Y=await XD("/checkout/sessions",{idempotencyKey:zk4({organizationId:$.organizationId,...$.planId?{planId:$.planId}:{},...$.lastStripeEventAt!==void 0&&{lastStripeEventAt:$.lastStripeEventAt}}),params:{mode:"subscription",...pB$(null),line_items:[{price:Q,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}},subscription_data:{billing_cycle_anchor_config:{day_of_month:1,hour:0,minute:0,second:0},metadata:{orgId:$.organizationId,...$.planId?{planId:$.planId}:{}}}}});if(!Y.url)throw new uZ(500,"checkout session lacks url");return{url:Y.url}}function Pk4($,Z){return Math.round($*(1+Z/100))}function Tk4($){let Z=Math.floor(($.nowMs??Date.now())/Ak4);return["topup",$.organizationId,$.currency,$.amountCents,Z].join(":")}async function oB$($){let Z=Pk4($.amountCents,$.feePercent),Q=iB$($.amountCents,$.currency,await dB$()),Y=E0().stripeTopupProductId,X={kind:"topup",orgId:$.organizationId,creditCents:Q},J=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,G=await XD("/checkout/sessions",{idempotencyKey:Tk4({organizationId:$.organizationId,amountCents:$.amountCents,currency:$.currency}),params:{mode:"payment",...$.customerId&&{customer:$.customerId},...pB$($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Y?{product:Y}:{product_data:{name:J}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:X,payment_intent_data:{metadata:X}}});if(!G.url)throw new uZ(500,"checkout session lacks url");return{url:G.url}}async function dK0($){let Z=await XD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new uZ(500,"portal session lacks url");return{url:Z.url}}async function rB$($){let Z=await XD("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl,...E0().stripePortalConfigurationId&&{configuration:E0().stripePortalConfigurationId},flow_data:{type:"subscription_update_confirm",subscription_update_confirm:{subscription:$.subscriptionId,items:[{id:$.subscriptionItemId,price:$.priceId}]},after_completion:{type:"redirect",redirect:{return_url:$.returnUrl}}}}});if(!Z.url)throw new uZ(500,"portal session lacks url");return{url:Z.url}}async function sB$($){return XD(`/prices/${encodeURIComponent($)}`)}async function Bj($){return XD(`/subscriptions/${encodeURIComponent($)}`)}async function aB$($){await XD(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}async function eB$($){let Z=await XD(`/invoices?subscription=${encodeURIComponent($)}&status=paid&limit=100`),Q=Rk4($,Z.data??[]);for(let Y of Q)await XD("/refunds",{params:{payment_intent:Y.paymentIntent,reason:"duplicate"},idempotencyKey:Y.idempotencyKey});return{refundedCents:Q.reduce((Y,X)=>Y+X.amountCents,0)}}function Rk4($,Z){let Q=[];for(let Y of Z){let X=Y.amount_paid??0;if(X<=0)continue;let J=typeof Y.payment_intent==="string"?Y.payment_intent:Y.payment_intent?.id;if(!J)continue;Q.push({paymentIntent:J,amountCents:X,idempotencyKey:`orphan-refund:${$}:${Y.id??J}`})}return Q}var Ok4="https://api.stripe.com/v1",uZ,Lk4=15000,wk4="taxid",jk4=11,Ek4=18,Ak4=120000;var JD=D(()=>{X$();uZ=class uZ extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as iK0}from"zod";async function qk4($){if(!$.planId)throw Error("This organization already has an active subscription.");let Z=L81($.planId);if(!Z)throw new uZ(503,`plan '${$.planId}' has no Stripe price configured`);let Q=await Bj($.subscriptionId),Y=(Q.items?.data??[]).filter((G)=>G.price?.id?nB$(G.price.id):!1),X=Y[0];if(Y.length>1)throw Error("This organization's subscription has more than one plan line \u2014 change it in Stripe, not here.");if(!X?.id)throw new uZ(500,"subscription has no plan line to move to another price");if(X.price?.id===Z)throw Error("This organization is already on that plan.");let{url:J}=await rB$({customerId:Q.customer,subscriptionId:$.subscriptionId,subscriptionItemId:X.id,priceId:Z,returnUrl:$.returnUrl});return J}var w81;var $D$=D(()=>{JD();I9();k0();G6();w81=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:iK0.object({planId:iK0.string().optional()}),outputSchema:iK0.object({url:iK0.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id,Y=Z.organization?.slug;if(!Q||!Y)throw Error("Organization context required");let X=await Z.storage.organizationBilling.getBilling(Q),J=`${m5()}${Yj(Y,"members")}`;if(X?.status==="active"&&X.stripeSubscriptionId){let W=await qk4({subscriptionId:X.stripeSubscriptionId,planId:$.planId,returnUrl:`${J}?checkout=updated`});return wY({event:"subscription_plan_change_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:W}}if(X?.status==="active")throw Error("This organization already has an active subscription.");if(X?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let{url:G}=await tB$({organizationId:Q,successUrl:`${J}?checkout=success`,cancelUrl:`${J}?checkout=canceled`,...$.planId?{planId:$.planId}:{},lastStripeEventAt:X?.lastStripeEventAt??null});return wY({event:"subscription_checkout_started",organizationId:Q,...$.planId?{properties:{plan_id:$.planId}}:{},...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:G}}})});import{z as Dj}from"zod";async function kk4(){if(N00&&Date.now()-N00.at<N00.ttlMs)return N00.prices;let $=new Set,Z=Object.entries(E0().stripePlanPriceIds??{}).filter(([,J])=>{if($.has(J))return!1;return $.add(J),!0}),Y=(await Promise.all(Z.map(async([J,G])=>{try{let W=await sB$(J);if(W.unit_amount===null)return null;return{planId:G,amountCents:W.unit_amount,currency:W.currency,interval:W.recurring?.interval??null}}catch(W){return console.warn(`plan price ${J} (${G}) unreadable:`,W instanceof uZ?W.message:W),null}}))).filter((J)=>J!==null),X=Y.length===Z.length;return N00={at:Date.now(),prices:Y,ttlMs:X?Ik4:Vk4},Y}var Mk4,Ik4=600000,Vk4=30000,N00=null,j81;var ZD$=D(()=>{JD();k0();X$();Mk4=Dj.object({planId:Dj.string(),amountCents:Dj.number(),currency:Dj.string(),interval:Dj.string().nullable()});j81=c({name:"ORGANIZATION_BILLING_PLAN_PRICES",description:"The monthly price of each purchasable plan, read from Stripe. Empty when no plan prices are configured.",annotations:{title:"Plan Prices",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Dj.object({}),outputSchema:Dj.object({prices:Dj.array(Mk4)}),handler:async($,Z)=>{return n(Z),await Z.access.check(),{prices:await kk4()}}})});import{z as E81}from"zod";var z81;var QD$=D(()=>{JD();I9();k0();z81=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:E81.object({}),outputSchema:E81.object({url:E81.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z);if(!Q.slug)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(Q.id);if(!Y?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await dK0({customerId:Y.stripeCustomerId,returnUrl:`${m5()}${Yj(Q.slug,"members")}`})}catch(X){if(X instanceof uZ)throw Error(X.message);throw X}}})});function pK0($){return P81[$%P81.length]??Sk4}function XQ($){return $.createdBy==="system"}function _k4($){if($?.reviewer_enabled===void 0&&$?.qa_agent_enabled===!1&&$?.code_reviewer_enabled===!1)return!1;return jZ($,"reviewer_enabled")}function GD($){return _k4($)?MW:[]}function vk4($){return jZ($,"delivery_lanes_enabled")}function zU($){return vk4($)?"merged":"done"}function Lj($,Z){if(!$)return!1;return[EU[Z],...Ck4].some((Q)=>$.startsWith(`${Q}:`))}function WD($,Z){if(Z)return new Date(Z).getTime();let Q=0;for(let Y of $){if(Y.action!=="status_changed")continue;if(Y.data?.to!=="in_review")continue;Q=Math.max(Q,new Date(Y.occurredAt).getTime())}return Q}function JD$($,Z,Q){let X=$.filter((J)=>J.action==="status_changed").at(-1);if(!X)return Q;return X.data?.to===Z?X.occurredAt:null}function wj($,Z){let Q=WD($,Z.cycleStartedAt),Y=new Map;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;if(new Date(X.occurredAt).getTime()<Q)continue;let J=X.data??{};if(J.reviewer!=="reviewer")continue;if(X.action==="review_approved"){if(Z?.verifiedOnly&&J.verified!==!0)continue;Y.set("reviewer","approved")}else Y.set("reviewer","changes_requested")}return Y}function Oj($,Z,Q){if(Z.length===0)return!1;let Y=wj($,Q);return Z.every((X)=>Y.get(X)==="approved")}function GD$($,Z,Q){return Oj($,Z,Q)&&!Oj($,Z,{...Q,verifiedOnly:!0})}function WD$($){let Z=null;for(let Q of $){if(Q.action!=="review_approved"&&Q.action!=="review_changes_requested")continue;let Y=new Date(Q.occurredAt).getTime();if(Z&&Y<Z.at)continue;let X=Q.data?.notes;Z={at:Y,notes:Q.action==="review_changes_requested"&&typeof X==="string"?X:null}}return Z?.notes??null}function ND$($,Z=Date.now()){if($.state!==null&&$.state!=="open")return!1;if($.state===null)return!0;if($.checksStatus==="pending")return!0;if($.previewUrl!==null)return!1;let Q=$.updatedAt?Date.parse($.updatedAt):Number.NaN;return Number.isFinite(Q)&&Z-Q<bk4}var R8="super-agent",P81,Sk4,B00='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',YD$,A81="chore",MW,EU,Ck4,D00="NO VISUAL SURFACE",OH,R$,XD$,nK0,KD$="task-board.item.updated",HD$="task-board.item.deleted",FD$="task-board.item.prs.updated",UD$=4000,bk4=600000;var x4=D(()=>{t9();P81=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],Sk4=P81[0];YD$="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",MW=["reviewer"],EU={reviewer:"Reviewer"},Ck4=["QA Agent","Code Reviewer"];OH=["triage","todo","in_progress","in_review","approved","merged","post_deploy_validation","done","archived"],R$={intake:"triage",queue:"todo",progress:"in_progress",review:"in_review",archive:"archived"},XD$=OH.map(($,Z)=>({key:$,title:$,position:Z})),nK0=["approved","merged","post_deploy_validation"]});function T81($){return $==="trial"?"trial":"subscription"}function O00($,Z,Q,Y={}){wY({event:Z,organizationId:Q.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:Q.id,...Y}})}function R81($){return $?.status==="active"||$?.status==="past_due"}function tK0($,Z){if(R81($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function L00(){let $=E0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function jj(){return{...L00(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function Qm($,Z,Q=L00()){if(!Q.enforced||!XQ(Z))return;let Y=await $.storage.organizationBilling.taskClaim(Z.id);if(Y&&Y.runCount>=Q.maxRunsPerTask)throw O00($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new kX("runs_exhausted");if(Y&&Y.state!=="released")return;let X=await $.storage.organizationBilling.getBilling(Z.organizationId),J=tK0(X,Q);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,J.periodKey)>=J.limit)throw O00($,"task_quota_blocked",Z,{phase:"precheck",reason:J.exhaustedReason,billing_mode:T81(J.periodKey),limit:J.limit}),new kX(J.exhaustedReason)}async function BD$($,Z,Q=L00()){if(!Q.enforced||!XQ(Z))return"skipped";let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),X=tK0(Y,Q),J=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,X.periodKey,X.limit,Q.maxRunsPerTask);if(J==="exhausted")throw O00($,"task_quota_blocked",Z,{phase:"claim",reason:X.exhaustedReason,billing_mode:T81(X.periodKey),limit:X.limit}),new kX(X.exhaustedReason);if(J==="runs_exhausted")throw O00($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new kX("runs_exhausted");if(J==="claimed")O00($,"task_quota_claimed",Z,{billing_mode:T81(X.periodKey),period_key:X.periodKey,limit:X.limit});return J}async function DD$($,Z,Q,Y){if(Y==="skipped")return;await $.rollbackTaskClaim(Z,Q,{releaseSlot:Y==="claimed"}).catch((X)=>console.error("[task-quota] rollback failed (stays charged)",X))}async function OD$($,Z){let Q=await $.storage.organizationBilling.taskClaim(Z);return!!Q&&Q.state!=="released"}async function LD$($,Z,Q){if(await $.releaseTaskClaim(Z,Q).catch((X)=>{return console.error("[task-quota] refund failed (stays charged)",X),!1}))wY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:Q}})}var xk4="[SUBSCRIPTION_REQUIRED]",fk4,kX;var IW=D(()=>{x4();G6();X$();fk4={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};kX=class kX extends Error{reason;constructor($){super(`${xk4} ${fk4[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as KD}from"zod";var q81;var wD$=D(()=>{k0();IW();q81=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:KD.object({}),outputSchema:KD.object({enforced:KD.boolean(),billingStatus:KD.string(),subscribed:KD.boolean(),hasBillingAccount:KD.boolean(),used:KD.number(),limit:KD.number(),currentPeriodEnd:KD.string().datetime().nullable()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=L00(),X=await Z.storage.organizationBilling.getBilling(Q.id),J=tK0(X,Y),G=await Z.storage.organizationBilling.countTaskClaims(Q.id,J.periodKey);return{enforced:Y.enforced,billingStatus:X?.status??"none",subscribed:R81(X),hasBillingAccount:!!X?.stripeCustomerId,used:G,limit:J.limit,currentPeriodEnd:X?.currentPeriodEnd?.toISOString()??null}}})});var jD$=D(()=>{DB$();OB$();LB$();wB$();jB$();AB$();TB$();qB$();MB$();VB$();SB$();CB$();vB$();gB$();hB$();uB$();lB$();cB$();mB$();$D$();ZD$();QD$();wD$()});function VW($){let Z=$?.status;return typeof Z==="number"?Z:null}function ED$($){let Z=$;if(Z?.isRateLimited!==!0)return;return typeof Z.retryAfterMs==="number"?Z.retryAfterMs:null}async function bJ($,Z){let Q=await $.getBranch(Z);if(Q)return Q.sha;throw new f0({provider:$.repo.provider,status:404,message:`Branch ${Z} does not exist in ${$.repo.path}`})}var s6;var w00=D(()=>{T5();s6=class s6 extends Error{constructor($,Z){super($,Z);this.name="RepoWriteConflict"}}});function Ym($){if($.length===0)return null;let Z=!1;for(let Q of $){if(Q.state!=="completed"){Z=!0;continue}if(Q.conclusion&&gk4.has(Q.conclusion))return"failing"}return Z?"pending":"passing"}var gk4,PA;var j00=D(()=>{gk4=new Set(["failure","cancelled","timed_out","action_required"]);PA=class PA extends Error{existing;constructor($,Z){super($);this.name="ChangeRequestExists",this.existing=Z}}});function Xm($){return hk4.test($.trim())}function lZ($,Z,Q){if($===void 0||!Number.isFinite($)||$<=0)return Math.min(Z,Q);return Math.min(Math.floor($),Q)}async function Jm($,Z){let Q=$.headers.get("content-length"),Y=Q===null?Number.NaN:Number(Q),X=Number.isFinite(Y)&&Y>=0?Y:null,J=$.body;if(!J)return{content:"",size:X??0,truncated:!1};let G=J.getReader(),W=[],K=0,H=!1;try{for(;;){let{done:U,value:N}=await G.read();if(U)break;if(!N)continue;let B=Z-K;if(N.byteLength>=B){W.push(N.subarray(0,B)),K+=B,H=N.byteLength>B||!(await G.read()).done;break}W.push(N),K+=N.byteLength}}finally{await G.cancel().catch(()=>{})}return{content:new TextDecoder().decode(uk4(W,K)),size:X??K,truncated:H||X!==null&&X>K}}function uk4($,Z){let Q=new Uint8Array(Z),Y=0;for(let X of $)Q.set(X,Y),Y+=X.byteLength;return Q}function Q3($){return $.split("/").map(encodeURIComponent).join("/")}function M81($){let Z=Number($);return Number.isInteger(Z)&&Z>1?Z:1}var Ej=400,HD=2000,zj=60000,FD=200000,Pj=50,Aj=50,LH=100,hk4;var Gm=D(()=>{hk4=/\[bot\]$|[-_.]bot$|^bot[-_.]|^(dependabot|renovate)$/i});var PU;var I81=D(()=>{PU={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});import{sql as E00}from"kysely";function zD$($){return $ instanceof Date?$.toISOString():String($)}function z00($){let Z=$.installation_id===null||$.installation_id===void 0?null:Number($.installation_id);return{id:$.id,organizationId:$.organization_id,type:$.type,host:$.host,authKind:$.auth_kind,externalAccountId:$.external_account_id,login:$.login,avatarUrl:$.avatar_url,installationId:Number.isFinite(Z)?Z:null,status:$.status,installationAuthorizedBy:$.installation_authorized_by??null,installationRepositoryIds:$.installation_repository_ids??null,credentialConnectionId:$.credential_connection_id,connectedBy:$.connected_by_name?{name:$.connected_by_name}:null,createdAt:zD$($.created_at),updatedAt:zD$($.updated_at)}}class AA{db;constructor($){this.db=$}async upsert($){let Z=new Date,Q=await this.db.insertInto("git_provider_accounts").values({organization_id:$.organizationId,type:$.type,host:$.host.toLowerCase(),auth_kind:$.authKind,external_account_id:$.externalAccountId,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",created_by:$.createdBy??null}).onConflict((Y)=>Y.columns(["organization_id","host","external_account_id"]).doUpdateSet({type:$.type,auth_kind:$.authKind,login:$.login,avatar_url:$.avatarUrl??null,installation_id:$.installationId??null,installation_authorized_by:$.installationAuthorizedBy??null,installation_repository_ids:$.installationRepositoryIds?JSON.stringify($.installationRepositoryIds):null,credential_connection_id:null,status:"active",updated_at:E00`GREATEST(${Z}, git_provider_accounts.updated_at + interval '1 millisecond')`})).returningAll().executeTakeFirstOrThrow();return z00(Q)}async get($,Z){let Q=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?z00(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("id","=",$).executeTakeFirst();return Z?z00(Z):null}async listByOrg($){return(await this.db.selectFrom("git_provider_accounts").leftJoin("user as connector","connector.id","git_provider_accounts.created_by").selectAll("git_provider_accounts").select("connector.name as connected_by_name").where("git_provider_accounts.organization_id","=",$).orderBy("git_provider_accounts.created_at","asc").execute()).map(z00)}async findByExternalId($){let Z=await this.db.selectFrom("git_provider_accounts").selectAll().where("organization_id","=",$.organizationId).where("host","=",$.host.toLowerCase()).where("external_account_id","=",$.externalAccountId).executeTakeFirst();return Z?z00(Z):null}async setStatus($,Z,Q){await this.db.updateTable("git_provider_accounts").set({status:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).execute()}async grantRepository($,Z,Q){let Y=E00`jsonb_build_array(${Q}::bigint)`;await this.db.updateTable("git_provider_accounts").set({installation_repository_ids:E00`installation_repository_ids || ${Y}`,updated_at:E00`GREATEST(${new Date}, updated_at + interval '1 millisecond')`}).where("id","=",$).where("organization_id","=",Z).where("installation_repository_ids","is not",null).where(E00`NOT installation_repository_ids @> ${Y}`).execute()}async delete($,Z){return(await this.db.deleteFrom("git_provider_accounts").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}}var oK0=()=>{};class P00{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("git_provider_account_credentials").selectAll().where("account_id","=",$).executeTakeFirst();if(!Z)return null;return lk4(this.vault,Z)}async upsert($){let Z=new Date,Q=await this.vault.encrypt($.accessToken),Y=$.refreshToken?await this.vault.encrypt($.refreshToken):null,X=$.clientSecret?await this.vault.encrypt($.clientSecret):null;await this.db.insertInto("git_provider_account_credentials").values({account_id:$.connectionId,access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint}).onConflict((J)=>J.column("account_id").doUpdateSet({access_token:Q,refresh_token:Y,scope:$.scope,expires_at:$.expiresAt,client_id:$.clientId,client_secret:X,token_endpoint:$.tokenEndpoint,updated_at:Z})).execute()}async delete($){await this.db.deleteFrom("git_provider_account_credentials").where("account_id","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Y=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Y))return!0;return Y-Z<Date.now()}}async function lk4($,Z){try{let Q=await $.decrypt(Z.access_token),Y=Z.refresh_token?await $.decrypt(Z.refresh_token):null,X=Z.client_secret?await $.decrypt(Z.client_secret):null;return{id:Z.account_id,connectionId:Z.account_id,accessToken:Q,refreshToken:Y,scope:Z.scope,expiresAt:Z.expires_at,createdAt:Z.created_at,updatedAt:Z.updated_at,clientId:Z.client_id,clientSecret:X,tokenEndpoint:Z.token_endpoint}}catch(Q){return console.warn("[GitProviderAccountCredential] failed to decrypt credential row",{accountId:Z.account_id,message:Q instanceof Error?Q.message:String(Q)}),null}}import{sql as ck4}from"kysely";function PD$($){return $ instanceof Date?$.toISOString():String($)}function TA($){return{id:$.id,organizationId:$.organization_id,accountId:$.account_id,provider:$.provider,host:$.host,path:$.path,externalId:$.external_id,defaultBranch:$.default_branch,webUrl:$.web_url,visibility:$.visibility,sandboxImage:FU.catch("default").parse($.sandbox_image),legacyConnectionId:$.legacy_connection_id,createdAt:PD$($.created_at),updatedAt:PD$($.updated_at)}}function UD($){return{provider:$.provider,host:$.host,path:$.path}}class A00{db;constructor($){this.db=$}async upsert($){let Z=$.ref.host.toLowerCase(),Q=await this.findByRef($.organizationId,$.ref);if(Q){let X=await this.db.updateTable("repositories").set({path:$.ref.path,provider:$.ref.provider,web_url:kJ({...$.ref,host:Z}),...$.accountId!==void 0?{account_id:$.accountId}:{},...$.externalId!==void 0?{external_id:$.externalId}:{},...$.defaultBranch!==void 0?{default_branch:$.defaultBranch}:{},...$.visibility!==void 0?{visibility:$.visibility}:{},...$.sandboxImage!==void 0?{sandbox_image:$.sandboxImage}:{},...$.legacyConnectionId!==void 0?{legacy_connection_id:$.legacyConnectionId}:{},updated_at:new Date}).where("id","=",Q.id).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return TA(X)}let Y=await this.db.insertInto("repositories").values({organization_id:$.organizationId,account_id:$.accountId??null,provider:$.ref.provider,host:Z,path:$.ref.path,external_id:$.externalId??null,default_branch:$.defaultBranch??null,web_url:kJ({...$.ref,host:Z}),visibility:$.visibility??null,sandbox_image:$.sandboxImage??null,legacy_connection_id:$.legacyConnectionId??null,created_by:$.createdBy??null}).returningAll().executeTakeFirstOrThrow();return TA(Y)}async get($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("id","=",$).where("organization_id","=",Z).executeTakeFirst();return Q?TA(Q):null}async getUnscoped($){let Z=await this.db.selectFrom("repositories").selectAll().where("id","=",$).executeTakeFirst();return Z?TA(Z):null}async findByRef($,Z){let Q=await this.db.selectFrom("repositories").selectAll().where("organization_id","=",$).where("host","=",Z.host.toLowerCase()).where(ck4`lower(path)`,"=",Z.path.toLowerCase()).executeTakeFirst();return Q?TA(Q):null}async listByOrg($,Z){let Q=this.db.selectFrom("repositories").selectAll().where("organization_id","=",$);if(Z?.accountId)Q=Q.where("account_id","=",Z.accountId);return(await Q.orderBy("path","asc").execute()).map(TA)}async setSandboxImage($,Z,Q){let Y=await this.db.updateTable("repositories").set({sandbox_image:Q,updated_at:new Date}).where("id","=",$).where("organization_id","=",Z).returningAll().executeTakeFirst();return Y?TA(Y):null}async delete($,Z){try{return(await this.db.deleteFrom("repositories").where("id","=",$).where("organization_id","=",Z).executeTakeFirst()).numDeletedRows>0n}catch(Q){if(Q instanceof Error&&"constraint"in Q&&Q.constraint==="org_repo_sync_source_present")throw Error("Remove this repository's sync configurations before unlinking it");throw Q}}}var Wm=D(()=>{i4()});function TD$($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function mk4($,Z){let{owner:Q}=k5(Z),Y=TD$(Z.host),X=new RegExp(`(?:https?://(?:[^@\\s/]*@)?${Y}/|git@${Y}:)${TD$(Q)}/([A-Za-z0-9._-]+)`,"gi");return[...$.matchAll(X)].flatMap((J)=>J[1]?.replace(/\.git$/i,"")||[])}async function RD$($,Z){let{owner:Q,name:Y}=k5(Z),X=new Set,J=[Z.path];while(J.length>0&&X.size<AD$){let G=J.shift();if(!G)break;let W=await $(G,"pubspec.yaml").catch(()=>null);if(!W)continue;for(let K of mk4(W,Z)){if(K===Y||X.has(K))continue;if(X.size>=AD$)break;X.add(K),J.push(`${Q}/${K}`)}}return[...X]}var AD$=20;var qD$=D(()=>{i4()});function ID$($){return Bun.hash($).toString(36)}function dk4($){for(let[Z,Q]of Tj)if(Q.expiresAt<=$)Tj.delete(Z);while(Tj.size>=512){let Z=Tj.keys().next();if(Z.done)break;Tj.delete(Z.value)}}function k81($,Z,Q,Y=Date.now()){dk4(Y),Tj.set(ID$($),{owner:Z,expiresAt:Q})}function Km($,Z=Date.now()){let Q=ID$($),Y=Tj.get(Q);if(!Y)return"unknown";if(Y.expiresAt<=Z)return Tj.delete(Q),"unknown";return Y.owner}var MD$="app",V81="user",Tj;var Hm=D(()=>{Tj=new Map});function Rj($=process.env){let Z=$.GITHUB_APP_ID?.trim(),Q=$.GITHUB_APP_PRIVATE_KEY?.trim(),Y=$.GITHUB_APP_CLIENT_ID?.trim(),X=$.GITHUB_APP_CLIENT_SECRET?.trim(),J=$.GITHUB_APP_SLUG?.trim();if(!Z||!Q||!Y||!X||!J)return null;return{appId:Z,privateKeyPem:Q.replace(/\\n/g,`
 `),clientId:Y,clientSecret:X,slug:J}}function RA($,Z){let Q=$.get(Z);if(Q===null)return null;let Y=Number(Q);return Number.isFinite(Y)?Y:null}function ik4($){return{limit:RA($,"x-ratelimit-limit"),remaining:RA($,"x-ratelimit-remaining"),reset:RA($,"x-ratelimit-reset"),used:RA($,"x-ratelimit-used"),resource:$.get("x-ratelimit-resource")}}function qj($){if($.status===429)return!0;if($.status!==403)return!1;if($.headers.get("retry-after")!==null)return!0;return RA($.headers,"x-ratelimit-remaining")===0}function Mj($,Z=Date.now()){let Q=RA($,"retry-after");if(Q!==null)return Math.max(0,Q*1000);let Y=RA($,"x-ratelimit-reset");if(Y!==null)return Math.max(0,Y*1000-Z);return null}function Ij($,Z){let Q=ik4($),Y=Q.resource??"unknown",X={installation:Z.installation,resource:Y},J={...X,lane:Z.lane,operation:Z.operation};if(SD$??=e1.createCounter("github_api_calls",{description:"Calls to the GitHub API, by transport and operation",unit:"{calls}"}),SD$.add(1,J),Q.remaining!==null)VD$??=e1.createGauge("github_rate_limit_remaining",{description:"Requests (REST) or points (GraphQL) left in the window",unit:"{requests}"}),VD$.record(Q.remaining,X);if(Q.used!==null)kD$??=e1.createGauge("github_rate_limit_used",{description:"Requests (REST) or points (GraphQL) spent in the window",unit:"{requests}"}),kD$.record(Q.used,X);return Q}function Vj($){CD$??=e1.createCounter("github_rate_limited",{description:"GitHub responses refused for rate-limit reasons",unit:"{responses}"}),CD$.add(1,$)}var VD$=null,kD$=null,SD$=null,CD$=null;var T00=D(()=>{k6()});function kW($){return process.env.GITHUB_API_BASE_URL??oB("github",$)}async function o9($,Z){let Q={Authorization:`Bearer ${Z.token}`,Accept:Z.accept??nk4,"X-GitHub-Api-Version":pk4};if(Z.body!==void 0)Q["Content-Type"]="application/json";let Y;try{Y=await fetch($,{method:Z.method??"GET",headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:AbortSignal.timeout(Z.timeoutMs??S81)})}catch(J){throw new f0({provider:"github",status:0,message:`GitHub ${Z.operation} failed: ${J instanceof Error?J.message:String(J)}`,cause:J})}let X=Km(Z.token);if(Ij(Y.headers,{lane:"rest",operation:Z.operation,installation:X}),qj(Y)){await Y.body?.cancel().catch(()=>{});let J=Y.headers.get("retry-after")!==null?"secondary":"primary";Vj({lane:"rest",operation:Z.operation,installation:X,kind:J});let G=Mj(Y.headers);throw new f0({provider:"github",status:Y.status,retryAfterMs:G,message:`GitHub ${J} rate limit reached${G===null?"":`; retry in ${Math.ceil(G/1000)}s`}`})}return Y}function R00($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"&&"message"in Z&&typeof Z.message==="string"&&Z.message.length>0)return Z.message}catch{}return $.slice(0,300)}function q00($,Z,Q){let Y=R00(Z);return new f0({provider:"github",status:$,message:`GitHub ${Q} failed: ${$}${Y?` ${Y}`:""}`})}async function cZ($,Z){let Q=await $.text().catch(()=>"");return q00($.status,Q,Z)}async function JQ($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new f0({provider:"github",status:$.status,message:`GitHub ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}var pk4="2022-11-28",nk4="application/vnd.github+json",S81=15000;var kj=D(()=>{i4();T00();Hm();T5()});function QS4($){return $==="public"||$==="private"||$==="internal"}function C81($,Z){let Q="public";if($.private)Q="private";else if($.visibility&&QS4($.visibility))Q=$.visibility;return{ref:{provider:"github",host:Z,path:$.full_name},externalId:String($.id),defaultBranch:$.default_branch??null,webUrl:$.html_url,visibility:Q,description:$.description??null,updatedAt:$.pushed_at??$.updated_at??null}}function v81($,Z){let Q=Z?.trim().toLowerCase();if(!Q)return!0;return $.toLowerCase().includes(Q)}function YS4($){return{name:$.name||$.login,email:$.email||`${$.login}@users.noreply.github.com`}}function XS4($){return $.split("/").filter(Boolean).map(encodeURIComponent).join("/")}function JS4($,Z){let{owner:Q,name:Y}=k5($),X=`/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}/tarball`;return Z?`${X}/${encodeURIComponent(Z)}`:X}function vD$($,Z,Q){return new f0({provider:"github",status:Z,message:Q?`Studio cannot create repositories in ${$}. The GitHub App needs the Administration permission there; ask an owner of ${$} to accept it.`:`The connected GitHub account cannot create repositories in ${$}.`})}class MA{kind="github";host;apiBaseUrl;options;grantedIds=new Map;constructor($){this.options=$,this.host=$.host.toLowerCase(),this.apiBaseUrl=kW($.host)}async tokenForRepo($,Z={}){let Q=this.options;if("appAuth"in Q){let Y=Q.repositoryIds??null,X=Z.alsoRepositories??[],J=await Q.appAuth.installationToken(Q.installationId,{...Y?{repositoryIds:[await this.grantedRepositoryId($,Y),...await this.grantedSiblingIds($,X,Y)]}:{repositories:[S11($),...X]},permissions:fK0,bufferMs:Z.bufferMs,forceRefresh:Z.forceRefresh});return{token:J.token,kind:"installation",expiresAt:J.expiresAt}}return this.sourceToken(Q.tokenSource,Z)}async accountToken($={}){let Z=this.options;if("appAuth"in Z){let Q=await Z.appAuth.installationToken(Z.installationId,{...Z.repositoryIds?{repositoryIds:Z.repositoryIds}:{},permissions:tk4,bufferMs:$.bufferMs,forceRefresh:$.forceRefresh});return{token:Q.token,kind:"installation",expiresAt:Q.expiresAt}}return this.sourceToken(Z.tokenSource,$)}async grantedRepositoryId($,Z){let Q=$.path.toLowerCase(),Y=this.grantedIds.get(Q);if(Y!==void 0)return Y;let X=Number((await this.getRepo($))?.externalId);if(!Number.isSafeInteger(X)||!Z.includes(X))throw new f0({provider:"github",status:403,message:`${$.path} is outside what this GitHub account authorized for Studio. Ask someone who administers it to connect it.`});return this.grantedIds.set(Q,X),X}async grantedSiblingIds($,Z,Q){let{owner:Y}=k5($),X=[];for(let J of Z){let G=await this.getRepo({...$,path:`${Y}/${J}`}).catch(()=>null),W=Number(G?.externalId);if(Number.isSafeInteger(W)&&Q.includes(W))X.push(W)}return X}async createRepoFromTemplate($){let{template:Q,owner:Y,name:X}=$,J=await this.creationToken(Y),G=await o9(`${this.apiBaseUrl}/repos/${encodeURIComponent(Q.owner)}/${encodeURIComponent(Q.name)}/generate`,{method:"POST",token:J,operation:"create_repo_from_template",body:{owner:Y,name:X,private:$.private,include_all_branches:!1}});if(!G.ok){let K=await G.text().catch(()=>"");if(G.status===422&&/already exists/i.test(R00(K)))throw new f0({provider:"github",status:409,message:`${Y}/${X} already exists on GitHub. Choose another name.`});if(G.status===403||G.status===404)throw vD$(Y,G.status,"appAuth"in this.options);throw q00(G.status,K,"create_repo_from_template")}let W=C81(await JQ(G,"create_repo_from_template"),this.host);return await this.waitForTemplateCopy(W.ref,J).catch(()=>{}),W}async creationToken($){let Z=this.options;if(!("appAuth"in Z))return(await this.sourceToken(Z.tokenSource,{})).token;if((Z.repositoryIds?.length??0)>=qA)throw new f0({provider:"github",status:409,message:`This GitHub account already grants Studio ${qA} repositories, the most one account can. Create the site with another account.`});try{return(await Z.appAuth.installationToken(Z.installationId,{permissions:ok4})).token}catch(Q){if(Q instanceof f0&&Q.status===422)throw vD$($,403,!0);throw Q}}async waitForTemplateCopy($,Z){let{owner:Q,name:Y}=k5($),X=`${this.apiBaseUrl}/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}/commits?per_page=1`;await E8(async()=>{let J=await o9(X,{token:Z,operation:"wait_template_copy"});if(await J.body?.cancel().catch(()=>{}),!J.ok)throw new _81},{maxAttempts:rk4,minTimeout:sk4,maxTimeout:ak4,isRetriable:(J)=>J instanceof _81})}async sourceToken($,Z){let Q=await $.get(Z);if(!Q)throw new f0({provider:"github",status:401,message:`No usable GitHub token for ${this.host}; reconnect the account`});return Q}async getRepo($){let{owner:Q,name:Y}=k5($),X=await this.request(`/repos/${encodeURIComponent(Q)}/${encodeURIComponent(Y)}`,{operation:"get_repo"});if(X.status===404)return await X.body?.cancel().catch(()=>{}),null;if(!X.ok)throw await cZ(X,"get_repo");return C81(await JQ(X,"get_repo"),this.host)}async listRepos($={}){let Z=Math.max(1,Math.floor($.page??1)),Q=Math.min($S4,Math.max(1,Math.floor($.perPage??ek4))),Y=`per_page=${Q}&page=${Z}`,X;if("appAuth"in this.options){let G=await this.request(`/installation/repositories?${Y}`,{operation:"list_installation_repositories"});if(!G.ok)throw await cZ(G,"list_installation_repositories");let W=await JQ(G,"list_installation_repositories");X=Array.isArray(W.repositories)?W.repositories:[]}else{let G=await this.request(`/user/repos?affiliation=owner,collaborator,organization_member&sort=pushed&${Y}`,{operation:"list_user_repositories"});if(!G.ok)throw await cZ(G,"list_user_repositories");let W=await JQ(G,"list_user_repositories");X=Array.isArray(W)?W:[]}return{repositories:X.filter((J)=>v81(J.full_name,$.query)).map((J)=>C81(J,this.host)),hasMore:X.length===Q}}async readFile($,Z,Q){let{owner:X,name:J}=k5($),G=Q?`?ref=${encodeURIComponent(Q)}`:"",W=await this.request(`/repos/${encodeURIComponent(X)}/${encodeURIComponent(J)}/contents/${XS4(Z)}${G}`,{operation:"read_file",accept:ZS4});if(W.status===404)return await W.body?.cancel().catch(()=>{}),null;if(!W.ok)throw await cZ(W,"read_file");return W.text()}async archiveTarball($,Z){let Y=`${this.apiBaseUrl}${JS4($,Z)}`,X=await this.tokenForRepo($),J=await o9(Y,{operation:"archive_tarball",token:X.token,timeoutMs:_D$});if(J.status===401){await J.body?.cancel().catch(()=>{});let G=await this.tokenForRepo($,{forceRefresh:!0});J=await o9(Y,{operation:"archive_tarball",token:G.token,timeoutMs:_D$})}if(J.status===404)return await J.body?.cancel().catch(()=>{}),null;if(!J.ok)throw await cZ(J,"archive_tarball");return J.body}async identity(){if("appAuth"in this.options)return null;let $="get_user",Z=await this.request("/user",{operation:$});if(!Z.ok)throw await cZ(Z,$);return YS4(await JQ(Z,$))}async request($,Z){let Q=`${this.apiBaseUrl}${$}`,Y=await this.accountToken(),X=await o9(Q,{...Z,token:Y.token});if(X.status!==401)return X;await X.body?.cancel().catch(()=>{});let J=await this.accountToken({forceRefresh:!0});return o9(Q,{...Z,token:J.token})}}var tk4,ok4,rk4=8,sk4=500,ak4=4000,_81,ek4=30,$S4=100,ZS4="application/vnd.github.raw+json",_D$=60000;var rK0=D(()=>{i4();_J();a$();T5();M00();kj();tk4={metadata:"read",contents:"read"},ok4={administration:"write",contents:"read",metadata:"read"};_81=class _81 extends Error{}});import{z as Sj}from"zod";function sK0($){return $.repositories.filter((Z)=>Z.permissions?.admin===!0).map((Z)=>({id:Z.id,name:Z.full_name}))}function aK0($){if($.total_count===void 0)return-1;return Math.max(0,Math.ceil($.total_count/IA)-1)}function xD$($){return aK0($)===0&&sK0($).length===0}function fD$($,Z,Q){let Y=$.filter((J)=>v81(J.name,Q)),X=(Z-1)*IA;return{repositories:Y.slice(X,X+IA),hasMore:Y.length>X+IA}}function yD$($,Z){let Q=new Set($.map((Y)=>Y.id));return Z.every((Y)=>Q.has(Y))}function gD$($,Z,Q){if(Z!==null){let J=new Set(Z);return $.filter((G)=>J.has(G.id)).map((G)=>G.id)}let Y=new Set(Q.flatMap((J)=>J.externalId?[J.externalId]:[])),X=new Set(Q.filter((J)=>!J.externalId).map((J)=>J.path.toLowerCase()));return $.filter((J)=>Y.has(String(J.id))||X.has(J.name.toLowerCase())).map((J)=>J.id)}class b81{ttlMs;entries=new Map;constructor($){this.ttlMs=$}installations($){return this.live($)?.installations}repositories($,Z){return this.live($)?.repositories.get(Z)}rememberInstallations($,Z){this.entry($).installations=Z}rememberRepositories($,Z,Q){this.entry($).repositories.set(Z,Q)}forget($){this.entries.delete($)}live($){let Z=this.entries.get($);if(!Z)return;if(Z.expiresAt<=Date.now()){this.entries.delete($);return}return Z}entry($){let Z=Date.now();for(let[Y,X]of this.entries)if(X.expiresAt<=Z)this.entries.delete(Y);let Q=this.entries.get($);if(!Q)Q={expiresAt:Z+this.ttlMs,repositories:new Map},this.entries.set($,Q);return Q}}var IA=100,bD$;var x81=D(()=>{rK0();bD$=Sj.object({total_count:Sj.number().int().nonnegative().optional(),repositories:Sj.array(Sj.object({id:Sj.number().int().positive().safe(),full_name:Sj.string().min(1),permissions:Sj.object({admin:Sj.boolean().optional()}).optional()}))})});import{createPrivateKey as lD$,sign as GS4}from"crypto";import{z as hD$}from"zod";function f81($){return Buffer.from($).toString("base64url")}function NS4($){let Z=f81(JSON.stringify({alg:"RS256",typ:"JWT"})),Q=f81(JSON.stringify({iat:$.nowSeconds-KS4,exp:$.nowSeconds+g81,iss:$.appId})),Y=`${Z}.${Q}`,X=GS4("RSA-SHA256",Buffer.from(Y),lD$($.privateKeyPem));return`${Y}.${f81(X)}`}function BS4($){let Z=X00.find((X)=>(X in $));if(!Z)return null;let{[Z]:Q,...Y}=$;return Y}function DS4($){let{repositories:Z,repositoryIds:Q}=$;if(Z&&Q)return"A GitHub installation token is scoped by repository name or by id, never both";let Y=Z?.length??Q?.length;if(Y!==void 0&&(Y===0||Y>qA))return`A GitHub installation token covers 1 to ${qA} repositories, not ${Y}`;if(Q?.some((X)=>!Number.isSafeInteger(X)||X<=0))return"A GitHub repository id must be a positive integer";return null}function OS4($,Z){let Q=(Z.repositories??[]).map((J)=>J.toLowerCase()).sort(),Y=Object.entries(Z.permissions??{}).map(([J,G])=>`${J}=${G}`).sort(),X=Z.repositoryIds?`ids:${[...Z.repositoryIds].sort((J,G)=>J-G).join(",")}`:"all";return`${$}|${Q.join(",")}|${X}|${Y.join(",")}`}function LS4($,Z){for(let[Q,Y]of $)if(Y.expiresAt.getTime()<=Z)$.delete(Q)}function uD$($){let Z=$.account;if(typeof $.id!=="number"||!Z||typeof Z.id!=="number"||typeof Z.login!=="string")return null;return{installationId:$.id,externalAccountId:String(Z.id),login:Z.login,avatarUrl:typeof Z.avatar_url==="string"?Z.avatar_url:null,accountType:typeof Z.type==="string"?Z.type:"User",htmlUrl:typeof $.html_url==="string"?$.html_url:null}}function wS4($){if(!$||typeof $!=="object"||Array.isArray($))return null;let Z={};for(let[Q,Y]of Object.entries($))if(typeof Y==="string")Z[Q]=Y;return Z}class cD${appId;privateKeyPem;apiBaseUrl;jwt=null;cache=new Map;inFlight=new Map;flowAccess=new b81(US4);constructor($,Z){this.appId=$.appId,this.privateKeyPem=$.privateKeyPem,this.apiBaseUrl=(Z?.apiBaseUrl??WS4).replace(/\/+$/,"")}appJwt(){let $=Math.floor(Date.now()/1000);if(this.jwt&&this.jwt.exp-$>HS4)return this.jwt.value;let Z=NS4({appId:this.appId,privateKeyPem:this.privateKeyPem,nowSeconds:$});return this.jwt={value:Z,exp:$+g81},k81(Z,MD$,($+g81)*1000),Z}installationToken($,Z={}){let Q=DS4(Z);if(Q)return Promise.reject(new f0({provider:"github",status:403,message:Q}));let Y=OS4($,Z),X=Z.bufferMs??FS4;if(!Z.forceRefresh){let W=this.cache.get(Y);if(W&&W.expiresAt.getTime()-Date.now()>X)return Promise.resolve(W)}let J=this.inFlight.get(Y);if(J)return J;let G=this.mint($,Z).then((W)=>{return this.cache.set(Y,W),k81(W.token,String($),W.expiresAt.getTime()),LS4(this.cache,Date.now()),W}).finally(()=>{this.inFlight.delete(Y)});return this.inFlight.set(Y,G),G}async mint($,Z){let Y=`${this.apiBaseUrl}/app/installations/${$}/access_tokens`,X=Z.repositories&&Z.repositories.length>0?Z.repositories:void 0,J=Z.permissions?{...Z.permissions}:void 0;for(;;){let G=await o9(Y,{method:"POST",token:this.appJwt(),body:{...X&&{repositories:X},...Z.repositoryIds&&{repository_ids:Z.repositoryIds},...J&&{permissions:J}},operation:"installation_access_token"});if(G.ok){let W=await JQ(G,"installation_access_token");if(typeof W.token!=="string"||W.token.length===0||typeof W.expires_at!=="string"||W.expires_at.length===0)throw new f0({provider:"github",status:G.status,message:"GitHub installation_access_token returned no token"});let K=new Date(W.expires_at);if(isNaN(K.getTime()))throw new f0({provider:"github",status:G.status,message:"GitHub installation_access_token returned invalid token expiration"});return{token:W.token,expiresAt:K,permissions:wS4(W.permissions)??J??{}}}if(G.status===422&&J){let W=await G.text().catch(()=>""),K=BS4(J);if(K&&q$1(R00(W))){J=K;continue}throw q00(G.status,W,"installation_access_token")}throw await cZ(G,"installation_access_token")}}async getInstallation($){let Q=await o9(`${this.apiBaseUrl}/app/installations/${$}`,{token:this.appJwt(),operation:"get_installation"});if(Q.status===404)return null;if(!Q.ok)throw await cZ(Q,"get_installation");let Y=uD$(await JQ(Q,"get_installation"));if(!Y)throw new f0({provider:"github",status:Q.status,message:"GitHub get_installation returned an installation without a user or organization account"});return Y}async connectingUserId($){let Z=hD$.object({id:hD$.number().int().positive().safe()}).parse(await this.userGet("/user",$,"get_connecting_user"));return String(Z.id)}async listConnectableInstallations($,Z){this.flowAccess.forget($);let Q=await this.listUserInstallations(Z);return this.flowAccess.rememberInstallations($,Q),(await F9(Q,4,async(X)=>{let J=await this.repositoryPage(Z,X.installationId,1);if(aK0(J)===0)this.flowAccess.rememberRepositories($,X.installationId,sK0(J));return xD$(J)?null:X})).filter((X)=>X!==null)}async connectableInstallation($,Z,Q,Y={}){let X=Y.fresh?void 0:this.flowAccess.installations($);if(!X)X=await this.listUserInstallations(Z),this.flowAccess.rememberInstallations($,X);return X.find((J)=>J.installationId===Q)??null}async delegableRepositories($,Z,Q,Y={}){if(!Y.fresh){let K=this.flowAccess.repositories($,Q);if(K)return K}let X=await this.repositoryPage(Z,Q,1),J=[X],G=aK0(X);if(G>0)J.push(...await F9(Array.from({length:G},(K,H)=>H+2),4,(K)=>this.repositoryPage(Z,Q,K)));else if(G<0)for(let K=2;J[J.length-1].repositories.length===IA;K++)J.push(await this.repositoryPage(Z,Q,K));let W=J.flatMap(sK0);return this.flowAccess.rememberRepositories($,Q,W),W}forgetFlow($){this.flowAccess.forget($)}async repositoryPage($,Z,Q){return bD$.parse(await this.userGet(`/user/installations/${Z}/repositories?per_page=${IA}&page=${Q}`,$,"list_connecting_user_repositories"))}async userGet($,Z,Q){let Y=await o9(`${this.apiBaseUrl}${$}`,{token:Z,operation:Q});if(!Y.ok)throw await cZ(Y,Q);return JQ(Y,Q)}async listUserInstallations($){let Y=[];for(let X=1;;X++){let J=await o9(`${this.apiBaseUrl}/user/installations?per_page=100&page=${X}`,{token:$,operation:"list_user_installations"});if(!J.ok)throw await cZ(J,"list_user_installations");let G=await JQ(J,"list_user_installations"),W=Array.isArray(G.installations)?G.installations:[];for(let K of W){let H=uD$(K);if(H)Y.push(H)}if(W.length<100)return Y}}}function wH(){if(y81===void 0){let $=Rj();y81=$&&jS4($)?new cD$($,{apiBaseUrl:kW("github.com")}):null}return y81}function jS4($){try{return lD$($.privateKeyPem),!0}catch(Z){return console.error("[git-providers] GITHUB_APP_PRIVATE_KEY is not a usable private key \u2014 "+"the GitHub App stays disabled and orgs keep their existing connections. Check that newlines survived the secret store.",Z),!1}}function mD$(){let $=Rj()!==null&&wH()!==null;return{configured:$,hosts:$?[ES4]:[]}}var WS4="https://api.github.com",KS4=60,g81=540,HS4=60,FS4=300000,US4=600000,qA=500,y81,ES4="github.com";var M00=D(()=>{a$();_J();Hm();T5();x81();kj()});import{execFile as zS4}from"child_process";import{promisify as PS4}from"util";import{z as eK0}from"zod";function VA(){return E0().localMode}function I00($){return new f0({provider:"github",status:403,message:$})}async function dD$($){if(!VA())throw I00("GitHub CLI connections are only available in local mode.");let Z={...process.env,GH_PROMPT_DISABLED:"1"};delete Z.GH_TOKEN,delete Z.GITHUB_TOKEN,delete Z.GH_DEBUG,delete Z.DEBUG;try{let{stdout:Q}=await AS4("gh",["auth","token","--hostname",h81,...$?["--user",$]:[]],{env:Z,timeout:1e4,maxBuffer:16384}),Y=Q.trim();if(!Y||/\s/.test(Y))throw Error("Invalid CLI token");return Y}catch{throw I00("Could not read your GitHub CLI login. Install gh and run gh auth login --hostname github.com, then connect again.")}}async function iD$($){try{let Z=await o9(`${kW(h81)}/user`,{token:$,operation:"cli_current_user"});if(!Z.ok)throw Error("GitHub rejected the CLI token");return TS4.parse(await Z.json())}catch{throw I00("Could not verify your GitHub CLI account. Run gh auth login --hostname github.com and connect again.")}}async function pD$(){let $=await iD$(await dD$());return{externalAccountId:`cli:user:${$.id}`,login:$.login,avatarUrl:$.avatar_url??null}}function nD$($){return{kind:"token",async get(){if($.host!==h81)throw I00("Unsupported GitHub CLI host.");let Z=await dD$($.login);if(`cli:user:${(await iD$(Z)).id}`!==$.externalAccountId)throw I00("Your GitHub CLI account changed. Connect it again.");return{token:Z,kind:"token",expiresAt:null}}}}var AS4,h81="github.com",TS4;var $H0=D(()=>{X$();T5();kj();AS4=PS4(zS4),TS4=eK0.object({id:eK0.number().int().positive().safe(),login:eK0.string().min(1),avatar_url:eK0.string().url().nullable().optional()})});function Fm($){return oB("gitlab",$)}function qS4($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"){let Q=Z,Y=[...KB(Q.message),...KB(Q.error),...KB(Q.error_description)];if(Y.length>0)return Y.join("; ")}}catch{}return $.slice(0,300)}async function Y3($){let Z=await $.text().catch(()=>""),Q=Z?qS4(Z):$.statusText;return new f0({provider:"gitlab",status:$.status,message:`GitLab API ${$.status}: ${Q}`,retryAfterMs:$.status===429?tD$($.headers):null})}async function V00($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new f0({provider:"gitlab",status:$.status,message:`GitLab ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}async function AU($,Z,Q={}){let Y={Authorization:`Bearer ${Z}`,Accept:Q.accept??"application/json"};if(Q.body!==void 0)Y["Content-Type"]="application/json";try{return await fetch($,{method:Q.method??"GET",headers:Y,body:Q.body===void 0?void 0:JSON.stringify(Q.body),signal:AbortSignal.timeout(Q.timeoutMs??RS4)})}catch(X){throw new f0({provider:"gitlab",status:0,message:`GitLab request failed: ${X instanceof Error?X.message:String(X)}`,cause:X})}}var RS4=15000;var k00=D(()=>{i4();T5();Cj()});import{z as CY}from"zod";function ND($){return encodeURIComponent($)}function S00($){return encodeURIComponent($.replace(/^\/+/,""))}function kS4($,Z){let Q=`/projects/${ND($.path)}/repository/archive.tar.gz`;return Z?`${Q}?sha=${encodeURIComponent(Z)}`:Q}function tD$($,Z=Date.now()){let Q=$.get("retry-after");if(Q!==null){let X=Number(Q);if(Number.isFinite(X))return Math.max(0,X*1000);let J=Date.parse(Q);if(Number.isFinite(J))return Math.max(0,J-Z)}let Y=$.get("ratelimit-reset");if(Y!==null){let X=Number(Y);if(Number.isFinite(X))return Math.max(0,X*1000-Z)}return null}function oD$($,Z){let Q=SS4.parse($),Y={provider:"gitlab",host:Z,path:Q.path_with_namespace};return{ref:Y,externalId:String(Q.id),defaultBranch:Q.default_branch??null,webUrl:Q.web_url??kJ(Y),visibility:Q.visibility,description:Q.description??null,updatedAt:Q.last_activity_at??null}}async function CS4($,Z,Q={}){let Y=await AU($,Z,Q);if(Y.status===404)return await Y.body?.cancel().catch(()=>{}),null;if(!Y.ok)throw await Y3(Y);return Y}async function _S4($,Z){let Q=await CS4(`${oB("gitlab",$)}/user`,Z);if(!Q)throw new f0({provider:"gitlab",status:404,message:"GitLab did not recognise the authenticated user"});return rD$.parse(await V00(Q,"get_user"))}async function ZH0($,Z){let Q=await _S4($,Z);return{externalAccountId:String(Q.id),login:Q.username,avatarUrl:Q.avatar_url??null}}class C00{kind="gitlab";host;apiBase;tokenSource;constructor($){this.host=$.host,this.apiBase=oB("gitlab",$.host),this.tokenSource=$.tokenSource}async tokenForRepo($,Z){return this.accountToken(Z)}async accountToken($){let Z=await this.tokenSource.get($);if(!Z)throw new f0({provider:"gitlab",status:401,message:"GitLab account is not authenticated"});return Z}async getRepo($){let Z=await this.get(`/projects/${ND($.path)}`);if(!Z)return null;return oD$(await V00(Z,"get_repo"),this.host)}async listRepos($={}){let Z=new URLSearchParams({membership:"true",simple:"true",order_by:"id",sort:"desc",per_page:String(Math.min(VS4,Math.max(1,$.perPage??IS4))),page:String(Math.max(1,$.page??1))}),Q=$.query?.trim();if(Q)Z.set("search",Q);let Y=await this.get(`/projects?${Z}`);if(!Y)return{repositories:[],hasMore:!1};let X=await V00(Y,"list_repos");if(!Array.isArray(X))throw new f0({provider:"gitlab",status:502,message:"GitLab /projects returned a non-array payload"});return{repositories:X.map((J)=>oD$(J,this.host)),hasMore:X.length===Number(Z.get("per_page"))}}async readFile($,Z,Q){let Y=Q;if(!Y){let J=await this.getRepo($);if(!J?.defaultBranch)return null;Y=J.defaultBranch}let X=await this.get(`/projects/${ND($.path)}/repository/files/${S00(Z)}/raw?ref=${encodeURIComponent(Y)}`,{accept:"text/plain, */*"});if(!X)return null;return X.text()}async archiveTarball($,Z){let Q=await this.authedFetch(`${this.apiBase}${kS4($,Z)}`,{accept:"application/octet-stream, */*",timeoutMs:MS4});if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await Y3(Q);return Q.body}async identity(){let $=await this.authedFetch(`${this.apiBase}/user`);if(!$.ok)throw await Y3($);let Z=rD$.parse(await V00($,"identity"));return{name:Z.name||Z.username,email:Z.commit_email||Z.public_email||Z.email||`${Z.username}@users.noreply.${this.host}`}}async get($,Z){let Q=await this.authedFetch(`${this.apiBase}${$}`,Z);if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await Y3(Q);return Q}async authedFetch($,Z={}){let Q=await this.accountToken(),Y=await AU($,Q.token,Z);if(Y.status!==401)return Y;await Y.body?.cancel().catch(()=>{});let X=await this.accountToken({forceRefresh:!0});return AU($,X.token,Z)}}var MS4=60000,IS4=30,VS4=100,SS4,rD$;var Cj=D(()=>{i4();T5();k00();SS4=CY.object({id:CY.number(),path_with_namespace:CY.string().min(1),default_branch:CY.string().nullish(),web_url:CY.string().nullish(),visibility:CY.enum(["public","private","internal"]),description:CY.string().nullish(),last_activity_at:CY.string().nullish()});rD$=CY.object({id:CY.number(),username:CY.string().min(1),name:CY.string().nullish(),avatar_url:CY.string().nullish(),email:CY.string().nullish(),public_email:CY.string().nullish(),commit_email:CY.string().nullish()})});function QH0($=process.env){let Z=$.BITBUCKET_OAUTH_CLIENT_ID?.trim(),Q=$.BITBUCKET_OAUTH_CLIENT_SECRET?.trim();if(!Z||!Q)return null;return{host:BD,clientId:Z,clientSecret:Q}}function sD$(){let $=QH0();return{configured:$!==null,hosts:$?[$.host]:[]}}var BD;var Um=D(()=>{i4();BD=rW0.bitbucket});function _00($){if($.toLowerCase()===BD)return;throw new f0({provider:"bitbucket",status:400,message:`${$} is not Bitbucket Cloud. Only bitbucket.org is supported; Bitbucket Data Center has a different API.`})}function bS4($,Z=Date.now()){let Q=$.get("retry-after");if(Q===null)return null;let Y=Number(Q);if(Number.isFinite(Y))return Math.max(0,Y*1000);let X=Date.parse(Q);return Number.isFinite(X)?Math.max(0,X-Z):null}function xS4($){try{let Z=JSON.parse($);if(Z!==null&&typeof Z==="object"){let Q=Z,Y=[...KB(Q.error),...KB(Q.error_description)];if(Y.length>0)return Y.join("; ")}}catch{}return $.slice(0,300)}async function SX($){let Z=await $.text().catch(()=>""),Q=Z?xS4(Z):$.statusText;return new f0({provider:"bitbucket",status:$.status,message:`Bitbucket API ${$.status}: ${Q}`,retryAfterMs:$.status===429?bS4($.headers):null})}async function kA($,Z){let Q=await $.text();try{return JSON.parse(Q)}catch(Y){throw new f0({provider:"bitbucket",status:$.status,message:`Bitbucket ${Z} returned invalid JSON: ${Q.slice(0,300)}`,cause:Y})}}async function _Y($,Z,Q={}){let Y={Authorization:Q.basicAuth?`Basic ${Buffer.from(`x-token-auth:${Z}`).toString("base64")}`:`Bearer ${Z}`,Accept:Q.accept??"application/json"},X=Q.body instanceof FormData;if(Q.body!==void 0&&!X)Y["Content-Type"]="application/json";try{return await fetch($,{method:Q.method??"GET",headers:Y,body:Q.body===void 0?void 0:X?Q.body:JSON.stringify(Q.body),signal:AbortSignal.timeout(Q.timeoutMs??vS4)})}catch(J){throw new f0({provider:"bitbucket",status:0,message:`Bitbucket request failed: ${J instanceof Error?J.message:String(J)}`,cause:J})}}function aD$($){if(!$.next)return null;try{let Z=new URL($.next).searchParams.get("page"),Q=Number(Z);return Z!==null&&Number.isInteger(Q)&&Q>0?Q:null}catch{return null}}function X3($){return`"${$.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}var vS4=15000,GQ;var v00=D(()=>{i4();T5();Um();GQ=oB("bitbucket",BD)});import{z as mZ}from"zod";function c81($){let{owner:Z,name:Q}=k5({path:$});if(!Z||!Q||Z.includes("/"))throw new f0({provider:"bitbucket",status:400,message:`${$} is not a Bitbucket repository path (expected workspace/repo_slug)`});return{workspace:Z,slug:Q}}function _j($){let{workspace:Z,slug:Q}=c81($.path);return`/repositories/${encodeURIComponent(Z)}/${encodeURIComponent(Q)}`}function gS4($,Z){return`${kJ($)}/get/${encodeURIComponent(Z)}.tar.gz`}function eD$($,Z){let Q=hS4.parse($),Y={provider:"bitbucket",host:Z,path:Q.full_name};return{ref:Y,externalId:Q.uuid,defaultBranch:Q.mainbranch?.name??null,webUrl:Q.links?.html?.href??kJ(Y),visibility:Q.is_private?"private":"public",description:Q.description??null,updatedAt:Q.updated_on??null}}async function YH0($,Z,Q){_00($);let Y=Q?.trim().toLowerCase();if(Y){let G=await l81(`${GQ}/workspaces/${encodeURIComponent(Y)}`,Z);if(G.ok)return $O$(G.json);throw G.failure}let X=await l81(`${GQ}/user`,Z);if(X.ok){let G=QO$.parse(X.json);return{externalAccountId:G.uuid,login:G.nickname,avatarUrl:G.links?.avatar?.href??null}}let J=await l81(`${GQ}/user/workspaces?pagelen=1`,Z);if(J.ok){let G=J.json.values?.[0];if(G?.workspace!==void 0)return $O$(G.workspace)}throw J.ok?new f0({provider:"bitbucket",status:401,message:"Bitbucket did not recognise this token. An access token cannot name itself \u2014 say which workspace it belongs to and connect it again."}):J.failure}function $O$($){let Z=uS4.parse($);return{externalAccountId:Z.uuid,login:Z.slug,avatarUrl:Z.links?.avatar?.href??null}}async function l81($,Z){let Q=await _Y($,Z);if(!Q.ok)return{ok:!1,failure:await SX(Q)};return{ok:!0,json:await kA(Q,"principal")}}class b00{kind="bitbucket";host;tokenSource;workspace;constructor($){_00($.host),this.host=BD,this.tokenSource=$.tokenSource,this.workspace=$.workspace?.trim().toLowerCase()||null}async tokenForRepo($,Z){return this.accountToken(Z)}async accountToken($){let Z=await this.tokenSource.get($);if(!Z)throw new f0({provider:"bitbucket",status:401,message:"Bitbucket account is not authenticated"});return Z}async getRepo($){let Z=await this.get(_j($));if(!Z)return null;return eD$(await kA(Z,"get_repo"),this.host)}async listRepos($={}){let Z=Math.min(u81,Math.max(1,$.perPage??yS4)),Q=new URLSearchParams({role:"member",sort:"-updated_on",pagelen:String(Z),page:String(Math.max(1,$.page??1))}),Y=$.query?.trim();if(Y)Q.set("q",`name ~ ${X3(Y)}`);let X=await this.workspaceSlugs(),J=await Promise.all(X.map(async(K)=>{let H=await this.get(`/repositories/${encodeURIComponent(K)}?${Q}`);if(!H)return{values:[],next:null};let F=await kA(H,"list_repos");if(!Array.isArray(F.values))throw new f0({provider:"bitbucket",status:502,message:`Bitbucket /repositories/${K} returned no values array`});return F})),G=J.flatMap((K)=>K.values??[]).map((K)=>eD$(K,this.host)).sort((K,H)=>(H.updatedAt??"").localeCompare(K.updatedAt??"")),W=X.length<=1;return{repositories:W?G:G.slice(0,Z),hasMore:J.some((K)=>!!K.next)||!W&&G.length>Z}}async workspaceSlugs(){if(this.workspace)return[this.workspace];let $=await this.get(`/user/workspaces?pagelen=${u81}`);if(!$)return[];return((await kA($,"list_workspaces")).values??[]).flatMap((Q)=>typeof Q.workspace?.slug==="string"?[Q.workspace.slug]:[])}async readFile($,Z,Q){let Y=Q;if(!Y){let J=await this.getRepo($);if(!J?.defaultBranch)return null;Y=J.defaultBranch}let X=await this.get(`${_j($)}/src/${encodeURIComponent(Y)}/${Nm(Z)}`,{accept:"text/plain, */*"});if(!X)return null;return X.text()}async archiveTarball($,Z){let Q=Z;if(!Q){let G=await this.getRepo($);if(!G?.defaultBranch)return null;Q=G.defaultBranch}let Y=gS4($,Q),X={accept:"application/octet-stream, */*",timeoutMs:fS4},J=await this.authedFetch(Y,X);if(J.status===401||J.status===403){await J.body?.cancel().catch(()=>{});let{token:G}=await this.accountToken();J=await _Y(Y,G,{...X,basicAuth:!0})}if(J.status===404)return await J.body?.cancel().catch(()=>{}),null;if(!J.ok)throw await SX(J);return J.body}async identity(){let $=await this.authedFetch(`${GQ}/user`);if($.status===401||$.status===403)return await $.body?.cancel().catch(()=>{}),null;if(!$.ok)throw await SX($);let Z=QO$.parse(await kA($,"identity"));return{name:Z.display_name||Z.nickname,email:await this.primaryEmail()??`${Z.nickname}@users.noreply.${this.host}`}}async primaryEmail(){let $=await this.authedFetch(`${GQ}/user/emails?pagelen=${u81}`);if(!$.ok)return await $.body?.cancel().catch(()=>{}),null;let Q=(await kA($,"user_emails").catch(()=>null))?.values??[],Y=Q.find((X)=>X.is_primary===!0&&X.is_confirmed!==!1)??Q.find((X)=>X.is_confirmed!==!1);return typeof Y?.email==="string"&&Y.email?Y.email:null}async get($,Z){let Q=await this.authedFetch(`${GQ}${$}`,Z);if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await SX(Q);return Q}async authedFetch($,Z={}){let Q=await this.accountToken(),Y=await _Y($,Q.token,Z);if(Y.status!==401)return Y;await Y.body?.cancel().catch(()=>{});let X=await this.accountToken({forceRefresh:!0});return _Y($,X.token,Z)}}function Nm($){return $.replace(/^\/+/,"").split("/").map((Z)=>encodeURIComponent(Z)).join("/")}var fS4=60000,yS4=30,u81=100,hS4,ZO$,QO$,uS4;var SA=D(()=>{i4();T5();Um();v00();hS4=mZ.object({uuid:mZ.string().min(1),full_name:mZ.string().min(1),is_private:mZ.boolean(),description:mZ.string().nullish(),mainbranch:mZ.object({name:mZ.string().nullish()}).nullish(),links:mZ.object({html:mZ.object({href:mZ.string()}).nullish()}).nullish(),updated_on:mZ.string().nullish()});ZO$=mZ.object({avatar:mZ.object({href:mZ.string().nullish()}).nullish()}).nullish(),QO$=mZ.object({uuid:mZ.string().min(1),nickname:mZ.string().min(1),display_name:mZ.string().nullish(),links:ZO$}),uS4=mZ.object({uuid:mZ.string().min(1),slug:mZ.string().min(1),links:ZO$})});function m81($,Z,Q){return{kind:Q,async get(Y){let X=Y?.forceRefresh?await $.get(Z):null,J=await J3({connectionId:Z,tokenStorage:$,bufferMs:Y?.bufferMs,force:Y?.forceRefresh===!0&&X!==null&&vj(X)});if(!J.accessToken)return null;return{token:J.accessToken,kind:Q,expiresAt:null}}}}function XH0($){return $==="token"?"token":"oauth"}function x00($){return d81($)===null}function d81($){if($.status!=="active")return"revoked";if($.authKind==="github_cli")return $.type==="github"&&$.host==="github.com"&&VA()?null:"provider_unavailable";if($.type==="github"&&$.authKind==="github_app"){if(wH()===null)return"provider_unavailable";if($.installationId===null)return"installation_missing";if(!$.installationAuthorizedBy)return"authorization_required";if($.installationRepositoryIds?.length===0)return"no_repositories"}return null}function TU($,Z){if(Z.status!=="active")throw new f0({provider:Z.type,status:403,message:"This git account was revoked. Reconnect it before accessing repositories."});if(Z.authKind==="github_app"&&(!Z.installationAuthorizedBy||Z.installationRepositoryIds?.length===0))throw new f0({provider:Z.type,status:403,message:"Reconnect this git account. A GitHub installation must be authorized by its account owner or by someone who administers repositories in it."});let Q=new P00($.db,$.vault);switch(Z.type){case"github":{if(Z.authKind==="github_cli")return new MA({host:Z.host,tokenSource:nD$(Z)});if(Z.authKind==="github_app"){let Y=wH();if(!Y)throw new f0({provider:"github",status:503,message:"GitHub App credentials are not configured on this deployment"});if(Z.installationId===null)throw new f0({provider:"github",status:403,message:"This GitHub account has no installation linked. Reconnect it to select repositories."});return new MA({host:Z.host,installationId:Z.installationId,repositoryIds:Z.installationRepositoryIds,appAuth:Y})}return new MA({host:Z.host,tokenSource:m81(Q,Z.id,XH0(Z.authKind))})}case"gitlab":return new C00({host:Z.host,tokenSource:m81(Q,Z.id,XH0(Z.authKind))});case"bitbucket":return new b00({workspace:Z.authKind==="token"?Z.login:null,host:Z.host,tokenSource:m81(Q,Z.id,XH0(Z.authKind))})}}function YO$($){if($.authKind==="github_app")return"installation";if($.authKind==="github_cli")return"token";return XH0($.authKind)}function f00($,Z,Q="installation"){return{ref:$,tokenSource:{kind:Q,get:()=>Promise.resolve({token:Z,kind:Q,expiresAt:null})}}}async function JH0($,Z){let Q=UD(Z);if(!Z.accountId)throw new f0({provider:Z.provider,status:401,message:`${Z.path} is linked without an account; link it again to read and write it`});let Y=await XO$($,Z,Z.accountId),X=TU($,Y),J=YO$(Y);return{ref:Q,tokenSource:{kind:J,get:(G)=>X.tokenForRepo(Q,G)}}}async function RU($,Z,Q){let Y=UD(Z);if(!Z.accountId)return lS4(Y);let X=await XO$($,Z,Z.accountId),J=TU($,X),W=YO$(X)==="installation"?await RD$((F,U)=>J.readFile({...Y,path:F},U),Y):[],K=await J.tokenForRepo(Y,{...Q,alsoRepositories:W}),H=K.kind==="installation"?null:await J.identity().catch(()=>null);return{cloneUrl:ve(Y,K.token),expiresAt:K.expiresAt,gitUserName:H?.name??PU.name,gitUserEmail:H?.email??PU.email}}function lS4($){return{cloneUrl:ve($),gitUserName:PU.name,gitUserEmail:PU.email}}async function XO$($,Z,Q){let Y=await new AA($.db).getUnscoped(Q);if(!Y||Y.organizationId!==Z.organizationId)throw new f0({provider:Z.provider,status:404,message:`The account backing ${Z.path} no longer exists. Link the repository again.`});return Y}async function GH0($,Z,Q){let Y=Q.repositoryId?await $.repositories.get(Q.repositoryId,Z):Q.ref?await $.repositories.findByRef(Z,Q.ref):null,X=Y?UD(Y):Q.ref??null;if(!X)return null;return{ref:X,repository:Y,servable:Y?await DD($,Y):!1}}async function DD($,Z){if(!Z.accountId)return!1;let Q=await $.gitProviderAccounts.getUnscoped(Z.accountId);return Q!==null&&x00(Q)}var WH0=D(()=>{i4();RW();I81();oK0();Wm();qD$();M00();rK0();$H0();Cj();SA();T5()});async function cS4($,Z){let Q=$.organization?.id;if(!Q)throw Error(k7);if(!Z.sourceConnectionId)throw Error(k7);let Y=await $.storage.connections.findById(Z.sourceConnectionId,Q);if(!Y)throw Error(k7);let{clientFromConnection:X}=await Promise.resolve().then(() => (xe(),KO$)),J=await X(Y,$,!0);try{let{result:G}=await ZB$((H)=>J.callTool({name:"MINT_REPO_TOKEN",arguments:{installationId:Z.installationId,owner:Z.owner,repo:Z.repo,permissions:H}}),$B$(Z.permissions)),W=G.structuredContent?.token;if(G.isError||!W)throw Error(k7);let K=G.structuredContent?.expiresAt;return{accessToken:W,expiresAt:K?new Date(K):null}}finally{await J.close().catch(()=>{})}}function mS4($,Z){return($?.getTime()??0)>Z?$:new Date(Z+WO$)}async function dS4($,Z,Q,Y){let X=Date.now(),J=await cS4($,Q),G=mS4(J.expiresAt,X);try{await Y.upsert({connectionId:Z,accessToken:J.accessToken,refreshToken:null,scope:null,expiresAt:G,clientId:null,clientSecret:null,tokenEndpoint:null})}catch(W){console.warn("[GithubMint] failed to persist minted token",{connectionId:Z,message:W instanceof Error?W.message:String(W)})}return J.accessToken}async function y00($,Z,Q){let Y=n9(Z);if(!Y)throw Error("Connection is not repo-scoped");if(!Y.sourceConnectionId)throw Error(k7);let X=new w9($.db,$.vault),J=await X.get(Z.id);if(!Q?.forceRefresh&&J&&!X.isExpired(J,h00))return J.accessToken;let G=i81.get(Z.id);if(G)return G;let W=dS4($,Z.id,Y,X).finally(()=>{i81.delete(Z.id)});return i81.set(Z.id,W),W}function JO$($){return $.slug==="mcp-github"}async function GO$($,Z,Q){if(n9(Z)?.sourceConnectionId)return y00($,Z,Q);return(await J3({connectionId:Z.id,connectionUrl:Z.connection_url,tokenStorage:new w9($.db,$.vault),force:Q?.forceRefresh})).accessToken}var i81;var g00=D(()=>{RW();_J();UH();i81=new Map});function iS4(){return process.env.GITHUB_GRAPHQL_URL??"https://api.github.com/graphql"}function nS4($){return $>=500&&$<600}function tS4($){return $ instanceof P5?$.cause:$}function oS4($,Z){try{return JSON.parse($)}catch(Q){throw Error(`GitHub GraphQL ${Z} returned invalid JSON: ${$.slice(0,300)}`,{cause:Q})}}function rS4($,Z){let Q=$.errors?.[0]?.message;if(Q)throw Error(`GitHub GraphQL ${Z} failed: ${Q}`);if($.data==null)throw Error(`GitHub GraphQL ${Z} returned no data`);return $.data}async function Bm($){let Z=await $.getToken();if(!Z)throw Error($.missingTokenMessage);let Q=(W)=>fetch(iS4(),{method:"POST",headers:{Authorization:`Bearer ${W}`,Accept:"application/vnd.github+json","Content-Type":"application/json"},body:JSON.stringify({query:$.query,variables:$.variables}),signal:AbortSignal.timeout(pS4)}),Y=async(W)=>{try{return await E8(async()=>{let K=await Q(W);if(nS4(K.status)){let H=K.status;throw await K.body?.cancel().catch(()=>{}),Error(`GitHub GraphQL transient error: ${H}`)}return K},{maxAttempts:3,minTimeout:300,maxTimeout:3000,jitter:1})}catch(K){throw tS4(K)}},X=await Y(Z),J=Z;if(X.status===401){try{await X.body?.cancel()}catch{}let W=await $.getToken(!0);if(!W)throw Error($.missingTokenMessage);if(X=await Y(W),J=W,X.status===401)throw Error($.missingTokenMessage)}let G=Km(J);if(Ij(X.headers,{lane:"graphql",operation:$.operation,installation:G}),qj(X)){let W=X.headers.get("retry-after")!==null?"secondary":"primary";Vj({lane:"graphql",operation:$.operation,installation:G,kind:W});let K=Mj(X.headers);throw await X.body?.cancel().catch(()=>{}),new f0({provider:"github",status:X.status,retryAfterMs:K,message:`GitHub ${W} rate limit reached${K===null?"":`; retry in ${Math.ceil(K/1000)}s`}`})}if(!X.ok)throw await X.body?.cancel().catch(()=>{}),new f0({provider:"github",status:X.status,message:`GitHub GraphQL ${$.label} failed: ${X.status}`});return rS4(oS4(await X.text(),$.label),$.label)}var pS4=15000;var KH0=D(()=>{a$();T5();T00();Hm()});function eS4($){if(!$)return null;if($.state!=="open")return!1;if(typeof $.mergeable==="boolean")return!$.mergeable;let Z=$.mergeable_state;if(typeof Z!=="string"||Z===""||Z==="unknown")return null;return Z==="dirty"}function $C4($){if($==="clean")return"passing";if($==="unstable")return"failing";return null}function p81($){let Z=$.merged===!0||typeof $.merged_at==="string";return{number:$.number??0,url:$.html_url??"",title:$.title??"",body:$.body??"",state:Z?"merged":$.state==="closed"?"closed":"open",draft:$.draft===!0,mergedAt:$.merged_at??null,updatedAt:$.updated_at??null,base:$.base?.ref??"main",head:$.head?.ref??"",headSha:$.head?.sha??"",headRepoPath:$.head?.repo?.full_name??null,author:$.user?.login??"",conflicting:eS4($),checks:$C4($.mergeable_state),changedFiles:typeof $.changed_files==="number"?$.changed_files:null}}function ZC4($){if($==="IN_PROGRESS")return"running";if($==="COMPLETED")return"completed";return"queued"}function QC4($){switch($){case"SUCCESS":return"success";case"FAILURE":case"STARTUP_FAILURE":return"failure";case"NEUTRAL":case"STALE":return"neutral";case"CANCELLED":return"cancelled";case"SKIPPED":return"skipped";case"TIMED_OUT":return"timed_out";case"ACTION_REQUIRED":return"action_required";default:return null}}function GC4($){let Z=$.state;return{id:null,name:$.context??"",state:Z==="PENDING"||Z==="EXPECTED"?"running":"completed",conclusion:Z==="SUCCESS"?"success":Z==="FAILURE"||Z==="ERROR"?"failure":Z==="PENDING"||Z==="EXPECTED"?null:"neutral",url:$.targetUrl??null,durationMs:null,summary:$.description??null}}function WC4($){let Z=$.commits?.nodes?.[0]?.commit?.statusCheckRollup?.contexts?.nodes??[],Q=[];for(let Y of Z){if(!Y)continue;if(Y.__typename==="StatusContext"){Q.push(GC4(Y));continue}if(Y.__typename!=="CheckRun")continue;let{startedAt:X,completedAt:J}=Y;Q.push({id:Y.databaseId==null?null:String(Y.databaseId),name:Y.name??"",state:ZC4(Y.status),conclusion:QC4(Y.conclusion),url:Y.detailsUrl??null,durationMs:X&&J?new Date(J).getTime()-new Date(X).getTime():null,summary:Y.summary??null})}return Q}function KC4($,Z){let Q=($.reviewThreads?.nodes??[]).filter((K)=>K?.isResolved===!1).length,Y=$.reviewDecision,X=Y==="REVIEW_REQUIRED"||Y==="CHANGES_REQUESTED",J=WC4($),G=$.number??0,W=$.merged===!0;return{number:G,url:$.url??zW(Z,G),title:$.title??"",body:$.body??"",state:W?"merged":$.state==="OPEN"?"open":"closed",draft:$.isDraft===!0,mergedAt:$.mergedAt??null,updatedAt:$.updatedAt??null,base:$.baseRefName??"main",head:$.headRefName??"",headSha:$.headRefOid??"",headRepoPath:$.headRepository?.nameWithOwner??null,author:$.author?.login??"",conflicting:$.state!=="OPEN"?!1:$.mergeable==="CONFLICTING"?!0:$.mergeable==="MERGEABLE"?!1:null,checks:Ym(J),changedFiles:$.changedFiles??null,checkRuns:J,comments:($.comments?.nodes??[]).flatMap((K)=>K?[{id:String(K.databaseId??0),author:K.author?.login??"",body:K.body??"",createdAt:K.createdAt??"",updatedAt:K.updatedAt??K.createdAt??"",url:K.url??""}]:[]),unresolvedConversations:Q,reviewBlocked:X}}function HC4($){let Z=null,Q=-1/0;for(let Y of $??[]){if(!Y?.mergedAt)continue;let X=Date.parse(Y.mergedAt);if(Number.isNaN(X)||X<=Q)continue;Z=Y,Q=X}return Z}function HO$($){return/not allowed on this repository/i.test($)}class n81{repo;tokenSource;apiBaseUrl;owner;name;constructor($){this.repo=$.repo,this.tokenSource=$.tokenSource,this.apiBaseUrl=kW($.repo.host);let{owner:Z,name:Q}=k5($.repo);this.owner=Z,this.name=Q}async token($){return(await this.tokenSource.get($?{forceRefresh:!0}:void 0))?.token??null}async requireToken(){let $=await this.token();if($)return $;throw new f0({provider:"github",status:401,message:`No usable GitHub token for ${this.repo.path}; reconnect the account`})}get base(){return`${this.apiBaseUrl}/repos/${this.owner}/${this.name}`}async rest($,Z){let Q=await o9(`${this.base}${$}`,{method:Z.method,body:Z.body,token:await this.requireToken(),operation:Z.operation});if(Q.status===404)return await Q.body?.cancel().catch(()=>{}),null;if(!Q.ok)throw await cZ(Q,Z.operation);if(Q.status===204)return null;return JQ(Q,Z.operation)}graphql($){return Bm({getToken:(Z)=>this.token(Z),missingTokenMessage:`No usable GitHub token for ${this.repo.path}; reconnect the account`,...$})}async read($){let Z=await this.rest(`/pulls/${$}`,{operation:"change_request_read"});return Z?p81(Z):null}async readForBranch($){return await this.readDetailed({branch:$})}async readDetailed($){let Z="number"in $,Y=(await this.graphql({query:Z?XC4:YC4,variables:Z?{owner:this.owner,repo:this.name,number:$.number}:{owner:this.owner,repo:this.name,branch:$.branch},label:`change request for ${this.repo.path}`,operation:"change_request_detail"})).repository;if(!Y)throw new f0({provider:"github",status:404,message:`${this.repo.path} is not accessible with this credential`});let X=Z?Y.pullRequest:Y.pullRequests?.nodes?.[0];return X?KC4(X,this.repo):null}async listOpen($){return(await this.rest(`/pulls?state=open&sort=updated&direction=desc&per_page=${Math.min($,100)}`,{operation:"change_request_list"})??[]).map(p81)}async lastMergedInto($){let Z=await this.graphql({query:JC4,variables:{owner:this.owner,repo:this.name,base:$},label:`last merged into ${$} on ${this.repo.path}`,operation:"change_request_last_merged"});if(!Z.repository)throw new f0({provider:"github",status:404,message:`${this.repo.path} is not accessible with this credential`});let Q=HC4(Z.repository.pullRequests?.nodes);if(!Q)return null;let Y=Q.number??0;return{number:Y,url:Q.url??zW(this.repo,Y),title:Q.title??"",body:Q.body??"",state:"merged",draft:!1,mergedAt:Q.mergedAt??null,updatedAt:Q.mergedAt??null,base:Q.baseRefName??$,head:Q.headRefName??"",headSha:Q.headRefOid??"",headRepoPath:null,author:Q.author?.login??"",conflicting:!1,checks:null,changedFiles:null}}async open($){let Z=await o9(`${this.base}/pulls`,{method:"POST",token:await this.requireToken(),operation:"change_request_open",body:{title:$.title,body:$.body||void 0,head:$.head,base:$.base}});if(Z.ok)return p81(await JQ(Z,"change_request_open"));let Q=await cZ(Z,"change_request_open");if(/already exists|pull request already/i.test(Q.message))throw new PA(Q.message,await this.readForBranch($.head).catch(()=>null));throw Q}async describe($,Z){await this.rest(`/pulls/${$}`,{method:"PATCH",body:{body:Z},operation:"change_request_describe"})}async merge($,Z={}){let Q=sS4[Z.strategy??"any"],Y="";for(let X of Q){let J=await this.attemptMerge($,X,Z);if(J.merged)return J;if(J.reason==="blocked"&&HO$(J.detail)){Y=J.detail;continue}return J}return{merged:!1,reason:"blocked",detail:Y}}async attemptMerge($,Z,Q){let Y;try{Y=await o9(`${this.base}/pulls/${$}/merge`,{method:"PUT",token:await this.requireToken(),operation:"change_request_merge",body:{merge_method:Z,...Q.commitTitle?{commit_title:Q.commitTitle}:{},...Q.commitMessage?{commit_message:Q.commitMessage}:{}}})}catch(G){return{merged:!1,...FC4(G)}}if(Y.ok)return await Y.body?.cancel().catch(()=>{}),{merged:!0};let X=await cZ(Y,"change_request_merge");if(Y.status===404)return{merged:!1,reason:"not_found",detail:X.message};if(HO$(X.message))return{merged:!1,reason:"blocked",detail:X.message};return{merged:!1,reason:await this.read($).then((G)=>G?.conflicting??null).catch(()=>null)===!0?"conflict":"blocked",detail:X.message}}async readCheckLog($){let Z=await this.rest(`/check-runs/${encodeURIComponent($)}`,{operation:"change_request_check_log"});return Z?.output?.summary??Z?.output?.text??null}async readDeployedUrl($){let Z=await this.rest(`/deployments?sha=${encodeURIComponent($)}&per_page=${aS4}`,{operation:"change_request_deployments"});for(let Q of Z??[]){if(typeof Q.id!=="number")continue;let X=(await this.rest(`/deployments/${Q.id}/statuses?per_page=10`,{operation:"change_request_deployment_statuses"})??[]).find((J)=>J.state==="success"&&typeof J.environment_url==="string"&&J.environment_url.length>0);if(X?.environment_url)return X.environment_url}return null}}function FC4($){let Z=$ instanceof Error?$.message:String($);if($ instanceof f0&&$.isRateLimited)return{reason:"rate_limited",detail:Z};return{reason:"error",detail:Z}}var sS4,aS4=3,FO$=`
 fragment CrDetail on PullRequest {
   number
@@ -1211,7 +1211,7 @@ ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{
 `);yield B?OR$(B):"alive"}}}catch(W){if(Y.signal.aborted&&!Z?.aborted)throw Y.signal.reason;throw W}finally{clearTimeout(X)}}async hostStall($,Z){let Q=Date.now(),Y=0;while(!Z.aborted){let X=!1,J="";try{for await(let G of this.watchOnce($,Z))if(Q=Date.now(),Y=0,G!=="alive"&&FR$(G))break;X=!0}catch(G){if(Z.aborted)return null;if(G instanceof ET0)return console.warn(`[${pm}] ${G.message} for ${$}: its progress is unbounded`),null;J=nm(G)}if(Date.now()-Q>=this.stallMs)return new Nf(`the host showed no progress for ${$} in ${this.stallMs/1000}s${J?`: ${J}`:""}`);await O$(X?this.stallMs/4:UR$(Y++),{signal:Z}).catch(()=>{})}return null}async*watchClaimLifecycle($,Z){let Q=jT0(Z,this.closed.signal),Y=Date.now(),X=0,J="";while(!Q?.aborted){let G="watch ended before ready";try{for await(let W of this.watchOnce($,Q)){if(Y=Date.now(),X=0,W==="alive")continue;let K=JSON.stringify(W);if(K!==J)J=K,yield W;if(FR$(W))return}}catch(W){if(Q?.aborted)return;if(W instanceof ET0){yield zT0(W.message);return}G=`watch failed: ${nm(W)}`}if(Date.now()-Y>=this.stallMs){yield zT0(G);return}await O$(UR$(X++),{signal:Q}).catch(()=>{})}}}function OR$($){let Z;try{Z=JSON.parse($)}catch{return zT0("host sent a non-JSON phase")}let Q=EL$.safeParse(Z);return Q.success?Q.data:zT0(`host sent a malformed phase: ${Q.error.message}`)}var pm="RemoteSandboxProvider",HR$=30000,Ld4=2147483647,NR$=500,wd4=10,jd4=0.5,BR$=5000,Ed4=3000,zd4=300000,Pd4=5000,Nf,ET0;var V91=D(()=>{SF();Sl();a$();Gf();z41();ym();ZT0();QT0();OT0();Nf=class Nf extends Error{constructor($){super($);this.name="SandboxHostError"}};ET0=class ET0 extends Error{}});var ER$={};$6(ER$,{subscribeLifecycle:()=>v91,readControlPlaneSandboxConfig:()=>v10,getOrInitSharedRunner:()=>b10,getAgentSandboxProviderForTeardown:()=>_91,getAgentSandboxProvider:()=>gX,__resetSharedLifecyclesForTesting:()=>xd4});function S91($){let Z=_10[LR$];if(Z)return Promise.resolve(Z);let Q=_10[k91];if(Q)return Q;let Y=$().then((X)=>{return _10[LR$]=X,X}).finally(()=>{delete _10[k91]});return _10[k91]=Y,Y}function qd4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Md4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Id4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Vd4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function kd4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}function v10(){let $=process.env.STUDIO_SANDBOX_CONTROL_PLANE_URL?.trim(),Z=process.env.STUDIO_SANDBOX_CONTROL_PLANE_TOKEN?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_CONTROL_PLANE_URL and STUDIO_SANDBOX_CONTROL_PLANE_TOKEN must both be set, or both unset.");return{url:$,token:Z}}async function C91($){let Z=process.env.FREESTYLE_API_KEY?.trim();if(!Z)return wR$($);let Q=await wR$($).catch((J)=>{console.warn("[lifecycle] kubernetes sandbox provider unavailable, using Freestyle only:",J instanceof Error?J.message:String(J));return}),[{FreestyleSandboxProvider:Y},{SandboxProviderRouter:X}]=await Promise.all([Promise.resolve().then(() => (GR$(),JR$)),Promise.resolve().then(() => (M91(),q91))]);return new X({kubernetes:Q,freestyle:new Y({apiKey:Z,image:process.env.STUDIO_SANDBOX_FREESTYLE_IMAGE?.trim()||void 0,meter:e1})},{freestyleShare:Sd4()})}function Sd4(){let $=Number(process.env.STUDIO_SANDBOX_FREESTYLE_SHARE??0);if(Number.isFinite($)&&$>=0&&$<=1)return $;return console.warn("[lifecycle] STUDIO_SANDBOX_FREESTYLE_SHARE must be a number from 0 to 1; using 0"),0}async function wR$($){let Z=v10();if(Z){let{RemoteSandboxProvider:K}=await Promise.resolve().then(() => (V91(),I91));return new K({baseUrl:Z.url,token:Z.token,credentialLifetimeMs:{orgFsConfig:KT0},meter:e1})}let Q=new m00($),Y=qd4(),{AgentSandboxProvider:X}=await Promise.resolve().then(() => (q10(),eA$)),J=new UX(E0().encryptionKey),G=MH0($,J),W=JT0(process.env.STUDIO_SANDBOX_TENANT_POOLS);return new X({stateStore:Q,previewUrlPattern:Y,sandboxTemplateName:Md4(),envName:Id4(),previewGateway:kd4(),sentinelToken:Vd4(),tenantPools:ZT$(W),mintPoolCloneUrl:QT$(W,G.mintCloneUrl),meter:e1,...G})}function gX($){if(!E0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return S91(()=>C91($.db))}function _91($){return S91(()=>C91($.db))}async function b10(){if(!E0().agentSandboxEnabled)return null;return S91(()=>C91(D8().db))}function v91($,Z,Q){let Y=tj.get(Z);if(Y){if(Y.terminated){if(Y.lastPhase)try{Q(Y.lastPhase)}catch{}return{unsubscribe:vd4}}if(Y.listeners.add(Q),Y.lastPhase)try{Q(Y.lastPhase)}catch{}return jR$(Z,Y,Q)}let X=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:X};return tj.set(Z,J),bd4($,Z,J),jR$(Z,J,Q)}function vd4(){}function jR$($,Z,Q){return{unsubscribe(){if(tj.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)tj.delete($),Z.abort.abort()}}}async function bd4($,Z,Q){let Y=null;try{for await(let X of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=X;let J=X.kind==="ready"||X.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let W of G)try{W(X)}catch{}if(J)break}}catch(X){Y=X}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let X={kind:"failed",reason:"unknown",message:Y instanceof Error?Y.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=X,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(X)}catch{}}if(tj.get(Z)===Q)tj.delete(Z)}}function xd4(){for(let $ of tj.values())$.abort.abort();tj.clear()}var LR$,k91,_10,Cd4,_d4,tj;var xW=D(()=>{SG();k6();B41();BL();X$();L41();HT0();GT0();LR$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),k91=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),_10=globalThis;Cd4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),_d4=globalThis,tj=_d4[Cd4]??=new Map});import{sql as fd4}from"kysely";function zR$($){return $ instanceof Date?$.toISOString():String($)}class b91{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:zR$($.created_at),updatedBy:$.updated_by,updatedAt:zR$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new oj($.id)}async create($){let Z=i8("sec"),Q=await this.vault.encrypt($.value),Y=new Date,X=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(PT0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new fW($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let Y=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(PT0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Y)throw new fW($);this.assertVisible(Y,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(PT0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Y)=>Y.or([Y("scope","=","organization"),Y.and([Y("scope","=","user"),Y("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Y)=>this.rowToInfo(Y))}async findById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(PT0).executeTakeFirst();if(!Y)throw new fW($);return this.assertVisible(Y,Q),this.rowToInfo(Y)}async resolveById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Y)throw new fW($);this.assertVisible(Y,Q);let X=await this.vault.decrypt(Y.encrypted_value);return{info:this.rowToInfo(Y),value:X}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(fd4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new fW(`${$.scope.kind}:${$.name}`);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}}var PT0,fW,oj;var x10=D(()=>{FY();PT0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];fW=class fW extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};oj=class oj extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function AT0({ctx:$,orgId:Z,userId:Q,entries:Y}){if(!Y||Y.length===0)return[];let X=[];for(let J of Y)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);X.push({host:J.host,token:G})}catch(G){if(G instanceof fW||G instanceof oj){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return X}var x91=D(()=>{x10()});function s9($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function TH($,Z,Q){let Y=$[Z]?.[Q];if(!Y)return null;return HB(Y)[uQ]??null}function f10($,Z,Q,Y){let J={...HB($[Z]?.[Q]),[uQ]:Y};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function PR$($,Z,Q,Y,X,J){let G=await $.findById(Z);if(!G)return;let W=G.metadata??{},K=f10(s9(W),Y,X,J);await $.update(Z,Q,{metadata:{...W,sandboxMap:K}})}function f91($,Z,Q){let Y=HB($[Z]?.[Q]);if(!Y[uQ])return null;let X={...Y};delete X[uQ];let J={...$[Z]??{}};if(Object.keys(X).length===0)delete J[Q];else J[Q]=X;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function rj($,Z,Q,Y,X){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},W=f91(s9(G),Y,X);if(!W)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:W}})}var uQ="agent-sandbox";var lJ=D(()=>{p8()});async function y10($,Z,Q){let Y=$.storage.threads.getOrganizationId();if(!Y||!Z)return null;let X=await(Q??$.storage.virtualMcps.findById(Z,Y));return X?.organization_id===Y?X.metadata??null:null}function qD($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function RH($,Z={}){let Q=$.replace(/^thread:/,"").replace(/\//g,"-");return Z.flat?`sandbox-thread-${Q}`:`sandbox/thread-${Q}`}function Bf($){return $==="gitlab"}async function y91($,Z,Q){if(!Q)return RH(Z);return RH(Z,{flat:Bf(await yd4($,Q))})}async function yd4($,Z){let Q=typeof Z.url==="string"?IY(Z.url)?.provider:void 0;if(Q)return Q;let Y=$.storage.threads.getOrganizationId();if(!Z.repositoryId||!Y)return null;return(await $.storage.repositories.get(Z.repositoryId,Y).catch(()=>null))?.provider??null}function bU($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Df($,Z,Q){return h91(await g91($,Z),Q)}async function g91($,Z){let Q=bU(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function h91($,Z){return $?.created_by??Z}async function sj($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function TT0($,Z){let Y=(await sj($,Z))?.headRef;return typeof Y==="string"&&Y.length>0?Y:null}async function AR$($,Z,Q){let Y=await sj($,Z);if(!Y)return;if(Y.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...Y,headRef:Q}}).catch((X)=>console.warn("[thread-repo] setThreadHeadRef failed",X))}function gd4($,Z){let Q=yK0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let Y=n9(Q);return{...$,connectionId:Q.id,...Y?.installationId?{installationId:Y.installationId}:{}}}async function u91($,Z){let Y=(await sj($,Z))?.additionalRepositories;return Array.isArray(Y)?Y.filter((X)=>X?.owner&&X?.name):[]}async function xU($,Z){let Q=await sj($,Z),Y=Q?.repository??null;if(!Z||!Q||!Y?.connectionId||Y.repositoryId)return Y;try{let X=$.storage.threads.getOrganizationId();if(!X)return Y;if(await $.storage.connections.findById(Y.connectionId,X))return Y;let{items:J}=await $.storage.connections.list(X),G=gd4(Y,J);if(!G)return Y;return await $.storage.threads.update(Z,{metadata:{...Q,repository:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Y.connectionId,to:G.connectionId}),G}catch(X){return console.warn("[thread-repo] repoint check failed",X),Y}}function l91($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===qD($.threadId))return $.runBranch;if($.threadRepo)return qD($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function c91($,Z){let Y=(await sj($,Z))?.pinnedRef;return typeof Y==="string"&&Y.length>0?Y:null}async function tm($,Z){let[Q,Y]=await Promise.all([xU($,Z.threadId),c91($,Z.threadId)]);return l91({...Z,threadRepo:Q,pinnedRef:Y})}async function TR$($,Z,Q,Y,X){let J=await sj($,Z);if(!J)return;let G=f10(s9(J),Q,Y,X);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function RT0($,Z){return s9(await sj($,Z))}async function RR$($,Z,Q,Y){let X=await sj($,Z);if(!X)return;let J=f91(s9(X),Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...X,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var yW=D(()=>{i4();_J();lJ()});function g10($){let Z=new Set($.map((F)=>F.name.toLowerCase()).filter((F,U,N)=>N.indexOf(F)!==U)),Q=$.map((F)=>Z.has(F.name.toLowerCase())),Y=(F)=>{let U=$[F];return m91(Q[F]?`${U.owner}-${U.name}`:U.name).toLowerCase()};for(let F=0;F<$.length;F++){let U=new Map,N=!1;for(let B=0;B<$.length;B++){let O=Y(B),L=U.get(O);if(L!==void 0){if(!Q[B])Q[B]=!0,N=!0;if(!Q[L])Q[L]=!0,N=!0}U.set(O,B)}if(!N)break}let X=$.map((F,U)=>m91(Q[U]?`${F.owner}-${F.name}`:F.name)),J=new Map;for(let F of X)J.set(F.toLowerCase(),(J.get(F.toLowerCase())??0)+1);let G=X.map((F,U)=>{if(J.get(F.toLowerCase())===1)return F;let N=new URL($[U].url).host;return m91(`${N}-${F}`)}),W=new Map;for(let F of G)W.set(F.toLowerCase(),(W.get(F.toLowerCase())??0)+1);let K=new Set(G.filter((F)=>W.get(F.toLowerCase())===1).map((F)=>F.toLowerCase())),H=G.map((F,U)=>U).filter((F)=>W.get(G[F].toLowerCase())!==1).sort((F,U)=>(No($[F])??"").localeCompare(No($[U])??""));for(let F of H){let U=G[F],N=1,B=`${U}-${N}`;while(K.has(B.toLowerCase()))B=`${U}-${++N}`;K.add(B.toLowerCase()),G[F]=B}return G}function qR$($,Z){let Q=$.findIndex((Y)=>BB(Y,Z));return Q===-1?null:g10($)[Q]??null}function m91($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}var d91=()=>{};import{AsyncLocalStorage as hd4}from"async_hooks";function h10(){let $=U3.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function qT0($){if($?.metadata?.source==="jira")return ld4;return MW.some((Q)=>Lj($?.title,Q))?ud4:MR$}var U3,MR$,ud4,ld4;var MD=D(()=>{x4();U3=new hd4;MR$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],ud4=[...MR$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],ld4=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD","JIRA_ISSUE_CREATE","JIRA_ISSUE_SEARCH"]});import{z as N3}from"zod";async function id4($,Z,Q,Y,X){return E8(async()=>{let G=TH(await RT0($,Z),Q,Y)??(X?TH(s9(await y10($,X)),Q,Y):null);if(!G)throw Error("sandbox record not written yet");return G},{maxAttempts:cd4,minTimeout:md4,maxTimeout:dd4,jitter:0}).catch(()=>null)}function nd4($,Z,Q=VR$){if($.some((Y)=>BB(Y,Z)))return!1;return $.length>=Q}async function p91($,Z,Q,Y){let X=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:Y})});if(!X.ok)throw Error(`sandbox bash failed (${X.status} ${X.statusText})`);let J=await X.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function kR$($){return`cd ${$} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`}async function td4($,Z,Q,Y){let X=()=>p91($,Z,Q,kR$(Y)).then((W)=>SR$(W.stdout)).catch(()=>null),J=await X();if(!J?.cloned)return!1;await O$(i91);let G=await X();return!!G?.cloned&&G.listing===J.listing}function SR$($){let Z=$.split(`
 `).map((X)=>X.trim()),Q=Z.includes("__CLONED__"),Y=Z.filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Q,listing:Y.join(`
 `)}}function od4($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...rd4].join(`
-`)}async function sd4($,Z,Q){if(Q.repository)return RU($,Q.repository,{bufferMs:MT0});return await jm({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),qU(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:MT0})}async function ad4($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return AT0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function ed4($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function $i4($,Z,Q,Y){let X=g10(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await bj($.storage,Z,G),H=K&&await DD($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await RU($,H,{bufferMs:MT0}):await qU(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:MT0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var MT0=3300000,cd4=4,md4=250,dd4=2000,IR$=45000,i91=1500,pd4=5,VR$=20,rd4,n91;var CR$=D(()=>{k0();Z7();c00();EH0();xW();i00();x91();lJ();yW();a$();d91();MD();rd4=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];n91=c({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. If your workspace already names a repository, use that checkout directly. For a workspace without a repository, call this once with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:N3.object({id:N3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:N3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:N3.object({success:N3.boolean(),repositories:N3.array(N3.object({id:N3.string(),repo:N3.string()})).optional(),repo:N3.string().optional(),cloned:N3.boolean().optional(),files:N3.string().optional(),message:N3.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=p0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=h10(),J=await xj(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((G0)=>G0.id===G):void 0;if(!W){let G0=J.map((N0)=>({id:N0.id,repo:N0.label}));return{success:!1,repositories:G0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:G0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=K.metadata?.repository?null:await y10(Z,K.virtual_mcp_id),F=await tm(Z,{threadId:X,runBranch:K.branch,agentRepo:H?.repository}),U=await Df(Z,F,Y),N=await id4(Z,X,U,F,H?.repository?K.virtual_mcp_id:null);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.repository??H?.repository,O=K.metadata?.additionalRepositories??[],L={url:W.webUrl,repositoryId:W.repository?.id},w=B&&BB(B,L),j=await gX(Z);if(w&&await td4(j,N.sandboxHandle,X,"."))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`${W.label} is already checked out at your working directory.`};if(B&&!w&&nd4(O,L))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`This run already has ${VR$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:E,gitUserName:z,gitUserEmail:T}=await sd4(Z,Q.id,W),A={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},P=!B||!!w,q=P?[]:await Z.storage.threads.appendThreadRepository(X,A);if(!B)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},repository:A},updated_by:Y});let x=jH0({branch:F,derivedRef:RH(F,{flat:Bf(W.provider)}),recordedHeadRef:null,sticky:!1}),_=await ad4(Z,Q.id,Y),V=await j.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(ed4({...P?{primary:{cloneUrl:E,branch:x,repoName:`${W.owner}/${W.name}`}}:{secondaries:await $i4(Z,Q.id,q,_)},submoduleCredentials:_,gitUserName:z,gitUserEmail:T}))});if(!V.ok)throw Error(`the sandbox rejected the repository (${V.status} ${V.statusText})`);await j.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((G0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",G0)});let y=P?null:qR$(q,A),g=P||!y?".":`"$(dirname "$PWD")/repos/${y}"`,l=Date.now()+IR$,i=!1,p="",U0=0,v0=null;while(Date.now()<l){let G0=await p91(j,N.sandboxHandle,X,kR$(g)).catch(()=>null);if(!G0){if(++U0>=pd4)break;await O$(i91);continue}U0=0;let N0=SR$(G0.stdout);if(N0.cloned&&N0.listing===v0){i=!0,p=N0.listing;break}v0=N0.cloned?N0.listing:null,await O$(i91)}if(i)await p91(j,N.sandboxHandle,X,od4(P?null:`../repos/${y}`)).catch((G0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",G0));return{success:i,repo:`${W.owner}/${W.name}`,cloned:i,files:p,message:i?P?`${W.label} is checked out at your working directory on branch ${x}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${y}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(IR$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as b1}from"zod";var om=50000,rm=500,IT0=200,sm=50000,ID,u10,Of,Zi4,Qi4,Yi4,_R$,am,Xi4,Ji4,vR$;var cJ=D(()=>{x4();x4();ID=b1.enum(OH),u10=b1.enum(["bug","feature","chore","spike","security"]),Of=b1.enum(["none","low","medium","high","urgent"]),Zi4=b1.object({threadId:b1.string(),virtualMcpId:b1.string().nullable(),status:b1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:b1.string().nullable(),lastMessage:b1.string().nullable(),hasPreview:b1.boolean(),failureKind:b1.string().nullable(),hasMessages:b1.boolean(),costUsd:b1.number().nullable(),costProvider:b1.string().nullable(),createdAt:b1.string(),lastActiveAt:b1.string()}),Qi4=b1.object({reviewer:b1.enum(MW),verdict:b1.enum(["approved","changes_requested"]),verified:b1.boolean()}),Yi4=b1.object({id:b1.string(),name:b1.string(),color:b1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:b1.string(),createdAt:b1.string().datetime()}),_R$=b1.object({url:b1.string(),number:b1.number(),repoOwner:b1.string(),repoName:b1.string(),createdAt:b1.string(),updatedAt:b1.string().nullable(),title:b1.string().nullable(),body:b1.string().nullable(),state:b1.enum(["open","closed"]).nullable(),draft:b1.boolean().nullable(),merged:b1.boolean().nullable(),mergeable:b1.boolean().nullable(),checksStatus:b1.enum(["pending","passing","failing"]).nullable(),checks:b1.array(b1.object({name:b1.string(),status:b1.string(),conclusion:b1.string().nullable(),detailsUrl:b1.string().nullable(),summary:b1.string().nullable()})),previewUrl:b1.string().nullable()}),am=b1.object({id:b1.string(),organizationId:b1.string(),title:b1.string(),description:b1.string().nullable(),status:ID,priority:Of,type:u10,assigneeId:b1.string().nullable(),assignedBy:b1.string().nullable(),repo:b1.string().nullable(),repositoryId:b1.string().nullable(),dueDate:b1.string().datetime().nullable(),sortOrder:b1.number(),keySeq:b1.number().nullable(),externalUrl:b1.string().nullable(),previewRoutes:b1.array(b1.string()),source:b1.enum(["jira"]).nullable(),retryAttempts:b1.number(),reviewCycleStartedAt:b1.string().datetime().nullable(),threads:b1.array(Zi4),tags:b1.array(Yi4),reviewVerdicts:b1.array(Qi4),statusSince:b1.string().datetime().nullable(),createdBy:b1.string(),createdAt:b1.string().datetime(),updatedBy:b1.string(),updatedAt:b1.string().datetime()}),Xi4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported","finding_resolved"],Ji4=b1.enum(Xi4),vR$=b1.object({id:b1.string(),taskBoardItemId:b1.string(),action:Ji4,actorId:b1.string().nullable(),data:b1.record(b1.string(),b1.unknown()),occurredAt:b1.string().datetime()})});async function VT0($,Z,Q){if(Q===R8)return;let{members:Y}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!Y.some((X)=>X.userId===Q))throw Error("assigneeId is not a member of the organization")}var t91=D(()=>{cJ()});async function kT0($,Z,Q){let Y=await $.storage.tags.listOrgTags(Z),X=new Set(Y.map((J)=>J.id));for(let J of Q)if(!X.has(J))throw Error(`Tag not found: ${J}`)}function fR$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(Gi4))continue;Z[Q]=Y}return Z}function ST0($){return{taskBoardItemId:$.id,...XQ($)&&{[bR$]:xR$}}}function Wi4($){return $?.[bR$]===xR$}function Ki4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function Hi4($,Z){let Q=E0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&Aw.provisionKey){let J=await TQ(X,$.auth?.user?.email),G=await Aw.provisionKey(J,Ki4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function yR$($,Z,Q){if(!E0().taskQuotaEnforced)return;if(!Wi4(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!XQ(X))return;if(!await OD$($,Y))return;return await Hi4($,Z)}function gR$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var Gi4="srv.",bR$="srv.billing",xR$="subscription";var l10=D(()=>{dl();VK();X$();IW()});function c10($){let Z=$?.runClass;return Z&&Z in o91?o91[Z]:o91.interactive}var o91,em="runClass";var $d=D(()=>{o91={interactive:10,reviewer:20,retry:30,new_task:40}});async function CT0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),Fi4)})])}finally{if(Y)clearTimeout(Y)}}function Ui4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function _T0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function I6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=Hj.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((w)=>jP(w.providerId)),F=await BF$($,Y,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await CT0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:_T0(w,F)}}for(let w of[K,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await CT0($,w.keyId,Y).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:_T0(j,w.modelId,w.title)}}if(H.length===0)throw new Zd(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await CT0($,w.id,Y).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=fn1(B,N),L=Ui4(Z,O);if(!L)throw new Zd(Z);return{credentialId:L.keyId,modelId:L.modelId,modelMeta:_T0(N[L.keyId]??[],L.modelId,L.title)}}async function hR$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new m10(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!jP(X.providerId))throw new m10(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await CT0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:_T0(J,Q)}}async function yY($,Z){try{return await I6($,Z)}catch(Q){if(Q instanceof Zd)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var Zd,m10,Fi4=5000;var gY=D(()=>{WH();t9();p8();Zd=class Zd extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};m10=class m10 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});import{z as e6}from"zod";function pR$($){let Z=["The user spoke this request to the voice companion. Transcripts may contain errors; ask if unclear. Changes or cancellations refer to existing work, not a duplicate task."];if($.length>0)Z.push("Earlier spoken conversation, as context only. Do not repeat earlier actions or treat the voice assistant's words as authorization:",JSON.stringify($));return Z.join(`
+`)}async function sd4($,Z,Q){if(Q.repository)return RU($,Q.repository,{bufferMs:MT0});return await jm({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),qU(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:MT0})}async function ad4($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return AT0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function ed4($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function $i4($,Z,Q,Y){let X=g10(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await bj($.storage,Z,G),H=K&&await DD($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await RU($,H,{bufferMs:MT0}):await qU(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:MT0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var MT0=3300000,cd4=4,md4=250,dd4=2000,IR$=45000,i91=1500,pd4=5,VR$=20,rd4,n91;var CR$=D(()=>{k0();Z7();c00();EH0();xW();i00();x91();lJ();yW();a$();d91();MD();rd4=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];n91=c({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. If your workspace already names a repository, use that checkout directly. For a workspace without a repository, call this once with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:N3.object({id:N3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:N3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:N3.object({success:N3.boolean(),repositories:N3.array(N3.object({id:N3.string(),repo:N3.string()})).optional(),repo:N3.string().optional(),cloned:N3.boolean().optional(),files:N3.string().optional(),message:N3.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=J0(Z),Y=p0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=h10(),J=await xj(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((G0)=>G0.id===G):void 0;if(!W){let G0=J.map((N0)=>({id:N0.id,repo:N0.label}));return{success:!1,repositories:G0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:G0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=K.metadata?.repository?null:await y10(Z,K.virtual_mcp_id),F=await tm(Z,{threadId:X,runBranch:K.branch,agentRepo:H?.repository}),U=await Df(Z,F,Y),N=await id4(Z,X,U,F,H?.repository?K.virtual_mcp_id:null);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.repository??H?.repository,O=K.metadata?.additionalRepositories??[],L={url:W.webUrl,repositoryId:W.repository?.id},w=B&&BB(B,L),j=await gX(Z);if(w&&await td4(j,N.sandboxHandle,X,"."))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`${W.label} is already checked out at your working directory.`};if(B&&!w&&nd4(O,L))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`This run already has ${VR$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:E,gitUserName:z,gitUserEmail:T}=await sd4(Z,Q.id,W),A={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},P=!B||!!w,q=P?[]:await Z.storage.threads.appendThreadRepository(X,A);if(!B)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},repository:A},updated_by:Y});let x=jH0({branch:F,derivedRef:RH(F,{flat:Bf(W.provider)}),recordedHeadRef:null,sticky:!1}),_=await ad4(Z,Q.id,Y),V=await j.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(ed4({...P?{primary:{cloneUrl:E,branch:x,repoName:`${W.owner}/${W.name}`}}:{secondaries:await $i4(Z,Q.id,q,_)},submoduleCredentials:_,gitUserName:z,gitUserEmail:T}))});if(!V.ok)throw Error(`the sandbox rejected the repository (${V.status} ${V.statusText})`);await j.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((G0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",G0)});let y=P?null:qR$(q,A),g=P||!y?".":`"$(dirname "$PWD")/repos/${y}"`,l=Date.now()+IR$,i=!1,p="",U0=0,v0=null;while(Date.now()<l){let G0=await p91(j,N.sandboxHandle,X,kR$(g)).catch(()=>null);if(!G0){if(++U0>=pd4)break;await O$(i91);continue}U0=0;let N0=SR$(G0.stdout);if(N0.cloned&&N0.listing===v0){i=!0,p=N0.listing;break}v0=N0.cloned?N0.listing:null,await O$(i91)}if(i)await p91(j,N.sandboxHandle,X,od4(P?null:`../repos/${y}`)).catch((G0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",G0));return{success:i,repo:`${W.owner}/${W.name}`,cloned:i,files:p,message:i?P?`${W.label} is checked out at your working directory on branch ${x}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${y}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(IR$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as b1}from"zod";var om=50000,rm=500,IT0=200,sm=50000,ID,u10,Of,Zi4,Qi4,Yi4,_R$,am,Xi4,Ji4,vR$;var cJ=D(()=>{x4();x4();ID=b1.enum(OH),u10=b1.enum(["bug","feature","chore","spike","security"]),Of=b1.enum(["none","low","medium","high","urgent"]),Zi4=b1.object({threadId:b1.string(),virtualMcpId:b1.string().nullable(),status:b1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:b1.string().nullable(),lastMessage:b1.string().nullable(),hasPreview:b1.boolean(),failureKind:b1.string().nullable(),hasMessages:b1.boolean(),costUsd:b1.number().nullable(),costProvider:b1.string().nullable(),createdAt:b1.string(),lastActiveAt:b1.string()}),Qi4=b1.object({reviewer:b1.enum(MW),verdict:b1.enum(["approved","changes_requested"]),verified:b1.boolean()}),Yi4=b1.object({id:b1.string(),name:b1.string(),color:b1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:b1.string(),createdAt:b1.string().datetime()}),_R$=b1.object({url:b1.string(),number:b1.number(),repoOwner:b1.string(),repoName:b1.string(),createdAt:b1.string(),updatedAt:b1.string().nullable(),title:b1.string().nullable(),body:b1.string().nullable(),state:b1.enum(["open","closed"]).nullable(),draft:b1.boolean().nullable(),merged:b1.boolean().nullable(),mergeable:b1.boolean().nullable(),checksStatus:b1.enum(["pending","passing","failing"]).nullable(),checks:b1.array(b1.object({name:b1.string(),status:b1.string(),conclusion:b1.string().nullable(),detailsUrl:b1.string().nullable(),summary:b1.string().nullable()})),previewUrl:b1.string().nullable()}),am=b1.object({id:b1.string(),organizationId:b1.string(),title:b1.string(),description:b1.string().nullable(),status:ID,priority:Of,type:u10,assigneeId:b1.string().nullable(),assignedBy:b1.string().nullable(),repo:b1.string().nullable(),repositoryId:b1.string().nullable(),dueDate:b1.string().datetime().nullable(),sortOrder:b1.number(),keySeq:b1.number().nullable(),externalUrl:b1.string().nullable(),previewRoutes:b1.array(b1.string()),source:b1.enum(["jira"]).nullable(),retryAttempts:b1.number(),reviewCycleStartedAt:b1.string().datetime().nullable(),threads:b1.array(Zi4),tags:b1.array(Yi4),reviewVerdicts:b1.array(Qi4),statusSince:b1.string().datetime().nullable(),createdBy:b1.string(),createdAt:b1.string().datetime(),updatedBy:b1.string(),updatedAt:b1.string().datetime()}),Xi4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported","finding_resolved"],Ji4=b1.enum(Xi4),vR$=b1.object({id:b1.string(),taskBoardItemId:b1.string(),action:Ji4,actorId:b1.string().nullable(),data:b1.record(b1.string(),b1.unknown()),occurredAt:b1.string().datetime()})});async function VT0($,Z,Q){if(Q===R8)return;if(!await $.db.selectFrom("member").select("id").where("organizationId","=",Z).where("userId","=",Q).executeTakeFirst())throw Error("assigneeId is not a member of the organization")}var t91=D(()=>{cJ()});async function kT0($,Z,Q){let Y=await $.storage.tags.listOrgTags(Z),X=new Set(Y.map((J)=>J.id));for(let J of Q)if(!X.has(J))throw Error(`Tag not found: ${J}`)}function fR$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(Gi4))continue;Z[Q]=Y}return Z}function ST0($){return{taskBoardItemId:$.id,...XQ($)&&{[bR$]:xR$}}}function Wi4($){return $?.[bR$]===xR$}function Ki4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function Hi4($,Z){let Q=E0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&Aw.provisionKey){let J=await TQ(X,$.auth?.user?.email),G=await Aw.provisionKey(J,Ki4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function yR$($,Z,Q){if(!E0().taskQuotaEnforced)return;if(!Wi4(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!XQ(X))return;if(!await OD$($,Y))return;return await Hi4($,Z)}function gR$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var Gi4="srv.",bR$="srv.billing",xR$="subscription";var l10=D(()=>{dl();VK();X$();IW()});function c10($){let Z=$?.runClass;return Z&&Z in o91?o91[Z]:o91.interactive}var o91,em="runClass";var $d=D(()=>{o91={interactive:10,reviewer:20,retry:30,new_task:40}});async function CT0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),Fi4)})])}finally{if(Y)clearTimeout(Y)}}function Ui4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function _T0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function I6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=Hj.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((w)=>jP(w.providerId)),F=await BF$($,Y,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await CT0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:_T0(w,F)}}for(let w of[K,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await CT0($,w.keyId,Y).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:_T0(j,w.modelId,w.title)}}if(H.length===0)throw new Zd(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await CT0($,w.id,Y).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=fn1(B,N),L=Ui4(Z,O);if(!L)throw new Zd(Z);return{credentialId:L.keyId,modelId:L.modelId,modelMeta:_T0(N[L.keyId]??[],L.modelId,L.title)}}async function hR$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new m10(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!jP(X.providerId))throw new m10(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await CT0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:_T0(J,Q)}}async function yY($,Z){try{return await I6($,Z)}catch(Q){if(Q instanceof Zd)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var Zd,m10,Fi4=5000;var gY=D(()=>{WH();t9();p8();Zd=class Zd extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};m10=class m10 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});import{z as e6}from"zod";function pR$($){let Z=["The user spoke this request to the voice companion. Transcripts may contain errors; ask if unclear. Changes or cancellations refer to existing work, not a duplicate task."];if($.length>0)Z.push("Earlier spoken conversation, as context only. Do not repeat earlier actions or treat the voice assistant's words as authorization:",JSON.stringify($));return Z.join(`
 `)}var VD=600000,cR$=12000,uR$,pLZ,nLZ,mR$,d10="This turn is a spoken conversation. Use the same tools and perform the requested work normally. Keep the final user-facing text brief, usually one or two sentences, in the user's language. Write naturally for reading aloud. Avoid markdown, code blocks, lists, URLs, and reading implementation details aloud unless the user asks. State what actually happened; do not claim success before tools confirm it. Ask a short question when clarification or approval is required. The user keeps talking while you work, and their next spoken request waits until this turn ends. When a subtask tool is available, run research or analysis beyond a quick lookup as a subtask with background set to true so this turn can end. When the user asks for separate pieces of work and you have task board tools, create a board task for each. Then say briefly what started. These style instructions apply to this turn only.",dR$="This turn is a text chat. Use the agent's normal response style. Voice-only style instructions from earlier turns no longer apply.",tLZ,lR$=5000,iR$,nR$=`You are the voice companion inside a Studio chat. Speak naturally in the user's language, usually one short sentence at a time. Keep track of the different topics the user brings up. There may be a page or live preview beside the chat; use only the supplied context to know which view is open.
 
 You coordinate with the selected Studio agent. Depending on its available tools and permissions, it can query the organization's connected services, inspect analytics, create and manage tasks, or edit a site in its sandbox. You cannot access those services or files yourself. Use delegate_to_agent for work, inspections, and questions that require information not already in the supplied chat context. Preserve the user's intent and relevant details from your conversation in a complete request. When the user requests independent background tasks, include that intent in the request so the Studio agent can use its task tools. Do not send greetings, pauses, unfinished phrases, or conversational acknowledgments as tasks. When a user pauses mid-thought, let them finish. Ask briefly if an essential detail is missing.
@@ -3520,7 +3520,7 @@ ${Z}`}:Y)}}var S88=D(()=>{KZ()});async function Pv6($,Z,Q){if(!$)return!1;let Y=
           (SELECT created_at, id FROM notifications
             WHERE id = ${Q.cursor}
               AND user_id = ${$}
-              AND organization_id = ${Z})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Md.parse(F.data),createdAt:kv6(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($,Z,Q){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).where("user_id","=",Z).where("organization_id","=",Q).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:i8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await Id({...$,db:this.db})}async notifyMentions($){await l88({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var Iv6=20,Vv6=50,kv6=($)=>$ instanceof Date?$.toISOString():$;var m88=D(()=>{FY();Zq0();Qq0();c88()});class SU1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class CU1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function Sv6($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function Cv6($){return typeof $.id==="string"&&!!$.architecture&&Array.isArray($.architecture.input_modalities)&&Array.isArray($.architecture.output_modalities)&&!!$.top_provider&&!!$.pricing}function _v6($){return{providerId:"openrouter",modelId:Sv6($.id),title:$.name,description:$.description||null,logo:null,capabilities:cl($.architecture.input_modalities,$.architecture.output_modalities,$.supported_parameters,$.supported_parameters?.includes("reasoning")?["reasoning"]:[]),limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:Number($.pricing.prompt)||0,output:Number($.pricing.completion)||0}}}function i88($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function vv6($){if($){let Z=await $.get(d88,"openrouter");if(Z)return i88(Z)}try{let Z=await xF("OpenRouter enrichment index","https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)await EY("OpenRouter enrichment index",Z);let{data:Q}=await Z.json(),Y=Q.filter(Cv6).map(_v6);if($)await $.set(d88,"openrouter",Y);return i88(Y)}catch{return new Map}}function bv6($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function xv6($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function n88($,Z){if(xv6(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function fv6($,Z){return $.map((Q)=>{let X=bv6(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=n88(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class _U1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=v9()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listDecisionModels($,Z){let Q=await this.activate($,Z);if(!Q.decisions?.listModels)throw Error("Provider does not support decision model discovery");let Y=`${Q.info.id}:decisions`,X=await this.cache?.get(Z,Y);if(X)return X;let J=new Set,G=(await Q.decisions.listModels()).filter((W)=>{if(W.deprecated||!W.capabilities.includes("decisions")||J.has(W.modelId))return!1;return J.add(W.modelId),!0}).map((W)=>({...W,providerId:Q.info.id}));return await this.cache?.set(Z,Y,G),G}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=v9()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return p88(U,J.create(Y))}let G=J.create(Y),W=await G.listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"&&X!=="deco"){let U=await vv6(this.cache);H=fv6(H,U)}else H=H.map((U)=>({...U,capabilities:n88(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return p88(F,G)}}function p88($,Z){let Q=Z.asyncResearch;if(!Q)return $;return $.map((Y)=>Q.canHandle(Y.modelId)?{...Y,asyncResearch:!0}:Y)}var d88="_global";var t88=D(()=>{jW();A2()});import{SpanStatusCode as o88}from"@opentelemetry/api";function gv6($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=yv6)break;if(typeof X==="string"&&Y.length<=r88&&X.length<=r88)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function hv6($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function uv6($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function xU1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return BU1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(CZ(B))return!0;if(X&&!N)return BU1(X,F);let O=R$8(U?.role,F,q$8());if(O!=="fallback")return O==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let L=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...L}}))?.success===!0)return!0;let j=Be1(F);return(await H({headers:Q,body:{permission:j,...L}}))?.success===!0}catch(w){let j=w?.statusCode;if(j!==401&&j!==403)console.error("[Auth] Permission check failed:",w instanceof Error?w.message:String(w));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!k9(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},listMembers:async(F)=>{return Z.api.listMembers({headers:Q,query:F?{organizationId:F.organizationId,limit:F.limit,offset:F.offset,filterField:F.filterField,filterValue:F.filterValue}:void 0})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function NA($,Z,Q){if(eu.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function cv6($,Z,Q){$l($,Z,Q)}function mv6($,Z,Q){Zl($,Z,Q)}async function a88($,Z,Q,Y){let X=vU1.get(Q);if(X&&Date.now()-X.at<s88)return X.value;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=k9(J);return cv6(vU1,Q,G),mv6(vU1,lv6,s88),G}async function bU1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function dv6($,Z){if(!$)return!0;return Z===$}async function iv6($,Z,Q,Y,X){let J=kX0($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>ud0(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!dv6(Y,W))return;let K=Y?await bU1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function pv6($,Z,Q,Y=$48,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=uv6($),N=await Y.measure("auth_query_membership",()=>{let w=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return w.where("organization.slug","=",U).executeTakeFirst();if(H)return w.where("organization.id","=",H).executeTakeFirst();if(F)return w.where("organization.slug","=",F).executeTakeFirst();return w.orderBy("member.createdAt","asc").limit(2).execute().then((j)=>j.length===1?j[0]:void 0)});if(k9({metadata:N?.orgMetadata}))throw Error(MX0);let B=N?.role,O=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let L;if(N&&B)L=await Y.measure("auth_fetch_role_permissions",()=>NA(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:L,organization:O}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>ud0(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await bU1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await a88(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let O=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(k9(O))return{user:void 0};F=O?{id:O.id,slug:O.slug,name:O.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await a88(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await bU1(Q,Y,U,K.id,X);let N=await iv6($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(k9({metadata:N?.orgMetadata}))throw Error(MX0);if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N&&!k9(N))K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((O)=>O.userId===W.user.id)?.role;else if(!N)K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;if(W.message===MX0)throw G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function Z48($){let Z=new UX($.encryption.key),Q=E0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(WK()),H=W(VN()),F=(A)=>`read_ndjson('${K}/${A}/**/*.ndjson', auto_detect=true)`,U=(A)=>`read_ndjson('${H}/${A}/**/*.ndjson', auto_detect=true)`,N,B,O,L,w=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,O=F,L=U;else if(X){let A=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new Sr(Y,A),B=new Sr(Y,A),O=(P)=>"studio_monitoring_logs",L=(P)=>"studio_monitoring_logs"}else if(J){let A=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,P=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,q=Q.duckdbExtensionDirectory;if(!A||!P||!q)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let x={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:A,secretAccessKey:P,extensionDirectory:q},_=new kr(x,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=_,B=_;let V=Q.monitoringS3Bucket,y=Q.monitoringS3Prefix??"",g=(l,i)=>oa1({bucket:V,prefix:y,range:i});O=g,L=g,w=!0}else{let{engine:A}=await qn0({basePath:WK()}),{engine:P}=await qn0({basePath:VN()});N=A,B=P,O=F,L=U}let j=new oh($.db),E=new d40($.db),z=new br($.db),T={connections:new Oo($.db,Z),connectionCredentialVault:new ui0($.db),organizationSettings:new rP($.db),userModelPreferences:new In0($.db),monitoring:new ni0(N,O,B,L,G,w),virtualMcps:new wF($.db),users:new ln0($.db),tags:new xr($.db),projectSidebar:new gn0($.db),experiments:new hn0($.db),organizationBilling:new kG($.db),aiProviderKeys:new ps($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new EU1($.db,Z),secrets:new b91($.db,Z),orgFileConfigs:new zU1($.db,Z),orgSites:new QO($.db),orgRepoSyncs:new _A($.db),gitProviderAccounts:new AA($.db),gitProviderAccountCredentials:new P00($.db,Z),gitProviderOAuthStates:new qU1($.db),githubConnectFlows:new TU1($.db),repositories:new A00($.db),jiraIntegrations:new YO($.db,Z),taskBoard:new D3($.db),columnAutomations:new MU1($.db),taskBoardPrompts:new IU1($.db),taskBoardAnalytics:new YJ1($.db),threadAnalytics:new WJ1($.db),notifications:new kU1($.db),orgFsEntries:new tt($.db),oauthPkceStates:new SU1($.db),claudeSubscriptions:new CU1($.db,Z),automations:EX0($.db),triggerCallbackTokens:new _r($.db),orgSsoConfig:new bn0($.db,Z),orgSsoSessions:new xn0($.db),brandContext:new vr($.db),organizationDomains:new VG($.db),organizationJoinRequests:new tu($.db),kv:z,interests:new vn0(z)};return async(A,P)=>{let q=P?.timings??$48,x=HS0(),_=A?await $.observability.tracer.startActiveSpan("studio.auth",async(Z0)=>{try{let r=await pv6(A,$.auth,$.db,q,$.memberRoleCache);return Z0.setStatus({code:o88.OK}),r}catch(r){throw Z0.setStatus({code:o88.ERROR,message:r.message}),Z0.recordException(r),r}finally{Z0.end()}}):{user:void 0},V=hv6(A,_.user),y=xU1({auth:$.auth,headers:A?.headers??new Headers,role:_.role,permissions:_.permissions,userId:_.user?.id,apiKeyId:_.apiKeyId,organizationId:_.organization?.id}),g={user:_.user,tokenOrganizationId:_.tokenOrganizationId,permissions:_.permissions,permissionsOrganizationId:_.permissions?_.organization?.id:void 0};if(_.apiKey)g.apiKey=_.apiKey;let l=_.organization,i=A?E0().baseUrl??`${new URL(A.url).origin}`:WZ(),p=new aP(g.user?.id,void 0,y,_.role,"self",void 0,l?.id),U0={...T,virtualMcps:Nt1(T.virtualMcps),threads:new fi0(j,l?.id),asyncResearchJobs:new wU1(E,l?.id)},v0=new _U1(U0.aiProviderKeys,$.modelListCache),G0=HX(),N0=!l?null:G0?TG(G0,l.id):new m3(l.id,i),o=l&&N0?new d3(N0,U0.orgFsEntries,l.id):null;yF1(U0,{objectStorage:N0,baseUrl:i,orgSlug:l?.slug});let $0={timings:q,auth:g,connectionId:V,organization:l,storage:U0,vault:Z,authInstance:$.auth,boundAuth:y,access:p,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:i,objectStorage:N0,orgFs:o,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(nv6.map((Z0)=>[Z0,A?.headers.get(Z0)??null]).filter(([,Z0])=>Z0!==null)),userAgent:(A?kX0(A.headers,"client"):null)||A?.headers.get("User-Agent")||void 0,ipAddress:(A?.headers.get("CF-Connecting-IP")||A?.headers.get("X-Forwarded-For"))??void 0,properties:gv6(A?kX0(A.headers,"properties"):null)},aiProviders:v0,createMCPProxy:async(Z0)=>{return await C88(Z0,$0)},invalidateMemberRole:$.memberRoleCache?(Z0,r)=>$.memberRoleCache.invalidate(Z0,r):void 0,getOrCreateClient:x,pendingRevalidations:[],firecrawlApiKey:E0().firecrawlApiKey};return $0}}function BE($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=HX();$.objectStorage=Q?TG(Q,Z.id):new m3(Z.id,$.baseUrl),$.orgFs=new d3($.objectStorage,$.storage.orgFsEntries,Z.id),yF1($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var yv6=50,r88=500,s88=60000,lv6=1e4,vU1,e88,cQ,$48,nv6;var wU=D(()=>{VK();BL();X$();I9();yi0();PY0();AY0();jt1();ra1();_3();Mn0();Vn0();kn0();Cn0();fn0();He1();Fe1();yr();fK();in0();hJ1();DY();cF1();Do();jU1();HU1();fs0();x10();v88();PU1();oK0();Wm();RU1();n40();XJ1();KJ1();xD();m88();vd0();GB();t88();FL();Sh();gF1();vU1=new Map;cQ={set:($)=>{e88=$},create:async($,Z)=>{return await e88($,Z)}},$48={measure:async($,Z)=>{return await Z()}},nv6=["x-hub-signature-256"]});import{DBOS as wS0,SchedulerMode as tv6}from"@dbos-inc/dbos-sdk";function Q48($){yU1=$}function Y48(){if(!yU1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return yU1}async function rv6($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await cQ.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},BE(Y,{id:Q.id,slug:Q.slug}),Y}async function sv6($){try{let{db:Z}=Y48(),Q=await rv6(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await AH0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function av6($,Z){let Q=await wS0.runStep(()=>new _A(Y48().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await wS0.runStep(()=>sv6(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function X48(){if(fU1)return;fU1=wS0.registerWorkflow(av6,{name:"orgRepoSyncWorkflow"}),wS0.registerScheduled(fU1,{name:"orgRepoSyncWorkflow",crontab:ov6,mode:tv6.ExactlyOncePerIntervalWhenActive})}var ov6="7-59/10 * * * *",yU1=null,fU1=null;var J48=D(()=>{wU();TH0()});import{DBOS as jS0,SchedulerMode as ev6}from"@dbos-inc/dbos-sdk";function G48($){hU1=$}function W48(){if(!hU1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return hU1}async function Yb6($,Z){try{let Q=await VH(W48().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await Nb$(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function Xb6($,Z){let Q=new Date($.getTime()-Zb6),Y=await jS0.runStep(()=>new D3(W48().db).listItemsAwaitingArchive(Q,Qb6),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(Gq0(Y).map(({organizationId:G,itemIds:W})=>jS0.runStep(()=>Yb6(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function K48(){if(gU1)return;gU1=jS0.registerWorkflow(Xb6,{name:"taskBoardArchiveSweepWorkflow"}),jS0.registerScheduled(gU1,{name:"taskBoardArchiveSweepWorkflow",crontab:$b6,mode:ev6.ExactlyOncePerIntervalWhenActive})}var $b6="23 * * * *",Zb6=432000000,Qb6=200,hU1=null,gU1=null;var H48=D(()=>{xD();Cd();kd()});import{createHmac as Jb6,timingSafeEqual as Gb6}from"crypto";function U48($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>Wb6)return!1;let W=Jb6("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&Gb6(K,F)})}function N48($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=y7(Z),Y=y7(y7(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:$K(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function zS0($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function $K($){return typeof $==="string"?$:void 0}function y7($){return typeof $==="object"&&$!==null?$:void 0}function PS0($){return typeof $==="number"?new Date($*1000):null}function ES0($){return $K($)??$K(y7($)?.id)}function Kb6($){return ES0($.subscription)??$K(y7(y7($.parent)?.subscription_details)?.subscription)}function Hb6($){let Z=y7($.lines)?.data;if(Array.isArray(Z)){let Q=null;for(let Y of Z){let X=y7(y7(Y)?.period)?.end;if(typeof X==="number"&&(Q===null||X>Q))Q=X}if(Q!==null)return new Date(Q*1000)}return PS0($.period_end)}function Fb6($,Z){let Q=y7($.items)?.data;if(!Array.isArray(Q))return;for(let Y of Q){let X=y7(Y)?.amount;if(typeof X==="number"&&X<=0)continue;let J=ES0(y7(Y)?.price);if(J&&Z[J])return Z[J]}return}function cU1($,Z,Q){if($==="past_due")return;if($!=="active")return"free";return}function Ub6($){let Z=PS0($.current_period_end);if(Z)return Z;let Q=y7($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=y7(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function uU1($,Z){let Q=PS0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function lU1($,Z){let Q=PS0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function Nb6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=$K(y7(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if($K(y7(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if($K(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let H=$K(Q.id);if(!H)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let F=Number(y7(Q.metadata)?.creditCents);if(!Number.isInteger(F)||F<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:y7(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:F,referenceId:`stripe-topup:${H}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if($K(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.ensureBilling(Y);if(!X)return console.error("stripe webhook: PAID checkout for an org that does not exist",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"unknown org"};let J=ES0(Q.subscription);if(!J)return console.error("stripe webhook: subscription checkout without a sub id",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"subscription checkout without sub id"};if(uU1(Z,X))return{handled:!1,reason:"stale event"};if(X.stripeSubscriptionId&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let G=ES0(Q.customer);if(!await $.bindSubscription(Y,{stripeSubscriptionId:J,...G?{stripeCustomerId:G}:{},status:"active",lastStripeEventAt:lU1(Z,X)}))return console.error("stripe webhook: lost the bind race",{organizationId:Y,subscriptionId:J,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let K=$K(y7(Q.metadata)?.planId);return{handled:!0,organizationId:Y,...K?{planChange:{planId:K,note:`stripe checkout ${$K(Q.id)??""}`.trim()}}:{}}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=$K(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&uU1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":zS0(Q.status);await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:Ub6(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:lU1(Z,X)});let W=cU1(G,Q,E0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...W?{planChange:{planId:W,note:`stripe ${Z.type} (${G})`}}:{}}}case"invoice.paid":{let Y=Kb6(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(uU1(Z,X))return{handled:!1,reason:"stale event"};await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:Hb6(Q),lastStripeEventAt:lU1(Z,X)});let J=Fb6({items:Q.lines},E0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...J?{planChange:{planId:J,note:"stripe invoice.paid"}}:{}}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function Bb6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:zS0(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function F48($,Z){let Q=Bb6($,Z);if(!Q)return;wY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:NZ$(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function B48($){let Z=new kG(D8().db),Q=await Nb6(Z,$);if(!(Q.handled&&Q.topUp))F48($,Q);if(Q.handled&&Q.topUp)await cu$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),F48($,Q);if(Q.handled&&Q.planChange){try{await pM0({organizationId:Q.organizationId,planId:Q.planChange.planId,note:Q.planChange.note})}catch(Y){if(!(Y instanceof Wi))throw Y;return console.error("stripe webhook: gateway REFUSED the plan change \u2014 the org has been "+"charged (or cancelled) and its entitlement did NOT move. Place it by hand through the gateway admin API.",{organizationId:Q.organizationId,planId:Q.planChange.planId,eventId:$.id,status:Y.status,error:Y.message}),Q}Hi(Q.organizationId)}if(!Q.handled&&Q.orphanSubscriptionId){let Y=Q.orphanSubscriptionId;try{await aB$(Y)}catch(J){if(!(J instanceof uZ&&(J.status===400||J.status===404)))throw J}let{refundedCents:X}=await eB$(Y);console.error("stripe webhook: reversed orphan subscription",{subscriptionId:Y,refundedCents:X,eventId:$.id})}return Q}var Wb6=300;var mU1=D(()=>{k80();SG();G6();yr();JD();nM0();X$()});import{DBOS as AS0,SchedulerMode as Db6}from"@dbos-inc/dbos-sdk";function D48($){iU1=$}function O48(){if(!iU1)throw Error("[subscription-sweep] runtime not initialized \u2014 setSubscriptionSweepRuntime() must run before the workflow fires");return iU1}async function jb6($){let{organizationId:Z,stripeSubscriptionId:Q}=$;if(!Q)return{organizationId:Z,action:"ok"};let Y=new kG(O48().db);try{let X,J,G=!1;try{let K=await Bj(Q);X=zS0(K.status),J=Eb6(K)}catch(K){if(!(K instanceof uZ)||K.status!==404)throw K;X="canceled",J=$.currentPeriodEnd,G=!0}let W=cU1(X,{},E0().stripePlanPriceIds);if(await Y.updateStripeState(Z,{status:X,currentPeriodEnd:J,...G&&{stripeSubscriptionId:null}}),!W)return{organizationId:Z,action:"ok"};return await pM0({organizationId:Z,planId:W,note:`studio subscription sweep (${X})`}),Hi(Z),console.warn("[subscription-sweep] revoked a paid tier whose webhook never arrived",{organizationId:Z,subscriptionId:Q,status:X}),{organizationId:Z,action:G?"gone":"revoked"}}catch(X){if(X instanceof Wi)console.error("[subscription-sweep] gateway REFUSED the revocation \u2014 the org still holds a tier it no longer pays for",{organizationId:Z,subscriptionId:Q,status:X.status});return{organizationId:Z,action:"failed",error:X instanceof Error?X.message:String(X)}}}function Eb6($){if(typeof $.current_period_end==="number")return new Date($.current_period_end*1000);let Z=0;for(let Q of $.items?.data??[])if(typeof Q.current_period_end==="number")Z=Math.max(Z,Q.current_period_end);return Z>0?new Date(Z*1000):null}async function zb6($,Z){let Q=E0();if(!Q.plansEnabled||!Q.stripeSecretKey)return;let Y=new Date($.getTime()-Lb6),X=await AS0.runStep(()=>new kG(O48().db).listSubscriptionsPastPeriodEnd(Y,wb6),{name:"loadLapsedSubscriptions"});if(X.length===0)return;let J=await Promise.all(X.map((W)=>AS0.runStep(()=>jb6(W),{name:`sweepSubscription:${W.organizationId}`})));for(let W of J)if(W.action==="failed")console.warn(`[subscription-sweep] org ${W.organizationId} failed: ${W.error}`);let G=J.filter((W)=>W.action==="revoked"||W.action==="gone").length;if(G>0)console.warn(`[subscription-sweep] revoked ${G} of ${X.length} lapsed subscriptions`)}function L48(){if(dU1)return;dU1=AS0.registerWorkflow(zb6,{name:"subscriptionSweepWorkflow"}),AS0.registerScheduled(dU1,{name:"subscriptionSweepWorkflow",crontab:Ob6,mode:Db6.ExactlyOncePerIntervalWhenActive})}var Ob6="41 * * * *",Lb6=172800000,wb6=100,iU1=null,dU1=null;var w48=D(()=>{k80();yr();JD();nM0();mU1();X$()});async function Pb6($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===TS0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,TS0,pK0(Q.length))).id}async function Ab6($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!Lb$(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!xf(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await $5($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),L8(Z,K),!0}async function j48($,Z,Q,Y=Wq0){let X=null,J=()=>X??=Pb6($,Z),G=0;for(let W of Q)try{if(await Ab6($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var TS0="merged";var E48=D(()=>{x4();cY();Cd();kH();C7();P9()});import{DBOS as RS0,SchedulerMode as Tb6}from"@dbos-inc/dbos-sdk";function z48($){nU1=$}function P48(){if(!nU1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return nU1}async function Mb6($,Z){try{let Q=await VH(P48().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await j48(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function Ib6(){let $=await RS0.runStep(()=>new D3(P48().db).listItemsAwaitingMergedTag(TS0,qb6),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(Gq0($).map(({organizationId:Y,itemIds:X})=>RS0.runStep(()=>Mb6(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function A48(){if(pU1)return;pU1=RS0.registerWorkflow(Ib6,{name:"taskBoardMergedTagSweepWorkflow"}),RS0.registerScheduled(pU1,{name:"taskBoardMergedTagSweepWorkflow",crontab:Rb6,mode:Tb6.ExactlyOncePerIntervalWhenActive})}var Rb6="41 * * * *",qb6=200,nU1=null,pU1=null;var T48=D(()=>{xD();Cd();kd();E48()});function R48($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"}catch{return!1}}var M48,Vb6,q48=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},tU1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=q48(X.substring(0,J));if(Z&&Z!==G||!M48.test(G))continue;let W=q48(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if(Vb6.test(W)){if(Y[G]=W.indexOf("%")!==-1?Cl(W,Ps):W,Z)break}}return Y},kb6=($,Z,Q={})=>{if(!M48.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},qS0=($,Z,Q)=>{return Z=encodeURIComponent(Z),kb6($,Z,Q)};var I48=D(()=>{Uw();M48=/^[\w!#$%&'*.^`|~+-]+$/,Vb6=/^[ !#-:<-[\]-~]*$/});var Gp=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return tU1(Y,J)[J]}if(!Y)return{};return tU1(Y)},Sb6=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=qS0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=qS0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=qS0($,Z,{path:"/",...Q});return Y},t40=($,Z,Q,Y)=>{let X=Sb6(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var MS0=D(()=>{I48()});var V48=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var k48=()=>{};function oU1($,Z){return`${$}:${Z}`}function S48($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=oU1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=oU1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(oU1(J,G))}}}class rU1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=C48.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of C48)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var C48;var _48=D(()=>{C48=["studio.sse.broadcast","mesh.sse.broadcast"]});async function Cb6($,Z,Q=5){try{await E8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof P5?Y.cause:Y)}}function v48($){let Z=new rU1({getConnection:()=>$.getConnection()});_5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{Cb6("[NatsSSEBroadcast]",()=>Z.start())})}var sU1=D(()=>{a$();_48();Rd();Rd()});var b48=()=>{};var aU1=()=>{};var x48=()=>{};var _b6,$Y7;var f48=D(()=>{b48();aU1();Uw();x48();_b6={br:".br",zstd:".zst",gzip:".gz"},$Y7=Object.keys(_b6)});var y48=D(()=>{f48()});var g48=()=>{};var h48=D(()=>{g48()});var u48=()=>{};var l48=D(()=>{Pr0()});var eU1=D(()=>{Nw();l48()});var $N1="x-hono-disable-ssg",EY7;var ZN1=D(()=>{eU1();EY7=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[$N1]:"true"}})}catch{return null}})()});var c48=D(()=>{JG0()});var QN1=D(()=>{c48()});var m48=D(()=>{h48();u48();aU1();ZN1();QN1();eU1()});var d48=D(()=>{ZN1();QN1();m48()});var ZX7;var i48=D(()=>{d48();({write:ZX7}=Bun)});var xb6=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},p48=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var n48=()=>{};var o40=($)=>("server"in $.env)?$.env.server:$.env;var IS0=()=>{};var fb6;var t48=D(()=>{n48();IS0();fb6=p48(($,Z)=>{let Q=o40($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var r40=($)=>{let Z=o40($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var o48=D(()=>{IS0()});var YN1=D(()=>{y48();i48();t48();o48();IS0()});var r48;var s48=D(()=>{r48={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function a48(){let $=Object.keys(V4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:r48[X].icon})),Y=E0().localMode;return{emailAndPassword:{enabled:V4.emailAndPassword?.enabled??!1},magicLink:{enabled:V4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:V4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:GS0},socialProviders:{enabled:Z,providers:Q},sso:V4.ssoConfig?{enabled:!0,providerId:V4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:hD()}}async function yb6($,Z,Q){try{if(!V4.inviteEmailProviderId||!V4.emailProviders||V4.emailProviders.length===0)return;let Y=_G(V4.emailProviders,V4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=gr,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=CG(Y),K=`${WZ()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:vG({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:j2("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var XO,e48;var XN1=D(()=>{J8();YN1();G6();X$();Z3();SG();nF1();s$1();YS0();w2();DY();I9();Cn0();s48();uf();au();XO=new Z1;XO.post("/local-session",async($)=>{if(!hD())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=r40($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (uf(),Sq0));await Y();let{auth:X}=await Promise.resolve().then(() => (Z3(),m$8)),J=await DY1();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await kq0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});XO.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await x8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=D8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(CZ(G))return $.json({role:G,capabilities:Ne1()});if(G==="user")return $.json({role:G,capabilities:mn0({self:[...RX0]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:mn0(K)})});XO.get("/domain-lookup",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new VG(D8().db).getAllByDomain(Q)).filter(QS0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await D8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(k9(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});XO.post("/domain-join",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=D8().db,K=(await new VG(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!k9(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let O=F.get(B.organizationId);return O?[O]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((O)=>O.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await x8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!Nj(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return f1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return f1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});XO.post("/domain-setup",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=D8().db,K=new VG(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((T)=>T.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,P=T===0?U:`${U}${A}`,q=`${N}${A}`;try{B=await x8.api.createOrganization({body:{name:P,slug:q,userId:Z.user.id}});break}catch(x){if(!(x instanceof Error&&("body"in x)&&x.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw x}}if(!B?.id)throw Error("Failed to create organization");let O=B.id;if(G)await K.add(O,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let L=!1,w=null,j=null;try{let z=E0().firecrawlApiKey;if(z){let T=await lK0(Q,z,U);if(T){let A=new vr(D8().db),P=await A.create(O,T);if(await A.setDefault(P.id,O),L=!0,T.name&&T.name!==U)w=T.name;j=T.favicon??T.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let E={};if(!X&&w)E.name=w;if(J)E.logo=J;else if(j)E.logo=j;if(Object.keys(E).length>0)try{await x8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:O,data:E}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return f1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),f1.groupIdentify({groupType:"organization",groupKey:O,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:L,created_at:new Date().toISOString()}}),f1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:O},properties:{organization_id:O,organization_slug:B.slug??N,email_domain:Q,brand_extracted:L}}),$.json({success:!0,slug:B.slug??N,brandExtracted:L})}catch(W){return f1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});XO.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await x8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=D8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await x8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!DH.has(W)){let K=await new VG(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new tu(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});XO.post("/domain-request-join",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=D8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new VG(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new tu(J).create(G.id,Z.user.id),await yb6(J,G,Z.user.email),f1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return f1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});XO.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await x8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await XS0({db:D8().db,authApi:x8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)f1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});e48=XO});import{createHmac as gb6}from"crypto";function $68($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function Z68($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function hb6($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function ub6($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return Z68($.key)}async function Q68($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await x8.api.getMcpSession({headers:Z}).catch(()=>null),Y=Z68(Q);if(Y)return Y;let X=await x8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return ub6(X)}function lb6($,Z){let Q=gb6("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var JN1,Y68;var X68=D(()=>{J8();Z3();JN1=new Z1;JN1.get("/me",async($)=>{let Z=$68($.req.raw.headers),Q;if(Z)Q=await Q68(Z);else{let Y=await x8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=hb6(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});JN1.post("/session-from-oauth",async($)=>{let Z=$68($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await Q68(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await x8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=lb6(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});Y68=JN1});var Wp=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function cb6($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function GN1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function db6($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return mb6.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var mb6,Kp=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=db6($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst().then((F)=>F??_G0(X,Q));if(!G){if(Wp($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=GN1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(k9(G)){if(Wp($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(F)H=F.role;else if(await kQ1(X,K))fD({action:"org_scope_admit",actorUserId:K,targetOrgId:G.id,method:$.req.method,route:$.req.path}),H="owner";else if(!cb6($)){if(Wp($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),BE(Y,G),await Z()};var VS0=D(()=>{wU();Vd();mb6=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","task-board","resolve"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"],["internal","repositories","resolve"],["internal","repositories","*","tree"],["internal","repositories","*","file"],["internal","repositories","*","search"],["internal","repositories","*","change-requests"],["internal","repositories","*","commits"]]});function ib6($){if(MQ($.id)!==null)return!0;if(Cn1($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function pb6($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function nb6($){let Z=$.auth?.apiKey?.id?GN1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return kS0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return kS0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return kS0;return Y}var J68="/api/_me",kS0,tb6=256,ob6=20,rb6=50,sb6=10,ab6=5,G68=()=>{let $=new Z1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=p0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=nb6(Q);if(X===kS0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>tb6)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,rb6):ob6,K=pb6(Q,Y),H=W+sb6,F=[];for(let U=0;U<ab6&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((O)=>!ib6(O)).filter((O)=>!k9({metadata:O.organization_metadata})).map((O)=>({id:O.id,title:O.title,icon:O.icon,orgId:O.organization_id,orgName:O.organization_name,orgSlug:O.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var W68=D(()=>{J8();p8();VS0();kS0=Symbol("deny")});var K68="Payload Too Large",H68,x5=($)=>{let Z=$.onError||(()=>{let Y=new Response(K68,{status:413});throw new q1(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:O}=await H.read();if(B)break;if(K+=O.length,K>Q){N.error(new H68(K68));break}N.enqueue(O)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof H68)X.res=await Z(X)}};var ZK=D(()=>{OJ();H68=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as eb6}from"crypto";function s40($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function U68($){if(s40($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(s40($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(s40($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(s40($,[82,73,70,70])&&s40($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function KN1($){return WF($)}function Qx6($,Z){let Q=eb6("sha256").update($).digest("hex");return`${SS0}/${Q}.${Z}`}function _S0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${CS0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Hp($){let Z=HX(),Q=Z?TG(Z,WN1):new m3(WN1,$.baseUrl);return new d3(Q,$.storage.orgFsEntries,WN1,$x6)}async function a40($,Z){return(await $.listDir(Z,SS0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function N68($,Z){return(await a40($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function Yx6($,Z){if((await $.stat(Z,SS0))?.readPublic)await $.setReadPublic(Z,SS0,!1,{actor:Z})}async function HN1($,Z,Q){let Y=await a40($,Z);if(!Y.some((X)=>X.path===Q))throw new FX(`No such avatar: ${Q}`);await Yx6($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function Xx6($,Z,Q){try{let X=(await a40($,Z)).filter((J)=>J.path!==Q).slice(Zx6-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function B68($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=Qx6(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await HN1($,Q,G),await Xx6($,Q,G),G}async function D68($,Z,Q){if(!(await a40($,Z)).some((X)=>X.path===Q))throw new FX(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function O68($,Z){try{let Q=await a40($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var WN1="org_user_fs",CS0="/api/_users",SS0="avatars",$x6,F68=2097152,Zx6=5;var FN1=D(()=>{Sh();FL();GB();BP();$x6={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function e40($,Z,Q,Y){let X=d7(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var UN1=D(()=>{qK()});function vS0($,Z){if(Z instanceof FX)return $.json({error:Z.message},404);if(Z instanceof RG)return $.json({error:Z.message},400);if(Z instanceof DP)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function bS0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!KN1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var L68=()=>{let $=new Z1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!KN1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Hp(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return e40(Z,await J.read(Q,Y),Y,W)}catch(K){return vS0(Z,K)}}),$.post("/avatar",x5({maxSize:F68,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=U68(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await B68(Hp(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:_S0(X.baseUrl,Y,W)})}catch(W){return vS0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await N68(Hp(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:_S0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await HN1(Hp(Y),Q.userId,X.path),Z.json({url:_S0(Y.baseUrl,Q.userId,X.path)})}catch(J){return vS0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Hp(Y),J=Z.req.query("path");if(!J)return await O68(X,Q.userId),Z.json({ok:!0});try{return await D68(X,Q.userId,J),Z.json({ok:!0})}catch(G){return vS0(Z,G)}}),$};var w68=D(()=>{J8();ZK();GB();FN1();UN1()});import{z as Fp}from"zod";var Jx6,Gx6,Wx6=200,Kx6=2000,Hx6=60,Fx6=2000,Ux6,xS0;var NN1=D(()=>{Jx6=["warn","block"],Gx6=Fp.enum(Jx6),Ux6=Fp.string().max(Fx6).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),xS0=Fp.object({severity:Gx6,title:Fp.string().trim().min(1).max(Wx6),message:Fp.string().trim().min(1).max(Kx6),ctaLabel:Fp.string().trim().max(Hx6).nullable().optional(),ctaUrl:Ux6.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as BN1}from"zod";function DN1($){let Z=$??{},Q=new Set([...Object.keys(EA.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=jZ(Z,X);return{flags:Z,effective:Y}}var Nx6,j68;var E68=D(()=>{t9();Nx6=BN1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),j68=BN1.record(Nx6,BN1.boolean())});function z68($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
+              AND organization_id = ${Z})`);let G=await J.execute(),W=G.slice(0,Y),K=await this.db.selectFrom("notifications").select((F)=>F.fn.countAll().as("count")).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null).executeTakeFirst(),H=W[W.length-1];return{nextCursor:G.length>Y&&H?H.id:null,notifications:W.map((F)=>({id:F.id,taskBoardItemId:F.task_board_item_id,type:F.type,data:Md.parse(F.data),createdAt:kv6(F.created_at)})),unreadCount:Number(K?.count??0)}}async anchorExists($,Z,Q){return!!await this.db.selectFrom("notifications").select("id").where("id","=",$).where("user_id","=",Z).where("organization_id","=",Q).executeTakeFirst()}async markRead($,Z,Q){if(Q&&Q.length===0)return 0;let Y=this.db.updateTable("notifications").set({read_at:new Date}).where("user_id","=",$).where("organization_id","=",Z).where("read_at","is",null);if(Q)Y=Y.where("id","in",Q);let X=await Y.executeTakeFirst();return Number(X.numUpdatedRows??0n)}async setSubscribed($,Z,Q){await this.db.insertInto("notification_subscriptions").values({id:i8("nsub"),user_id:$,task_board_item_id:Z,subscribed:Q}).onConflict((Y)=>Y.columns(["user_id","task_board_item_id"]).doUpdateSet({subscribed:Q,updated_at:new Date})).execute()}async notify($){await Id({...$,db:this.db})}async notifyMentions($){await l88({...$,db:this.db})}async listSubscribers($){return(await this.db.selectFrom("notification_subscriptions").select("user_id").where("task_board_item_id","=",$).where("subscribed","=",!0).execute()).map((Q)=>Q.user_id)}}var Iv6=20,Vv6=50,kv6=($)=>$ instanceof Date?$.toISOString():$;var m88=D(()=>{FY();Zq0();Qq0();c88()});class SU1{db;constructor($){this.db=$}async create($,Z,Q){await this.deleteExpired(Z);let Y=crypto.randomUUID(),X=new Date(Date.now()+600000);return await this.db.insertInto("oauth_pkce_states").values({id:Y,organization_id:Z,user_id:Q,code_verifier:$,expires_at:X,created_at:new Date}).execute(),Y}async deleteExpired($){await this.db.deleteFrom("oauth_pkce_states").where("organization_id","=",$).where("expires_at","<",new Date).execute()}async consume($,Z,Q){let Y=await this.db.deleteFrom("oauth_pkce_states").where("id","=",$).where("organization_id","=",Z).where("user_id","=",Q).returningAll().executeTakeFirst();if(!Y)throw Error("Invalid or expired OAuth state token");if((Y.expires_at instanceof Date?Y.expires_at:new Date(Y.expires_at))<new Date)throw Error("OAuth state token has expired");return Y.code_verifier}}class CU1{db;vault;constructor($,Z){this.db=$;this.vault=Z}async upsert($){let Z=await this.vault.encrypt($.accessToken),Q=$.expiresAt??null,Y=new Date;return await this.db.insertInto("claude_subscriptions").values({user_id:$.userId,encrypted_access_token:Z,expires_at:Q,created_at:Y}).onConflict((X)=>X.column("user_id").doUpdateSet({encrypted_access_token:Z,expires_at:Q,created_at:Y})).execute(),{linkedAt:Y.toISOString(),expiresAt:Q?.toISOString()??null}}async find($){let Z=await this.db.selectFrom("claude_subscriptions").select(["created_at","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;return{linkedAt:new Date(Z.created_at).toISOString(),expiresAt:Z.expires_at?new Date(Z.expires_at).toISOString():null}}async findLiveToken($){let Z=await this.db.selectFrom("claude_subscriptions").select(["encrypted_access_token","expires_at"]).where("user_id","=",$).executeTakeFirst();if(!Z)return null;if(Z.expires_at&&new Date(Z.expires_at).getTime()<=Date.now())return null;return this.vault.decrypt(Z.encrypted_access_token)}async delete($){await this.db.deleteFrom("claude_subscriptions").where("user_id","=",$).execute()}}function Sv6($){return $.includes("/")?$.split("/").slice(1).join("/"):$}function Cv6($){return typeof $.id==="string"&&!!$.architecture&&Array.isArray($.architecture.input_modalities)&&Array.isArray($.architecture.output_modalities)&&!!$.top_provider&&!!$.pricing}function _v6($){return{providerId:"openrouter",modelId:Sv6($.id),title:$.name,description:$.description||null,logo:null,capabilities:cl($.architecture.input_modalities,$.architecture.output_modalities,$.supported_parameters,$.supported_parameters?.includes("reasoning")?["reasoning"]:[]),limits:{contextWindow:$.context_length,maxOutputTokens:$.top_provider.max_completion_tokens||null},costs:{input:Number($.pricing.prompt)||0,output:Number($.pricing.completion)||0}}}function i88($){let Z=new Map;for(let Q of $){let Y={description:Q.description,capabilities:Q.capabilities,limits:Q.limits,costs:Q.costs};Z.set(Q.modelId,Y);let X=Q.modelId.replace(/\./g,"-");if(X!==Q.modelId)Z.set(X,Y)}return Z}async function vv6($){if($){let Z=await $.get(d88,"openrouter");if(Z)return i88(Z)}try{let Z=await xF("OpenRouter enrichment index","https://openrouter.ai/api/v1/models",{signal:AbortSignal.timeout(1e4)});if(!Z.ok)await EY("OpenRouter enrichment index",Z);let{data:Q}=await Z.json(),Y=Q.filter(Cv6).map(_v6);if($)await $.set(d88,"openrouter",Y);return i88(Y)}catch{return new Map}}function bv6($){let Z=$.replace(/\./g,"-"),Q=$.replace(/-\d{8}$/,""),Y=Q.replace(/\./g,"-");return[...new Set([$,Z,Q,Y])]}function xv6($){return $.providerId==="anthropic"||$.modelId.startsWith("anthropic/")}function n88($,Z){if(xv6(Z)&&$.includes("vision")&&!$.includes("file"))return[...$,"file"];return $}function fv6($,Z){return $.map((Q)=>{let X=bv6(Q.modelId).map((W)=>Z.get(W)).find(Boolean),J=Q.capabilities.length?Q.capabilities:X?.capabilities??[],G=n88(J,Q);if(!X)return G===J?Q:{...Q,capabilities:G};return{...Q,description:Q.description??X.description??null,capabilities:G,limits:Q.limits??X.limits??null,costs:Q.costs??X.costs??null}})}class _U1{storage;cache;constructor($,Z){this.storage=$;this.cache=Z}async activate($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=v9()[Q.providerId];if(!X)throw Error(`Unknown provider: ${Q.providerId}`);return X.create(Y)}async listDecisionModels($,Z){let Q=await this.activate($,Z);if(!Q.decisions?.listModels)throw Error("Provider does not support decision model discovery");let Y=`${Q.info.id}:decisions`,X=await this.cache?.get(Z,Y);if(X)return X;let J=new Set,G=(await Q.decisions.listModels()).filter((W)=>{if(W.deprecated||!W.capabilities.includes("decisions")||J.has(W.modelId))return!1;return J.add(W.modelId),!0}).map((W)=>({...W,providerId:Q.info.id}));return await this.cache?.set(Z,Y,G),G}async listModels($,Z){let{keyInfo:Q,apiKey:Y}=await this.storage.resolve($,Z),X=Q.providerId,J=v9()[X];if(!J)throw Error(`Unknown provider: ${X}`);if(this.cache){let U=await this.cache.get(Z,X);if(U)return p88(U,J.create(Y))}let G=J.create(Y),W=await G.listModels(),K=new Set,H=W.filter((U)=>{if(U.deprecated)return!1;if(K.has(U.modelId))return!1;return K.add(U.modelId),!0});if(X!=="openrouter"&&X!=="deco"){let U=await vv6(this.cache);H=fv6(H,U)}else H=H.map((U)=>({...U,capabilities:n88(U.capabilities,U)}));let F=H.map((U)=>({...U,providerId:X}));if(this.cache)await this.cache.set(Z,X,F);return p88(F,G)}}function p88($,Z){let Q=Z.asyncResearch;if(!Q)return $;return $.map((Y)=>Q.canHandle(Y.modelId)?{...Y,asyncResearch:!0}:Y)}var d88="_global";var t88=D(()=>{jW();A2()});import{SpanStatusCode as o88}from"@opentelemetry/api";function gv6($){if(!$)return;try{let Z=JSON.parse($);if(typeof Z!=="object"||Z===null||Array.isArray(Z))return;let Q={};for(let[Y,X]of Object.entries(Z)){if(Object.keys(Q).length>=yv6)break;if(typeof X==="string"&&Y.length<=r88&&X.length<=r88)Q[Y]=X}return Object.keys(Q).length>0?Q:void 0}catch{return}}function hv6($,Z){return Z?.connectionId??$?.headers.get("x-caller-id")??void 0}function uv6($){try{let Z=new URL($.url).pathname.split("/").filter(Boolean);if(Z[0]==="api"&&Z[1])return decodeURIComponent(Z[1])}catch{}return}function xU1($){let{auth:Z,headers:Q,role:Y,permissions:X,userId:J,apiKeyId:G,organizationId:W}=$,K=!!G,H=Z.api.hasPermission;return{isApiKeyPrincipal:K,hasPermission:async(F,U)=>{if(K)return BU1(X??{},F);let N=!!U?.organizationId&&!!W&&U.organizationId!==W,B=U?U.role:Y;if(CZ(B))return!0;if(X&&!N)return BU1(X,F);let O=R$8(U?.role,F,q$8());if(O!=="fallback")return O==="grant";if(!H)return console.error("[Auth] hasPermission API not available"),!1;let L=U?.organizationId?{organizationId:U.organizationId}:{};try{if((await H({headers:Q,body:{permission:F,...L}}))?.success===!0)return!0;let j=Be1(F);return(await H({headers:Q,body:{permission:j,...L}}))?.success===!0}catch(w){let j=w?.statusCode;if(j!==401&&j!==403)console.error("[Auth] Permission check failed:",w instanceof Error?w.message:String(w));return!1}},organization:{create:async(F)=>{return Z.api.createOrganization({body:F})},update:async(F)=>{return Z.api.updateOrganization({headers:Q,body:F})},delete:async(F)=>{await Z.api.deleteOrganization({headers:Q,body:{organizationId:F}})},get:async(F)=>{return Z.api.getFullOrganization({headers:Q,query:F?{organizationId:F}:void 0})},list:async()=>{return(await Z.api.listOrganizations({headers:Q})).filter((U)=>!k9(U))},addMember:async(F)=>{return Z.api.addMember({body:F})},removeMember:async(F)=>{return Z.api.removeMember({headers:Q,body:F})},updateMemberRole:async(F)=>{return Z.api.updateMemberRole({headers:Q,body:F})}},apiKey:{create:async(F)=>{return Z.api.createApiKey({body:{...F,userId:J}})},list:async()=>{return Z.api.listApiKeys({headers:Q})},update:async(F)=>{return Z.api.updateApiKey({body:{...F,userId:J}})},delete:async(F)=>{await Z.api.deleteApiKey({headers:Q,body:{keyId:F}})}}}}async function NA($,Z,Q){if(eu.includes(Q))return;let Y=await $.selectFrom("organizationRole").select(["permission"]).where("organizationId","=",Z).where("role","=",Q).executeTakeFirst();if(!Y?.permission)return;try{return JSON.parse(Y.permission)}catch{console.error(`[Auth] Failed to parse permissions for role: ${Q}`);return}}function cv6($,Z,Q){$l($,Z,Q)}function mv6($,Z,Q){Zl($,Z,Q)}async function a88($,Z,Q,Y){let X=vU1.get(Q);if(X&&Date.now()-X.at<s88)return X.value;let J=await Z.measure(Y,()=>$.selectFrom("organization").select(["metadata"]).where("id","=",Q).executeTakeFirst()),G=k9(J);return cv6(vU1,Q,G),mv6(vU1,lv6,s88),G}async function bU1($,Z,Q,Y,X){let J=X?.get(Q,Y);if(J)return J;let W=(await Z.measure("auth_query_membership",()=>$.selectFrom("member").select(["member.role"]).where("member.userId","=",Q).where("member.organizationId","=",Y).executeTakeFirst()))?.role;if(W)X?.set(Q,Y,W);return W}function dv6($,Z){if(!$)return!0;return Z===$}async function iv6($,Z,Q,Y,X){let J=kX0($.headers,"token");if(!J)return;let G=await Q.measure("auth_verify_onbehalf_studio_jwt",()=>ud0(J));if(!G?.sub)return;let W=G.metadata?.organizationId;if(!dv6(Y,W))return;let K=Y?await bU1(Z,Q,G.sub,Y,X):G.user?.role??void 0;return{id:G.sub,email:G.user?.email,name:G.user?.name,role:K}}async function pv6($,Z,Q,Y=$48,X){let J=$.headers.get("Authorization");try{let G=new Headers($.headers);G.set("X-MCP-Session-Auth","true");let W=await Y.measure("auth_get_mcp_session",()=>Z.api.getMcpSession({headers:G}));if(W){let K=W.userId,H=$.headers.get("x-org-id"),F=$.headers.get("x-org-slug"),U=uv6($),N=await Y.measure("auth_query_membership",()=>{let w=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","member.organizationId","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",K);if(U)return w.where("organization.slug","=",U).executeTakeFirst();if(H)return w.where("organization.id","=",H).executeTakeFirst();if(F)return w.where("organization.slug","=",F).executeTakeFirst();return w.orderBy("member.createdAt","asc").limit(2).execute().then((j)=>j.length===1?j[0]:void 0)});if(k9({metadata:N?.orgMetadata}))throw Error(MX0);let B=N?.role,O=N?{id:N.orgId,slug:N.orgSlug,name:N.orgName}:void 0;if(N&&B)X?.set(K,N.organizationId,B);let L;if(N&&B)L=await Y.measure("auth_fetch_role_permissions",()=>NA(Q,N.organizationId,B));return{user:{id:K,role:B},role:B,permissions:L,organization:O}}}catch(G){console.error("[Auth] OAuth session check failed:",G)}if(J?.startsWith("Bearer ")){let G=J.replace("Bearer ","").trim();try{let W=await Y.measure("auth_verify_studio_token",()=>ud0(G));if(W){let K,H=W.metadata?.organizationId;if(W.sub&&H)K=await bU1(Q,Y,W.sub,H,X);let F,U=W.metadata?.organizationId;if(U){let N=W.metadata?.organizationName,B=W.metadata?.organizationSlug;if(N||B){if(await a88(Q,Y,U,"auth_query_org_archived_for_studio_token"))return{user:void 0};F={id:U,name:N,slug:B}}else{let O=await Y.measure("auth_query_org_for_studio_token",()=>Q.selectFrom("organization").select(["id","slug","name","metadata"]).where("id","=",U).executeTakeFirst());if(k9(O))return{user:void 0};F=O?{id:O.id,slug:O.slug,name:O.name}:{id:U}}}return{user:{id:W.sub,connectionId:W.metadata?.connectionId,role:K},role:K,permissions:W.permissions,tokenOrganizationId:H,organization:F}}}catch{}try{let W=await Y.measure("auth_verify_api_key",()=>Z.api.verifyApiKey({body:{key:G}}));if(W?.valid&&W.key){let K=W.key.metadata?.organization;if(K?.id&&await a88(Q,Y,K.id,"auth_query_org_for_api_key"))return{user:void 0};let H=W.key.permissions,F,U=W.key.userId;if(U&&K?.id)F=await bU1(Q,Y,U,K.id,X);let N=await iv6($,Q,Y,K?.id,X);return{apiKeyId:W.key.id,user:N??{id:W.key.userId,role:F},role:N?N.role:F,permissions:H,apiKey:{id:W.key.id,name:W.key.name??"",userId:W.key.userId,metadata:W.key.metadata},tokenOrganizationId:K?.id,organization:K?{id:K.id,slug:K.slug,name:K.name}:void 0}}}catch(W){let K=W;if(K.body?.code==="INVALID_API_KEY"||K.message?.includes("Invalid API key"))console.warn("[Auth] invalid API key (Bearer)",{path:new URL($.url).pathname,method:$.method,ua:$.headers.get("user-agent")??void 0,ip:$.headers.get("x-forwarded-for")??$.headers.get("x-real-ip")??void 0,tokenPrefix:G.slice(0,8)});else console.error("[Auth] API key check failed:",K)}}try{let G=new Headers($.headers);G.delete("Authorization");let W=await Y.measure("auth_get_session",()=>Z.api.getSession({headers:G}));if(W){let K,H,F=$.headers.get("x-org-id"),U=$.headers.get("x-org-slug");if(!F&&!U&&$.method.toUpperCase()==="GET")try{let N=new URL($.url).searchParams;F=N.get("x-org-id"),U=N.get("x-org-slug")}catch{}if(F||U){let N=await Y.measure("auth_query_membership_from_header",()=>{let B=Q.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName","organization.metadata as orgMetadata"]).where("member.userId","=",W.user.id);if(F)B=B.where("organization.id","=",F);else if(U)B=B.where("organization.slug","=",U);return B.executeTakeFirst()});if(k9({metadata:N?.orgMetadata}))throw Error(MX0);if(N)K={id:N.orgId,slug:N.orgSlug,name:N.orgName},H=N.role}else if(W.session.activeOrganizationId){let N=await Y.measure("auth_get_full_organization",()=>Z.api.getFullOrganization({headers:G}).catch(()=>null));if(N&&!k9(N))K={id:N.id,slug:N.slug,name:N.name},H=N.members?.find((O)=>O.userId===W.user.id)?.role;else if(!N)K={id:W.session.activeOrganizationId,slug:"",name:""}}return{user:{id:W.user.id,email:W.user.email,emailVerified:!!W.user.emailVerified,name:W.user.name,image:W.user.image??void 0,role:H},role:H,organization:K}}}catch(G){let W=G;if(W.message===MX0)throw G;console.error("[Auth] Session check failed:",JSON.stringify({message:W.message,body:W.body,stack:W.stack},null,2))}return{user:void 0}}async function Z48($){let Z=new UX($.encryption.key),Q=E0(),Y=Q.clickhouseUrl,X=!!Y,J=!X&&!!Q.monitoringS3Bucket,G=X?"clickhouse":"duckdb",{resolve:W}=await import("path"),K=W(WK()),H=W(VN()),F=(A)=>`read_ndjson('${K}/${A}/**/*.ndjson', auto_detect=true)`,U=(A)=>`read_ndjson('${H}/${A}/**/*.ndjson', auto_detect=true)`,N,B,O,L,w=!1;if($.monitoringEngines)N=$.monitoringEngines.monitoringEngine,B=$.monitoringEngines.metricEngine,O=F,L=U;else if(X){let A=Q.clickhouseMaxMemoryUsage?{maxMemoryUsage:String(Q.clickhouseMaxMemoryUsage)}:void 0;N=new Sr(Y,A),B=new Sr(Y,A),O=(P)=>"studio_monitoring_logs",L=(P)=>"studio_monitoring_logs"}else if(J){let A=Q.monitoringS3AccessKeyId??Q.s3AccessKeyId,P=Q.monitoringS3SecretAccessKey??Q.s3SecretAccessKey,q=Q.duckdbExtensionDirectory;if(!A||!P||!q)throw Error("MONITORING_S3_BUCKET is set but the GCS monitoring path is misconfigured: MONITORING_S3_ACCESS_KEY_ID/S3_ACCESS_KEY_ID, MONITORING_S3_SECRET_ACCESS_KEY/S3_SECRET_ACCESS_KEY, and DUCKDB_EXTENSION_DIRECTORY are all required.");let x={endpoint:Q.monitoringS3Endpoint??Q.s3Endpoint??"storage.googleapis.com",region:Q.monitoringS3Region??Q.s3Region,accessKeyId:A,secretAccessKey:P,extensionDirectory:q},_=new kr(x,{memoryLimit:Q.duckdbMemoryLimit,threads:Q.duckdbThreads});N=_,B=_;let V=Q.monitoringS3Bucket,y=Q.monitoringS3Prefix??"",g=(l,i)=>oa1({bucket:V,prefix:y,range:i});O=g,L=g,w=!0}else{let{engine:A}=await qn0({basePath:WK()}),{engine:P}=await qn0({basePath:VN()});N=A,B=P,O=F,L=U}let j=new oh($.db),E=new d40($.db),z=new br($.db),T={connections:new Oo($.db,Z),connectionCredentialVault:new ui0($.db),organizationSettings:new rP($.db),userModelPreferences:new In0($.db),monitoring:new ni0(N,O,B,L,G,w),virtualMcps:new wF($.db),users:new ln0($.db),tags:new xr($.db),projectSidebar:new gn0($.db),experiments:new hn0($.db),organizationBilling:new kG($.db),aiProviderKeys:new ps($.db,Z,$.providerKeyCache),subsidizedGatewayKeys:new EU1($.db,Z),secrets:new b91($.db,Z),orgFileConfigs:new zU1($.db,Z),orgSites:new QO($.db),orgRepoSyncs:new _A($.db),gitProviderAccounts:new AA($.db),gitProviderAccountCredentials:new P00($.db,Z),gitProviderOAuthStates:new qU1($.db),githubConnectFlows:new TU1($.db),repositories:new A00($.db),jiraIntegrations:new YO($.db,Z),taskBoard:new D3($.db),columnAutomations:new MU1($.db),taskBoardPrompts:new IU1($.db),taskBoardAnalytics:new YJ1($.db),threadAnalytics:new WJ1($.db),notifications:new kU1($.db),orgFsEntries:new tt($.db),oauthPkceStates:new SU1($.db),claudeSubscriptions:new CU1($.db,Z),automations:EX0($.db),triggerCallbackTokens:new _r($.db),orgSsoConfig:new bn0($.db,Z),orgSsoSessions:new xn0($.db),brandContext:new vr($.db),organizationDomains:new VG($.db),organizationJoinRequests:new tu($.db),kv:z,interests:new vn0(z)};return async(A,P)=>{let q=P?.timings??$48,x=HS0(),_=A?await $.observability.tracer.startActiveSpan("studio.auth",async(Z0)=>{try{let r=await pv6(A,$.auth,$.db,q,$.memberRoleCache);return Z0.setStatus({code:o88.OK}),r}catch(r){throw Z0.setStatus({code:o88.ERROR,message:r.message}),Z0.recordException(r),r}finally{Z0.end()}}):{user:void 0},V=hv6(A,_.user),y=xU1({auth:$.auth,headers:A?.headers??new Headers,role:_.role,permissions:_.permissions,userId:_.user?.id,apiKeyId:_.apiKeyId,organizationId:_.organization?.id}),g={user:_.user,tokenOrganizationId:_.tokenOrganizationId,permissions:_.permissions,permissionsOrganizationId:_.permissions?_.organization?.id:void 0};if(_.apiKey)g.apiKey=_.apiKey;let l=_.organization,i=A?E0().baseUrl??`${new URL(A.url).origin}`:WZ(),p=new aP(g.user?.id,void 0,y,_.role,"self",void 0,l?.id),U0={...T,virtualMcps:Nt1(T.virtualMcps),threads:new fi0(j,l?.id),asyncResearchJobs:new wU1(E,l?.id)},v0=new _U1(U0.aiProviderKeys,$.modelListCache),G0=HX(),N0=!l?null:G0?TG(G0,l.id):new m3(l.id,i),o=l&&N0?new d3(N0,U0.orgFsEntries,l.id):null;yF1(U0,{objectStorage:N0,baseUrl:i,orgSlug:l?.slug});let $0={timings:q,auth:g,connectionId:V,organization:l,storage:U0,vault:Z,authInstance:$.auth,boundAuth:y,access:p,db:$.db,tracer:$.observability.tracer,meter:$.observability.meter,baseUrl:i,objectStorage:N0,orgFs:o,metadata:{requestId:crypto.randomUUID(),timestamp:new Date,wellKnownForwardableHeaders:Object.fromEntries(nv6.map((Z0)=>[Z0,A?.headers.get(Z0)??null]).filter(([,Z0])=>Z0!==null)),userAgent:(A?kX0(A.headers,"client"):null)||A?.headers.get("User-Agent")||void 0,ipAddress:(A?.headers.get("CF-Connecting-IP")||A?.headers.get("X-Forwarded-For"))??void 0,properties:gv6(A?kX0(A.headers,"properties"):null)},aiProviders:v0,createMCPProxy:async(Z0)=>{return await C88(Z0,$0)},invalidateMemberRole:$.memberRoleCache?(Z0,r)=>$.memberRoleCache.invalidate(Z0,r):void 0,getOrCreateClient:x,pendingRevalidations:[],firecrawlApiKey:E0().firecrawlApiKey};return $0}}function BE($,Z){$.storage.threads.setOrganizationId(Z.id),$.storage.asyncResearchJobs.setOrganizationId(Z.id);let Q=HX();$.objectStorage=Q?TG(Q,Z.id):new m3(Z.id,$.baseUrl),$.orgFs=new d3($.objectStorage,$.storage.orgFsEntries,Z.id),yF1($.storage,{objectStorage:$.objectStorage,baseUrl:$.baseUrl,orgSlug:Z.slug??void 0})}var yv6=50,r88=500,s88=60000,lv6=1e4,vU1,e88,cQ,$48,nv6;var wU=D(()=>{VK();BL();X$();I9();yi0();PY0();AY0();jt1();ra1();_3();Mn0();Vn0();kn0();Cn0();fn0();He1();Fe1();yr();fK();in0();hJ1();DY();cF1();Do();jU1();HU1();fs0();x10();v88();PU1();oK0();Wm();RU1();n40();XJ1();KJ1();xD();m88();vd0();GB();t88();FL();Sh();gF1();vU1=new Map;cQ={set:($)=>{e88=$},create:async($,Z)=>{return await e88($,Z)}},$48={measure:async($,Z)=>{return await Z()}},nv6=["x-hub-signature-256"]});import{DBOS as wS0,SchedulerMode as tv6}from"@dbos-inc/dbos-sdk";function Q48($){yU1=$}function Y48(){if(!yU1)throw Error("[org-fs] org-repo-sync runtime not initialized \u2014 setOrgRepoSyncRuntime() must run before the workflow fires");return yU1}async function rv6($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await cQ.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},BE(Y,{id:Q.id,slug:Q.slug}),Y}async function sv6($){try{let{db:Z}=Y48(),Q=await rv6(Z,$.organizationId);if(!Q)return{id:$.id,volume:$.volume,error:"organization no longer exists"};let Y=await AH0(Q,$);return"error"in Y?{id:Y.id,volume:Y.volume,error:Y.error}:{id:Y.id,volume:Y.volume}}catch(Z){return{id:$.id,volume:$.volume,error:Z instanceof Error?Z.message:String(Z)}}}async function av6($,Z){let Q=await wS0.runStep(()=>new _A(Y48().db).listEnabled(),{name:"loadOrgRepoSyncConfigs"});for(let Y of Q){let X=await wS0.runStep(()=>sv6(Y),{name:`syncOrgRepo:${Y.id}`});if(X.error)console.warn(`[org-fs] org repo sync ${X.id} (${X.volume}) failed: ${X.error}`)}}function X48(){if(fU1)return;fU1=wS0.registerWorkflow(av6,{name:"orgRepoSyncWorkflow"}),wS0.registerScheduled(fU1,{name:"orgRepoSyncWorkflow",crontab:ov6,mode:tv6.ExactlyOncePerIntervalWhenActive})}var ov6="7-59/10 * * * *",yU1=null,fU1=null;var J48=D(()=>{wU();TH0()});import{DBOS as jS0,SchedulerMode as ev6}from"@dbos-inc/dbos-sdk";function G48($){hU1=$}function W48(){if(!hU1)throw Error("[task-board-archive] runtime not initialized \u2014 setTaskBoardArchiveSweepRuntime() must run before the workflow fires");return hU1}async function Yb6($,Z){try{let Q=await VH(W48().db,$);if(!Q)return{organizationId:$,archived:0};let{archived:Y}=await Nb$(Q,$,Z);return{organizationId:$,archived:Y}}catch(Q){return{organizationId:$,archived:0,error:Q instanceof Error?Q.message:String(Q)}}}async function Xb6($,Z){let Q=new Date($.getTime()-Zb6),Y=await jS0.runStep(()=>new D3(W48().db).listItemsAwaitingArchive(Q,Qb6),{name:"loadArchiveCandidates"});if(Y.length===0)return;let X=await Promise.all(Gq0(Y).map(({organizationId:G,itemIds:W})=>jS0.runStep(()=>Yb6(G,W),{name:`archiveMergedForOrg:${G}`})));for(let G of X)if(G.error)console.warn(`[task-board-archive] org ${G.organizationId} failed: ${G.error}`);let J=X.reduce((G,W)=>G+W.archived,0);if(J>0)console.log(`[task-board-archive] archived ${J} of ${Y.length} candidates`)}function K48(){if(gU1)return;gU1=jS0.registerWorkflow(Xb6,{name:"taskBoardArchiveSweepWorkflow"}),jS0.registerScheduled(gU1,{name:"taskBoardArchiveSweepWorkflow",crontab:$b6,mode:ev6.ExactlyOncePerIntervalWhenActive})}var $b6="23 * * * *",Zb6=432000000,Qb6=200,hU1=null,gU1=null;var H48=D(()=>{xD();Cd();kd()});import{createHmac as Jb6,timingSafeEqual as Gb6}from"crypto";function U48($,Z,Q,Y=Date.now()){if(!Z||!Q)return!1;let X,J=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let U=H.slice(0,F).trim(),N=H.slice(F+1).trim();if(U==="t")X=N;else if(U==="v1")J.push(N)}if(!X||J.length===0)return!1;let G=Number(X);if(!Number.isFinite(G)||Math.abs(Y/1000-G)>Wb6)return!1;let W=Jb6("sha256",Q).update(`${X}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return J.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&Gb6(K,F)})}function N48($){let Z;try{Z=JSON.parse($)}catch{return null}let Q=y7(Z),Y=y7(y7(Q?.data)?.object);if(!Q||typeof Q.type!=="string"||!Y)return null;return{id:$K(Q.id),type:Q.type,created:typeof Q.created==="number"?Q.created:void 0,livemode:typeof Q.livemode==="boolean"?Q.livemode:void 0,data:{object:Y}}}function zS0($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function $K($){return typeof $==="string"?$:void 0}function y7($){return typeof $==="object"&&$!==null?$:void 0}function PS0($){return typeof $==="number"?new Date($*1000):null}function ES0($){return $K($)??$K(y7($)?.id)}function Kb6($){return ES0($.subscription)??$K(y7(y7($.parent)?.subscription_details)?.subscription)}function Hb6($){let Z=y7($.lines)?.data;if(Array.isArray(Z)){let Q=null;for(let Y of Z){let X=y7(y7(Y)?.period)?.end;if(typeof X==="number"&&(Q===null||X>Q))Q=X}if(Q!==null)return new Date(Q*1000)}return PS0($.period_end)}function Fb6($,Z){let Q=y7($.items)?.data;if(!Array.isArray(Q))return;for(let Y of Q){let X=y7(Y)?.amount;if(typeof X==="number"&&X<=0)continue;let J=ES0(y7(Y)?.price);if(J&&Z[J])return Z[J]}return}function cU1($,Z,Q){if($==="past_due")return;if($!=="active")return"free";return}function Ub6($){let Z=PS0($.current_period_end);if(Z)return Z;let Q=y7($.items)?.data;if(!Array.isArray(Q))return null;let Y=0;for(let X of Q){let J=y7(X)?.current_period_end;if(typeof J==="number"&&J>Y)Y=J}return Y>0?new Date(Y*1000):null}function uU1($,Z){let Q=PS0($.created);return!!Q&&!!Z.lastStripeEventAt&&Q<Z.lastStripeEventAt}function lU1($,Z){let Q=PS0($.created);if(!Q)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>Q?void 0:Q}async function Nb6($,Z){let Q=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Y=$K(y7(Q.metadata)?.orgId);if(!Y)return{handled:!1,reason:"no orgId"};if($K(y7(Q.metadata)?.kind)==="topup"){if(Q.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if($K(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let H=$K(Q.id);if(!H)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Y}),{handled:!1,reason:"topup session without id"};let F=Number(y7(Q.metadata)?.creditCents);if(!Number.isInteger(F)||F<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Y,creditCents:y7(Q.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Y,topUp:{creditCents:F,referenceId:`stripe-topup:${H}`}}}if(Q.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if($K(Q.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let X=await $.ensureBilling(Y);if(!X)return console.error("stripe webhook: PAID checkout for an org that does not exist",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"unknown org"};let J=ES0(Q.subscription);if(!J)return console.error("stripe webhook: subscription checkout without a sub id",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"subscription checkout without sub id"};if(uU1(Z,X))return{handled:!1,reason:"stale event"};if(X.stripeSubscriptionId&&X.stripeSubscriptionId!==J)return console.error("stripe webhook: refused checkout rebind",{organizationId:Y,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let G=ES0(Q.customer);if(!await $.bindSubscription(Y,{stripeSubscriptionId:J,...G?{stripeCustomerId:G}:{},status:"active",lastStripeEventAt:lU1(Z,X)}))return console.error("stripe webhook: lost the bind race",{organizationId:Y,subscriptionId:J,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:J};let K=$K(y7(Q.metadata)?.planId);return{handled:!0,organizationId:Y,...K?{planChange:{planId:K,note:`stripe checkout ${$K(Q.id)??""}`.trim()}}:{}}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Y=$K(Q.id);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};let J=Z.type==="customer.subscription.deleted";if(!J&&uU1(Z,X))return{handled:!1,reason:"stale event"};let G=J?"canceled":zS0(Q.status);await $.updateStripeState(X.organizationId,{status:G,currentPeriodEnd:Ub6(Q),...J&&{stripeSubscriptionId:null},lastStripeEventAt:lU1(Z,X)});let W=cU1(G,Q,E0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...W?{planChange:{planId:W,note:`stripe ${Z.type} (${G})`}}:{}}}case"invoice.paid":{let Y=Kb6(Q);if(!Y)return{handled:!1,reason:"no sub id"};let X=await $.getBillingByStripeSubscriptionId(Y);if(!X)return{handled:!1,reason:"unknown subscription"};if(uU1(Z,X))return{handled:!1,reason:"stale event"};await $.updateStripeState(X.organizationId,{status:"active",currentPeriodEnd:Hb6(Q),lastStripeEventAt:lU1(Z,X)});let J=Fb6({items:Q.lines},E0().stripePlanPriceIds);return{handled:!0,organizationId:X.organizationId,...J?{planChange:{planId:J,note:"stripe invoice.paid"}}:{}}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function Bb6($,Z){if(!Z.handled||$.livemode===!1)return null;let Q=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:zS0(Q.status),...typeof Q.cancel_at_period_end==="boolean"?{cancel_at_period_end:Q.cancel_at_period_end}:{}}};case"invoice.paid":if(Q.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function F48($,Z){let Q=Bb6($,Z);if(!Q)return;wY({event:Q.name,organizationId:Q.organizationId,...$.id?{uuid:NZ$(`stripe:${$.id}:${Q.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:Q.properties})}async function B48($){let Z=new kG(D8().db),Q=await Nb6(Z,$);if(!(Q.handled&&Q.topUp))F48($,Q);if(Q.handled&&Q.topUp)await cu$({organizationId:Q.organizationId,amountCents:Q.topUp.creditCents,referenceId:Q.topUp.referenceId}),F48($,Q);if(Q.handled&&Q.planChange){try{await pM0({organizationId:Q.organizationId,planId:Q.planChange.planId,note:Q.planChange.note})}catch(Y){if(!(Y instanceof Wi))throw Y;return console.error("stripe webhook: gateway REFUSED the plan change \u2014 the org has been "+"charged (or cancelled) and its entitlement did NOT move. Place it by hand through the gateway admin API.",{organizationId:Q.organizationId,planId:Q.planChange.planId,eventId:$.id,status:Y.status,error:Y.message}),Q}Hi(Q.organizationId)}if(!Q.handled&&Q.orphanSubscriptionId){let Y=Q.orphanSubscriptionId;try{await aB$(Y)}catch(J){if(!(J instanceof uZ&&(J.status===400||J.status===404)))throw J}let{refundedCents:X}=await eB$(Y);console.error("stripe webhook: reversed orphan subscription",{subscriptionId:Y,refundedCents:X,eventId:$.id})}return Q}var Wb6=300;var mU1=D(()=>{k80();SG();G6();yr();JD();nM0();X$()});import{DBOS as AS0,SchedulerMode as Db6}from"@dbos-inc/dbos-sdk";function D48($){iU1=$}function O48(){if(!iU1)throw Error("[subscription-sweep] runtime not initialized \u2014 setSubscriptionSweepRuntime() must run before the workflow fires");return iU1}async function jb6($){let{organizationId:Z,stripeSubscriptionId:Q}=$;if(!Q)return{organizationId:Z,action:"ok"};let Y=new kG(O48().db);try{let X,J,G=!1;try{let K=await Bj(Q);X=zS0(K.status),J=Eb6(K)}catch(K){if(!(K instanceof uZ)||K.status!==404)throw K;X="canceled",J=$.currentPeriodEnd,G=!0}let W=cU1(X,{},E0().stripePlanPriceIds);if(await Y.updateStripeState(Z,{status:X,currentPeriodEnd:J,...G&&{stripeSubscriptionId:null}}),!W)return{organizationId:Z,action:"ok"};return await pM0({organizationId:Z,planId:W,note:`studio subscription sweep (${X})`}),Hi(Z),console.warn("[subscription-sweep] revoked a paid tier whose webhook never arrived",{organizationId:Z,subscriptionId:Q,status:X}),{organizationId:Z,action:G?"gone":"revoked"}}catch(X){if(X instanceof Wi)console.error("[subscription-sweep] gateway REFUSED the revocation \u2014 the org still holds a tier it no longer pays for",{organizationId:Z,subscriptionId:Q,status:X.status});return{organizationId:Z,action:"failed",error:X instanceof Error?X.message:String(X)}}}function Eb6($){if(typeof $.current_period_end==="number")return new Date($.current_period_end*1000);let Z=0;for(let Q of $.items?.data??[])if(typeof Q.current_period_end==="number")Z=Math.max(Z,Q.current_period_end);return Z>0?new Date(Z*1000):null}async function zb6($,Z){let Q=E0();if(!Q.plansEnabled||!Q.stripeSecretKey)return;let Y=new Date($.getTime()-Lb6),X=await AS0.runStep(()=>new kG(O48().db).listSubscriptionsPastPeriodEnd(Y,wb6),{name:"loadLapsedSubscriptions"});if(X.length===0)return;let J=await Promise.all(X.map((W)=>AS0.runStep(()=>jb6(W),{name:`sweepSubscription:${W.organizationId}`})));for(let W of J)if(W.action==="failed")console.warn(`[subscription-sweep] org ${W.organizationId} failed: ${W.error}`);let G=J.filter((W)=>W.action==="revoked"||W.action==="gone").length;if(G>0)console.warn(`[subscription-sweep] revoked ${G} of ${X.length} lapsed subscriptions`)}function L48(){if(dU1)return;dU1=AS0.registerWorkflow(zb6,{name:"subscriptionSweepWorkflow"}),AS0.registerScheduled(dU1,{name:"subscriptionSweepWorkflow",crontab:Ob6,mode:Db6.ExactlyOncePerIntervalWhenActive})}var Ob6="41 * * * *",Lb6=172800000,wb6=100,iU1=null,dU1=null;var w48=D(()=>{k80();yr();JD();nM0();mU1();X$()});async function Pb6($,Z){let Q=await $.storage.tags.listOrgTags(Z),Y=Q.find((J)=>J.name.toLowerCase()===TS0);if(Y)return Y.id;return(await $.storage.tags.createTag(Z,TS0,pK0(Q.length))).id}async function Ab6($,Z,Q,Y,X){let J=await $.storage.taskBoard.getById(Q,Z);if(!J||!Lb$(J.status))return!1;let G=await $.storage.taskBoard.listPrs(Q,Z),W=await Promise.all(G.map(async(H)=>({...H,...await X($,Z,H)})));if(!xf(W))return!1;await $.storage.taskBoard.addItemTags(Q,[await Y()],"system");let K=await $.storage.taskBoard.getById(Q,Z);if(!K)return!1;return await $5($,{taskBoardItemId:Q,action:"tags_changed",actorId:null,data:{from:J.tags,to:K.tags,reason:"merged_pr_auto_tag"}}),L8(Z,K),!0}async function j48($,Z,Q,Y=Wq0){let X=null,J=()=>X??=Pb6($,Z),G=0;for(let W of Q)try{if(await Ab6($,Z,W,J,Y))G+=1}catch(K){console.error(`[task-board-merged-tag] ${W} failed`,K)}return{tagged:G}}var TS0="merged";var E48=D(()=>{x4();cY();Cd();kH();C7();P9()});import{DBOS as RS0,SchedulerMode as Tb6}from"@dbos-inc/dbos-sdk";function z48($){nU1=$}function P48(){if(!nU1)throw Error("[task-board-merged-tag] runtime not initialized \u2014 setTaskBoardMergedTagSweepRuntime() must run before the workflow fires");return nU1}async function Mb6($,Z){try{let Q=await VH(P48().db,$);if(!Q)return{organizationId:$,tagged:0};let{tagged:Y}=await j48(Q,$,Z);return{organizationId:$,tagged:Y}}catch(Q){return{organizationId:$,tagged:0,error:Q instanceof Error?Q.message:String(Q)}}}async function Ib6(){let $=await RS0.runStep(()=>new D3(P48().db).listItemsAwaitingMergedTag(TS0,qb6),{name:"loadMergedTagCandidates"});if($.length===0)return;let Z=await Promise.all(Gq0($).map(({organizationId:Y,itemIds:X})=>RS0.runStep(()=>Mb6(Y,X),{name:`tagMergedForOrg:${Y}`})));for(let Y of Z)if(Y.error)console.warn(`[task-board-merged-tag] org ${Y.organizationId} failed: ${Y.error}`);let Q=Z.reduce((Y,X)=>Y+X.tagged,0);if(Q>0)console.log(`[task-board-merged-tag] tagged ${Q} of ${$.length} candidates`)}function A48(){if(pU1)return;pU1=RS0.registerWorkflow(Ib6,{name:"taskBoardMergedTagSweepWorkflow"}),RS0.registerScheduled(pU1,{name:"taskBoardMergedTagSweepWorkflow",crontab:Rb6,mode:Tb6.ExactlyOncePerIntervalWhenActive})}var Rb6="41 * * * *",qb6=200,nU1=null,pU1=null;var T48=D(()=>{xD();Cd();kd();E48()});function R48($){if(!$)return!1;try{return new URL($).host==="api.decocms.com"}catch{return!1}}var M48,Vb6,q48=($)=>{let Z=0,Q=$.length;while(Z<Q){let Y=$.charCodeAt(Z);if(Y!==32&&Y!==9)break;Z++}while(Q>Z){let Y=$.charCodeAt(Q-1);if(Y!==32&&Y!==9)break;Q--}return Z===0&&Q===$.length?$:$.slice(Z,Q)},tU1=($,Z)=>{if(Z&&$.indexOf(Z)===-1)return{};let Q=$.split(";"),Y={};for(let X of Q){let J=X.indexOf("=");if(J===-1)continue;let G=q48(X.substring(0,J));if(Z&&Z!==G||!M48.test(G))continue;let W=q48(X.substring(J+1));if(W.startsWith('"')&&W.endsWith('"'))W=W.slice(1,-1);if(Vb6.test(W)){if(Y[G]=W.indexOf("%")!==-1?Cl(W,Ps):W,Z)break}}return Y},kb6=($,Z,Q={})=>{if(!M48.test($))throw Error("Invalid cookie name");let Y=`${$}=${Z}`;if($.startsWith("__Secure-")&&!Q.secure)throw Error("__Secure- Cookie must have Secure attributes");if($.startsWith("__Host-")){if(!Q.secure)throw Error("__Host- Cookie must have Secure attributes");if(Q.path!=="/")throw Error('__Host- Cookie must have Path attributes with "/"');if(Q.domain)throw Error("__Host- Cookie must not have Domain attributes")}for(let X of["domain","path"])if(Q[X]&&/[;\r\n]/.test(Q[X]))throw Error(`${X} must not contain ";", "\\r", or "\\n"`);if(Q&&typeof Q.maxAge==="number"&&Q.maxAge>=0){if(Q.maxAge>34560000)throw Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");Y+=`; Max-Age=${Q.maxAge|0}`}if(Q.domain&&Q.prefix!=="host")Y+=`; Domain=${Q.domain}`;if(Q.path)Y+=`; Path=${Q.path}`;if(Q.expires){if(Q.expires.getTime()-Date.now()>34560000000)throw Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");Y+=`; Expires=${Q.expires.toUTCString()}`}if(Q.httpOnly)Y+="; HttpOnly";if(Q.secure)Y+="; Secure";if(Q.sameSite)Y+=`; SameSite=${Q.sameSite.charAt(0).toUpperCase()+Q.sameSite.slice(1)}`;if(Q.priority)Y+=`; Priority=${Q.priority.charAt(0).toUpperCase()+Q.priority.slice(1)}`;if(Q.partitioned){if(!Q.secure)throw Error("Partitioned Cookie must have Secure attributes");Y+="; Partitioned"}return Y},qS0=($,Z,Q)=>{return Z=encodeURIComponent(Z),kb6($,Z,Q)};var I48=D(()=>{Uw();M48=/^[\w!#$%&'*.^`|~+-]+$/,Vb6=/^[ !#-:<-[\]-~]*$/});var Gp=($,Z,Q)=>{let Y=$.req.raw.headers.get("Cookie");if(typeof Z==="string"){if(!Y)return;let J=Z;if(Q==="secure")J="__Secure-"+Z;else if(Q==="host")J="__Host-"+Z;return tU1(Y,J)[J]}if(!Y)return{};return tU1(Y)},Sb6=($,Z,Q)=>{let Y;if(Q?.prefix==="secure")Y=qS0("__Secure-"+$,Z,{path:"/",...Q,secure:!0});else if(Q?.prefix==="host")Y=qS0("__Host-"+$,Z,{...Q,path:"/",secure:!0,domain:void 0});else Y=qS0($,Z,{path:"/",...Q});return Y},t40=($,Z,Q,Y)=>{let X=Sb6(Z,Q,Y);$.header("Set-Cookie",X,{append:!0})};var MS0=D(()=>{I48()});var V48=($)=>{let Q={...{origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[]},...$},Y=((J)=>{if(typeof J==="string")if(J==="*"){if(Q.credentials)return(G)=>G||null;return()=>J}else return(G)=>J===G?G:null;else if(typeof J==="function")return J;else return(G)=>J.includes(G)?G:null})(Q.origin),X=((J)=>{if(typeof J==="function")return J;else if(Array.isArray(J))return()=>J;else return()=>[]})(Q.allowMethods);return async function(G,W){function K(F,U){G.res.headers.set(F,U)}let H=await Y(G.req.header("origin")||"",G);if(H)K("Access-Control-Allow-Origin",H);if(Q.credentials)K("Access-Control-Allow-Credentials","true");if(Q.exposeHeaders?.length)K("Access-Control-Expose-Headers",Q.exposeHeaders.join(","));if(G.req.method==="OPTIONS"){if(Q.origin!=="*"||Q.credentials)K("Vary","Origin");if(Q.maxAge!=null)K("Access-Control-Max-Age",Q.maxAge.toString());let F=await X(G.req.header("origin")||"",G);if(F.length)K("Access-Control-Allow-Methods",F.join(","));let U=Q.allowHeaders;if(!U?.length){let N=G.req.header("Access-Control-Request-Headers");if(N)U=N.split(/\s*,\s*/)}if(U?.length)K("Access-Control-Allow-Headers",U.join(",")),G.res.headers.append("Vary","Access-Control-Request-Headers");return G.res.headers.delete("Content-Length"),G.res.headers.delete("Content-Type"),new Response(null,{headers:G.res.headers,status:204,statusText:"No Content"})}if(await W(),Q.origin!=="*"||Q.credentials)G.header("Vary","Origin",{append:!0})}};var k48=()=>{};function oU1($,Z){return`${$}:${Z}`}function S48($){let Z=$?.ttlMs??120000,Q=$?.maxSize??1e4,Y=new Map;function X(){if(Y.size<=Q)return;let J=Date.now();for(let[G,W]of Y)if(W.expiresAt<=J)Y.delete(G);if(Y.size>Q){let G=Y.size-Q,W=0;for(let K of Y.keys()){if(W>=G)break;Y.delete(K),W++}}}return{get(J,G){let W=oU1(J,G),K=Y.get(W);if(!K)return;if(K.expiresAt<=Date.now()){Y.delete(W);return}return K.role},set(J,G,W){let K=oU1(J,G);Y.set(K,{role:W,expiresAt:Date.now()+Z}),X()},invalidate(J,G){Y.delete(oU1(J,G))}}}class rU1{options;subscriptions=[];localEmit=null;originId=crypto.randomUUID();encoder=new TextEncoder;seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.localEmit=$;if(this.subscriptions.length>0)return;if(!this.localEmit)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder;this.subscriptions=C48.map((Y)=>Z.subscribe(Y));for(let Y of this.subscriptions)(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(typeof J?.originId!=="string"||typeof J?.organizationId!=="string"||typeof J?.event?.id!=="string"||typeof J?.event?.type!=="string")continue;if(J.originId===this.originId)continue;if(typeof J.messageId==="string"&&this.hasSeen(J.messageId))continue;this.localEmit?.(J.organizationId,J.event)}catch{}})().catch((X)=>{console.error("[NatsSSEBroadcast] Subscription error:",X)})}broadcast($,Z){this.localEmit?.($,Z);let Q={originId:this.originId,messageId:crypto.randomUUID(),organizationId:$,event:Z};try{let Y=this.options.getConnection();if(!Y)return;let X=this.encoder.encode(JSON.stringify(Q));for(let J of C48)Y.publish(J,X)}catch(Y){console.warn("[NatsSSEBroadcast] Publish failed (non-critical):",Y)}}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.localEmit=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var C48;var _48=D(()=>{C48=["studio.sse.broadcast","mesh.sse.broadcast"]});async function Cb6($,Z,Q=5){try{await E8(Z,{maxAttempts:Q,minTimeout:1000,maxTimeout:1e4,jitter:0})}catch(Y){console.error(`${$} Deferred start failed:`,Y instanceof P5?Y.cause:Y)}}function v48($){let Z=new rU1({getConnection:()=>$.getConnection()});_5.start(Z).catch((Q)=>{console.error("[SSEHub] Failed to start broadcast strategy:",Q)}),$.onReady(()=>{Cb6("[NatsSSEBroadcast]",()=>Z.start())})}var sU1=D(()=>{a$();_48();Rd();Rd()});var b48=()=>{};var aU1=()=>{};var x48=()=>{};var _b6,$Y7;var f48=D(()=>{b48();aU1();Uw();x48();_b6={br:".br",zstd:".zst",gzip:".gz"},$Y7=Object.keys(_b6)});var y48=D(()=>{f48()});var g48=()=>{};var h48=D(()=>{g48()});var u48=()=>{};var l48=D(()=>{Pr0()});var eU1=D(()=>{Nw();l48()});var $N1="x-hono-disable-ssg",EY7;var ZN1=D(()=>{eU1();EY7=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[$N1]:"true"}})}catch{return null}})()});var c48=D(()=>{JG0()});var QN1=D(()=>{c48()});var m48=D(()=>{h48();u48();aU1();ZN1();QN1();eU1()});var d48=D(()=>{ZN1();QN1();m48()});var ZX7;var i48=D(()=>{d48();({write:ZX7}=Bun)});var xb6=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,Z){this.#$.send($,Z??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,Z){this.#$.close($,Z)}},p48=($)=>{return(...Z)=>{if(typeof Z[0]==="function"){let[Q,Y]=Z;return async function(J,G){let W=await Q(J),K=await $(J,W,Y);if(K)return K;await G()}}else{let[Q,Y,X]=Z;return(async()=>{let J=await $(Q,Y,X);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var n48=()=>{};var o40=($)=>("server"in $.env)?$.env.server:$.env;var IS0=()=>{};var fb6;var t48=D(()=>{n48();IS0();fb6=p48(($,Z)=>{let Q=o40($);if(!Q)throw TypeError("env has to include the 2nd argument of fetch.");if(Q.upgrade($.req.raw,{data:{events:Z,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var r40=($)=>{let Z=o40($);if(!Z)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof Z.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Q=Z.requestIP($.req.raw);if(!Q)return{remote:{}};return{remote:{address:Q.address,addressType:Q.family==="IPv6"||Q.family==="IPv4"?Q.family:void 0,port:Q.port}}};var o48=D(()=>{IS0()});var YN1=D(()=>{y48();i48();t48();o48();IS0()});var r48;var s48=D(()=>{r48={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});function a48(){let $=Object.keys(V4.socialProviders??{}),Z=$.length>0,Q=$.map((X)=>({name:X,icon:r48[X].icon})),Y=E0().localMode;return{emailAndPassword:{enabled:V4.emailAndPassword?.enabled??!1},magicLink:{enabled:V4.magicLinkConfig?.enabled??!1},emailOtp:{enabled:V4.emailOtpConfig?.enabled??!1},resetPassword:{enabled:GS0},socialProviders:{enabled:Z,providers:Q},sso:V4.ssoConfig?{enabled:!0,providerId:V4.ssoConfig.providerId}:{enabled:!1},stdioEnabled:Y,localMode:hD()}}async function yb6($,Z,Q){try{if(!V4.inviteEmailProviderId||!V4.emailProviders||V4.emailProviders.length===0)return;let Y=_G(V4.emailProviders,V4.inviteEmailProviderId);if(!Y)return;let X=await $.selectFrom("member").innerJoin("user","user.id","member.userId").select(["user.email as email","member.role as role"]).where("member.organizationId","=",Z.id).execute(),J=gr,G=X.filter((H)=>(H.role??"").split(",").map((F)=>F.trim()).some((F)=>J.includes(F)));if(G.length===0)return;let W=CG(Y),K=`${WZ()}/${Z.slug}/settings/members`;await Promise.allSettled(G.map((H)=>W({to:H.email,subject:`New request to join ${Z.name}`,html:vG({preheader:`${Q} requested to join ${Z.name}.`,heading:"New join request",subheading:`<strong>${Q}</strong> requested to join <strong>${Z.name}</strong> on deco Studio.`,body:j2("Review request",K),footnote:"You can approve or deny this request from your members settings."})})))}catch(Y){console.error("[Auth] Failed to notify admins of join request:",Y)}}var XO,e48;var XN1=D(()=>{J8();YN1();G6();X$();Z3();SG();nF1();s$1();YS0();w2();DY();I9();Cn0();s48();uf();au();XO=new Z1;XO.post("/local-session",async($)=>{if(!hD())return $.json({success:!1,error:"Local mode is not active"},403);let Z;try{Z=r40($).remote.address}catch{}if(!(Z==="127.0.0.1"||Z==="::1"||Z==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:Y}=await Promise.resolve().then(() => (uf(),Sq0));await Y();let{auth:X}=await Promise.resolve().then(() => (Z3(),m$8)),J=await DY1();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let G=await kq0();return await X.api.signInEmail({body:{email:J.email,password:G},asResponse:!0})}catch(Y){return console.error("Failed to create local session:",Y),$.json({success:!1,error:Y instanceof Error?Y.message:"Failed to create local session"},500)}});XO.get("/my-capabilities/:slug",async($)=>{let Z=$.req.param("slug"),Q=await x8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({error:"Authentication required"},401);let Y=D8().db,X=await Y.selectFrom("organization").select(["id"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({role:null,capabilities:{}});let G=(await Y.selectFrom("member").select(["role"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())?.role??null;if(!G)return $.json({role:null,capabilities:{}});if(CZ(G))return $.json({role:G,capabilities:Ne1()});if(G==="user")return $.json({role:G,capabilities:mn0({self:[...RX0]})});let W=await Y.selectFrom("organizationRole").select(["permission"]).where("role","=",G).where("organizationId","=",X.id).executeTakeFirst(),K={},H=W?.permission;if(typeof H==="string")try{let F=JSON.parse(H);if(F&&typeof F==="object"&&!Array.isArray(F))K=F}catch{K={}}return $.json({role:G,capabilities:mn0(K)})});XO.get("/domain-lookup",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({found:!1,organizations:[]});let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({found:!1,organizations:[]});try{let X=(await new VG(D8().db).getAllByDomain(Q)).filter(QS0);if(X.length===0)return $.json({found:!1,organizations:[]});let J=await D8().db.selectFrom("organization").select(["id","name","slug","logo","metadata"]).where("id","in",X.map((K)=>K.organizationId)).execute(),G=new Map(J.map((K)=>[K.id,K])),W=X.map((K)=>{let H=G.get(K.organizationId);if(!H)return null;if(k9(H))return null;return{id:H.id,name:H.name,slug:H.slug,logo:H.logo,joinMode:K.joinMode}}).filter((K)=>K!==null);return $.json({found:W.length>0,organizations:W})}catch(Y){return console.error("[Auth] Domain lookup failed:",Y),$.json({success:!1,error:"Domain lookup failed"},500)}});XO.post("/domain-join",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;try{let J=D8().db,K=(await new VG(J).getAllByDomain(Q)).filter((B)=>B.verificationStatus==="verified"&&B.joinMode==="auto");if(K.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let H=await J.selectFrom("organization").select(["id","slug","metadata"]).where("id","in",K.map((B)=>B.organizationId)).execute(),F=new Map(H.filter((B)=>!k9(B)).map((B)=>[B.id,{id:B.id,slug:B.slug}])),U=K.flatMap((B)=>{let O=F.get(B.organizationId);return O?[O]:[]});if(U.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let N;if(X){let B=U.find((O)=>O.slug===X);if(!B)return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);N=B}else if(U.length===1)N=U[0];else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await x8.api.addMember({body:{userId:Z.user.id,role:"user",organizationId:N.id}})}catch(B){if(!Nj(B))return console.error("[Auth] Domain join addMember failed:",B),$.json({success:!1,error:"Failed to join organization"},500)}return f1.capture({distinctId:Z.user.id,event:"organization_domain_joined",groups:{organization:N.id},properties:{organization_id:N.id,organization_slug:N.slug,email_domain:Q}}),$.json({success:!0,slug:N.slug})}catch(J){return f1.captureException(J,Z.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});XO.post("/domain-setup",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Corporate email required"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.name==="string"&&Y.name.trim().length>0?Y.name.trim():null,J=typeof Y.logo==="string"&&Y.logo.length>0?Y.logo:null,G=Y.claimDomain!==!1;try{let W=D8().db,K=new VG(W),H=await K.getAllByDomain(Q);if(H.length>0){let z=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",Z.user.id).where("member.organizationId","in",H.map((T)=>T.organizationId)).executeTakeFirst();if(z)return $.json({success:!0,slug:z.slug,alreadyExists:!0})}let F=Q.split(".")[0]??Q,U=X??F.charAt(0).toUpperCase()+F.slice(1),N=(X??F).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||F.toLowerCase().replace(/[^a-z0-9-]/g,""),B=null;for(let T=0;T<3;T++){let A=T===0?"":`-${Math.random().toString(36).slice(2,6)}`,P=T===0?U:`${U}${A}`,q=`${N}${A}`;try{B=await x8.api.createOrganization({body:{name:P,slug:q,userId:Z.user.id}});break}catch(x){if(!(x instanceof Error&&("body"in x)&&x.body?.code==="ORGANIZATION_ALREADY_EXISTS")||T===2)throw x}}if(!B?.id)throw Error("Failed to create organization");let O=B.id;if(G)await K.add(O,Q,{joinMode:"auto",verificationStatus:"verified",verificationMethod:"email"});let L=!1,w=null,j=null;try{let z=E0().firecrawlApiKey;if(z){let T=await lK0(Q,z,U);if(T){let A=new vr(D8().db),P=await A.create(O,T);if(await A.setDefault(P.id,O),L=!0,T.name&&T.name!==U)w=T.name;j=T.favicon??T.logo??null}}}catch(z){console.error("[Auth] Brand extraction failed (non-fatal):",z)}let E={};if(!X&&w)E.name=w;if(J)E.logo=J;else if(j)E.logo=j;if(Object.keys(E).length>0)try{await x8.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:O,data:E}})}catch(z){console.error("[Auth] Org update failed (non-fatal):",z)}return f1.identify({distinctId:Z.user.id,properties:{email:Z.user.email,$set:{email:Z.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),f1.groupIdentify({groupType:"organization",groupKey:O,properties:{name:B.slug??N,slug:B.slug??N,email_domain:Q,brand_extracted:L,created_at:new Date().toISOString()}}),f1.capture({distinctId:Z.user.id,event:"organization_created",groups:{organization:O},properties:{organization_id:O,organization_slug:B.slug??N,email_domain:Q,brand_extracted:L}}),$.json({success:!0,slug:B.slug??N,brandExtracted:L})}catch(W){return f1.captureException(W,Z.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});XO.get("/org-access-status/:slug",async($)=>{let Z=$.req.param("slug"),Q=await x8.api.getSession({headers:$.req.raw.headers});if(!Q?.user)return $.json({success:!1,error:"Authentication required"},401);let Y=D8().db,X=await Y.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",Z).executeTakeFirst();if(!X)return $.json({status:"not-found"});let J={id:X.id,name:X.name,slug:X.slug,logo:X.logo};if(await Y.selectFrom("member").select(["id"]).where("userId","=",Q.user.id).where("organizationId","=",X.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await x8.api.listUserInvitations({headers:$.req.raw.headers}),K=Date.now(),H=W.find((F)=>F.organizationId===X.id&&F.status==="pending"&&new Date(F.expiresAt).getTime()>K);if(H)return $.json({status:"pending-invite",invitation:{id:H.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Q.user.emailVerified){let W=Q.user.email?.split("@")[1]?.toLowerCase();if(W&&!DH.has(W)){let K=await new VG(Y).getByOrgAndDomain(X.id,W);if(K?.verificationStatus==="verified"){if(K.joinMode==="auto")return $.json({status:"auto-domain-join",organization:{...J,domain:W}});if(K.joinMode==="request"){let H=await new tu(Y).getPending(X.id,Q.user.id);return $.json({status:H?"request-pending":"can-request",organization:{...J,domain:W}})}}}}return $.json({status:"no-access",organization:J})});XO.post("/domain-request-join",async($)=>{let Z=await x8.api.getSession({headers:$.req.raw.headers});if(!Z?.user)return $.json({success:!1,error:"Authentication required"},401);if(!Z.user.emailVerified)return $.json({success:!1,error:"Email must be verified to request access"},403);let Q=Z.user.email?.split("@")[1]?.toLowerCase();if(!Q||DH.has(Q))return $.json({success:!1,error:"Generic email domains cannot request access"},403);let Y=await $.req.json().catch(()=>({})),X=typeof Y.organizationSlug==="string"&&Y.organizationSlug.trim()?Y.organizationSlug.trim():null;if(!X)return $.json({success:!1,error:"organizationSlug is required"},400);try{let J=D8().db,G=await J.selectFrom("organization").select(["id","slug","name"]).where("slug","=",X).executeTakeFirst();if(!G)return $.json({success:!1,error:"Organization not found"},404);let W=await new VG(J).getByOrgAndDomain(G.id,Q);if(!W||W.verificationStatus!=="verified"||W.joinMode!=="request")return $.json({success:!1,error:"This organization is not accepting requests for your domain."},403);if(await J.selectFrom("member").select(["id"]).where("userId","=",Z.user.id).where("organizationId","=",G.id).executeTakeFirst())return $.json({success:!0,slug:G.slug,alreadyMember:!0});return await new tu(J).create(G.id,Z.user.id),await yb6(J,G,Z.user.email),f1.capture({distinctId:Z.user.id,event:"organization_join_requested",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:Q}}),$.json({success:!0,status:"pending"})}catch(J){return f1.captureException(J,Z.user.id),console.error("[Auth] Domain request-join failed:",J),$.json({success:!1,error:"Failed to request access"},500)}});XO.post("/ensure-organization",async($)=>{let Z=null;try{if(Z=await x8.api.getSession({headers:$.req.raw.headers}),!Z?.user)return $.json({success:!1,error:"Authentication required"},401);let Q=await XS0({db:D8().db,authApi:x8.api,user:{id:Z.user.id,email:Z.user.email,name:Z.user.name??null,emailVerified:!!Z.user.emailVerified},allowCreate:!0,createdVia:"commerce_onboarding_recovery"});if(Q.status==="ambiguous")return $.json({success:!1,status:Q.status,domain:Q.domain,organizations:Q.organizations});if(Q.status==="skipped")return $.json({success:!1,status:Q.status,reason:Q.reason,domain:Q.domain,error:"Organization creation is not available."},409);if(Q.status==="already_has_organization")return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain});return $.json({success:!0,status:Q.status,organization:Q.organization,domain:Q.domain})}catch(Q){let Y=Z?.user?.id;if(Y)f1.captureException(Q,Y);return console.error("[Auth] ensure organization failed:",Q),$.json({success:!1,error:"Failed to ensure organization"},500)}});e48=XO});import{createHmac as gb6}from"crypto";function $68($){return/^Bearer\s+(.+)$/i.exec($.get("authorization")??"")?.[1]?.trim()||null}function Z68($){if(!$||typeof $!=="object"||!("userId"in $)||typeof $.userId!=="string")return null;return $.userId}function hb6($){if(!$||typeof $!=="object"||!("user"in $))return null;let{user:Z}=$;if(!Z||typeof Z!=="object"||!("id"in Z)||typeof Z.id!=="string")return null;return Z.id}function ub6($){if(!$||typeof $!=="object"||!("valid"in $)||$.valid!==!0||!("key"in $))return null;return Z68($.key)}async function Q68($){let Z=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),Q=await x8.api.getMcpSession({headers:Z}).catch(()=>null),Y=Z68(Q);if(Y)return Y;let X=await x8.api.verifyApiKey({body:{key:$}}).catch(()=>null);return ub6(X)}function lb6($,Z){let Q=gb6("sha256",Z).update($).digest("base64");return encodeURIComponent(`${$}.${Q}`)}var JN1,Y68;var X68=D(()=>{J8();Z3();JN1=new Z1;JN1.get("/me",async($)=>{let Z=$68($.req.raw.headers),Q;if(Z)Q=await Q68(Z);else{let Y=await x8.api.getSession({headers:$.req.raw.headers}).catch(()=>null);Q=hb6(Y)}if(!Q)return $.json({error:"unauthorized"},401);return $.json({userId:Q})});JN1.post("/session-from-oauth",async($)=>{let Z=$68($.req.raw.headers);if(!Z)return $.json({error:"unauthorized"},401);let Q=await Q68(Z);if(!Q)return $.json({error:"unauthorized"},401);try{let Y=await x8.$context,X=await Y.internalAdapter.createSession(Q,!1),J=lb6(X.token,Y.secret);return $.json({sessionToken:J})}catch(Y){return console.error("[desktop-auth] failed to mint a session from an OAuth bearer:",Y instanceof Error?Y.message:String(Y)),$.json({error:"failed to mint a session"},500)}});Y68=JN1});var Wp=($)=>{let Z=$.req.header("sec-fetch-dest");if(Z!==void 0)return Z==="document";let Q=$.req.header("accept")??"";return Q.includes("text/html")&&!/text\/html\s*;\s*q\s*=\s*0/.test(Q)};function cb6($){let Z=$.req.path;return $.req.method==="GET"&&/\/fs\/[^/]+\/read$/.test(Z)||$.req.method==="POST"&&/\/fs\/[^/]+\/unlock$/.test(Z)}function GN1($){let Z=$.auth?.apiKey?.metadata;if(!Z||typeof Z!=="object"||Array.isArray(Z)||!("organization"in Z))return{present:!1};let Q=Z.organization;if(!Q||typeof Q!=="object"||Array.isArray(Q))return{present:!0};let Y=Q.id;return{present:!0,id:typeof Y==="string"?Y:void 0}}function db6($){let Z=$.split("/").filter(Boolean);if(Z[0]!=="api")return!1;let Q=Z.slice(2);return mb6.some((Y)=>Y.length===Q.length&&Y.every((X,J)=>X==="*"||X===Q[J]))}var mb6,Kp=async($,Z)=>{let Q=$.req.param("org");if(!Q)return $.json({error:"org slug missing in path"},400);let Y=$.get("studioContext");if(!Y?.db)return $.json({error:"studioContext not initialized"},500);let X=Y.db,J=db6($.req.path),G=await X.selectFrom("organization").select(["id","slug","name","metadata"]).where((F)=>J?F.or([F("slug","=",Q),F("id","=",Q)]):F("slug","=",Q)).executeTakeFirst().then((F)=>F??_G0(X,Q));if(!G){if(Wp($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let W=GN1(Y);if(Y.auth?.apiKey?.id&&W.present&&W.id!==G.id)return $.json({error:"forbidden: API key is scoped to another organization"},403);if(Y.auth?.tokenOrganizationId&&Y.auth.tokenOrganizationId!==G.id)return $.json({error:"forbidden: token is scoped to another organization"},403);if(k9(G)){if(Wp($))return $.redirect(`/${encodeURIComponent(Q)}`,302);return $.json({error:`organization "${Q}" not found`},404)}let K=Y.auth?.user?.id,H;if(K){let F=await X.selectFrom("member").select(["role"]).where("userId","=",K).where("organizationId","=",G.id).executeTakeFirst();if(F)H=F.role;else if(await kQ1(X,K))fD({action:"org_scope_admit",actorUserId:K,targetOrgId:G.id,method:$.req.method,route:$.req.path}),H="owner";else if(!cb6($)){if(Wp($))return $.redirect(`/${encodeURIComponent(G.slug)}`,302);return $.json({error:"forbidden: not a member of organization"},403)}}return Y.organization={id:G.id,slug:G.slug,name:G.name,role:H},Y.access.setOrganizationId(G.id),Y.access.setRole(H),BE(Y,G),await Z()};var VS0=D(()=>{wU();Vd();mb6=[["vault","connections","*","access-token"],["vault","connections","*","configuration"],["internal","task-board","import"],["internal","task-board","resolve"],["internal","commerce-diagnostic","share-invite"],["internal","organization-notices"],["internal","repositories","resolve"],["internal","repositories","*","tree"],["internal","repositories","*","file"],["internal","repositories","*","search"],["internal","repositories","*","change-requests"],["internal","repositories","*","commits"]]});function ib6($){if(MQ($.id)!==null)return!0;if(Cn1($.id))return!0;let Z=$.metadata?.liveAgentId;return typeof Z==="string"&&Z.length>0}function pb6($,Z){let Q=new Map,Y=(X)=>{let J=Q.get(X);if(J)return J;let G=(async()=>{if(!(await $.storage.orgSsoConfig.getByOrgId(X))?.enforced)return!0;return await $.storage.orgSsoSessions.isValid(Z,X)})();return Q.set(X,G),G};return async(X)=>{let J=await Promise.all(X.map((G)=>Y(G.orgId)));return X.filter((G,W)=>J[W]===!0)}}function nb6($){let Z=$.auth?.apiKey?.id?GN1($):{present:!1,id:void 0};if(Z.present&&!Z.id)return kS0;let Q=$.auth?.tokenOrganizationId;if(Z.id&&Q&&Z.id!==Q)return kS0;let Y=Z.id??Q??null;if(Y===null&&$.auth?.apiKey?.id)return kS0;return Y}var J68="/api/_me",kS0,tb6=256,ob6=20,rb6=50,sb6=10,ab6=5,G68=()=>{let $=new Z1;return $.get("/projects/search",async(Z)=>{let Q=Z.get("studioContext");Z.header("Cache-Control","private, no-store");let Y=p0(Q);if(!Y)return Z.json({error:"Unauthorized"},401);let X=nb6(Q);if(X===kS0)return Z.json({error:"forbidden: credential is scoped to another organization"},403);let J=(Z.req.query("q")??"").trim();if(!J)return Z.json({items:[]});if(J.length>tb6)return Z.json({error:"query too long"},400);let G=Number.parseInt(Z.req.query("limit")??"",10),W=Number.isFinite(G)&&G>0?Math.min(G,rb6):ob6,K=pb6(Q,Y),H=W+sb6,F=[];for(let U=0;U<ab6&&F.length<W;U++){let N=await Q.storage.virtualMcps.searchAcrossMemberships({userId:Y,term:J,limit:H,offset:U*H,organizationId:X}),B=N.filter((O)=>!ib6(O)).filter((O)=>!k9({metadata:O.organization_metadata})).map((O)=>({id:O.id,title:O.title,icon:O.icon,orgId:O.organization_id,orgName:O.organization_name,orgSlug:O.organization_slug}));if(F.push(...await K(B)),N.length<H)break}return Z.json({items:F.slice(0,W)})}),$};var W68=D(()=>{J8();p8();VS0();kS0=Symbol("deny")});var K68="Payload Too Large",H68,x5=($)=>{let Z=$.onError||(()=>{let Y=new Response(K68,{status:413});throw new q1(413,{res:Y})}),Q=$.maxSize;return async function(X,J){if(!X.req.raw.body)return J();let G=X.req.raw.headers.has("transfer-encoding"),W=X.req.raw.headers.has("content-length");if(W&&!G)return parseInt(X.req.raw.headers.get("content-length")||"0",10)>Q?Z(X):J();let K=0,H=X.req.raw.body.getReader(),U={body:new ReadableStream({async start(N){try{for(;;){let{done:B,value:O}=await H.read();if(B)break;if(K+=O.length,K>Q){N.error(new H68(K68));break}N.enqueue(O)}}finally{N.close()}}}),duplex:"half"};if(X.req.raw=new Request(X.req.raw,U),await J(),X.error instanceof H68)X.res=await Z(X)}};var ZK=D(()=>{OJ();H68=class extends Error{constructor($){super($);this.name="BodyLimitError"}}});import{createHash as eb6}from"crypto";function s40($,Z,Q=0){return Z.every((Y,X)=>$[Q+X]===Y)}function U68($){if(s40($,[137,80,78,71,13,10,26,10]))return{mime:"image/png",ext:"png"};if(s40($,[255,216,255]))return{mime:"image/jpeg",ext:"jpg"};if(s40($,[71,73,70,56])&&($[4]===55||$[4]===57)&&$[5]===97)return{mime:"image/gif",ext:"gif"};if(s40($,[82,73,70,70])&&s40($,[87,69,66,80],8))return{mime:"image/webp",ext:"webp"};return null}function KN1($){return WF($)}function Qx6($,Z){let Q=eb6("sha256").update($).digest("hex");return`${SS0}/${Q}.${Z}`}function _S0($,Z,Q){let Y=new URLSearchParams({path:Q}).toString();return`${$.replace(/\/$/,"")}${CS0}/fs/${encodeURIComponent(Z)}/read?${Y}`}function Hp($){let Z=HX(),Q=Z?TG(Z,WN1):new m3(WN1,$.baseUrl);return new d3(Q,$.storage.orgFsEntries,WN1,$x6)}async function a40($,Z){return(await $.listDir(Z,SS0).catch(()=>[])).filter((Y)=>Y.kind==="file").sort((Y,X)=>X.updatedAt.localeCompare(Y.updatedAt))}async function N68($,Z){return(await a40($,Z)).map((Y)=>({path:Y.path,current:Y.readPublic,updatedAt:Y.updatedAt}))}async function Yx6($,Z){if((await $.stat(Z,SS0))?.readPublic)await $.setReadPublic(Z,SS0,!1,{actor:Z})}async function HN1($,Z,Q){let Y=await a40($,Z);if(!Y.some((X)=>X.path===Q))throw new FX(`No such avatar: ${Q}`);await Yx6($,Z),await $.setReadPublic(Z,Q,!0,{actor:Z}),await Promise.all(Y.filter((X)=>X.path!==Q&&X.readPublic).map((X)=>$.setReadPublic(Z,X.path,!1,{actor:Z})))}async function Xx6($,Z,Q){try{let X=(await a40($,Z)).filter((J)=>J.path!==Q).slice(Zx6-1);await Promise.all(X.map((J)=>$.delete(Z,J.path,{actor:Z})))}catch(Y){console.warn("[user-fs] failed to evict old avatars",Y)}}async function B68($,Z){let{userId:Q,bytes:Y,contentType:X,ext:J}=Z,G=Qx6(Y,J);return await $.write(Q,G,Y,{actor:Q,contentType:X}),await HN1($,Q,G),await Xx6($,Q,G),G}async function D68($,Z,Q){if(!(await a40($,Z)).some((X)=>X.path===Q))throw new FX(`No such avatar: ${Q}`);await $.delete(Z,Q,{actor:Z})}async function O68($,Z){try{let Q=await a40($,Z);await Promise.all(Q.map((Y)=>$.delete(Z,Y.path,{actor:Z})))}catch(Q){console.warn("[user-fs] failed to clear avatars",Q)}}var WN1="org_user_fs",CS0="/api/_users",SS0="avatars",$x6,F68=2097152,Zx6=5;var FN1=D(()=>{Sh();FL();GB();BP();$x6={maxFileBytes:5242880,volumeQuotaBytes:67108864}});function e40($,Z,Q,Y){let X=d7(Q),J={"Content-Type":X,"X-Content-Type-Options":"nosniff","Cache-Control":Y?"public, max-age=0, must-revalidate":"private, max-age=0"};if(X.startsWith("text/html"))J["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin allow-downloads";return $.body(Buffer.from(Z),200,J)}var UN1=D(()=>{qK()});function vS0($,Z){if(Z instanceof FX)return $.json({error:Z.message},404);if(Z instanceof RG)return $.json({error:Z.message},400);if(Z instanceof DP)return $.json({error:Z.message},413);return console.error("[user-fs] request failed",Z),$.json({error:"Internal error"},500)}function bS0($){let Q=$.get("studioContext").auth?.user?.id;if(!Q)return{ok:!1,res:$.json({error:"Unauthorized"},401)};if(!KN1(Q))return{ok:!1,res:$.json({error:"Unsupported user id"},400)};return{ok:!0,userId:Q}}var L68=()=>{let $=new Z1;return $.get("/fs/:userId/read",async(Z)=>{let Q=Z.req.param("userId"),Y=Z.req.query("path")??"";if(!KN1(Q))return Z.json({error:"Invalid user id"},400);let X=Z.get("studioContext"),J=Hp(X),W=(await J.resolveReadAccess(Q,Y).catch(()=>({access:"private"}))).access==="public";if(!W&&X.auth?.user?.id!==Q)return Z.json({error:"Not found"},404);try{return e40(Z,await J.read(Q,Y),Y,W)}catch(K){return vS0(Z,K)}}),$.post("/avatar",x5({maxSize:F68,onError:(Z)=>Z.json({error:"Avatar exceeds the size limit"},413)}),async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let{userId:Y}=Q,X=Z.get("studioContext"),J=new Uint8Array(await Z.req.arrayBuffer());if(J.byteLength===0)return Z.json({error:"Empty request body"},400);let G=U68(J);if(!G)return Z.json({error:"Avatar must be a PNG, JPEG, GIF or WebP image"},415);try{let W=await B68(Hp(X),{userId:Y,bytes:J,contentType:G.mime,ext:G.ext});return Z.json({url:_S0(X.baseUrl,Y,W)})}catch(W){return vS0(Z,W)}}),$.get("/avatars",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await N68(Hp(Y),Q.userId);return Z.json({avatars:X.map((J)=>({...J,url:_S0(Y.baseUrl,Q.userId,J.path)}))})}),$.post("/avatar/select",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=await Z.req.json().catch(()=>null);if(typeof X?.path!=="string"||!X.path)return Z.json({error:"Body must be { path: string }"},400);try{return await HN1(Hp(Y),Q.userId,X.path),Z.json({url:_S0(Y.baseUrl,Q.userId,X.path)})}catch(J){return vS0(Z,J)}}),$.delete("/avatar",async(Z)=>{let Q=bS0(Z);if(!Q.ok)return Q.res;let Y=Z.get("studioContext"),X=Hp(Y),J=Z.req.query("path");if(!J)return await O68(X,Q.userId),Z.json({ok:!0});try{return await D68(X,Q.userId,J),Z.json({ok:!0})}catch(G){return vS0(Z,G)}}),$};var w68=D(()=>{J8();ZK();GB();FN1();UN1()});import{z as Fp}from"zod";var Jx6,Gx6,Wx6=200,Kx6=2000,Hx6=60,Fx6=2000,Ux6,xS0;var NN1=D(()=>{Jx6=["warn","block"],Gx6=Fp.enum(Jx6),Ux6=Fp.string().max(Fx6).refine(($)=>{try{let Z=new URL($);return Z.protocol==="https:"||Z.protocol==="http:"}catch{return!1}},{message:"ctaUrl must be an absolute http(s) URL"}),xS0=Fp.object({severity:Gx6,title:Fp.string().trim().min(1).max(Wx6),message:Fp.string().trim().min(1).max(Kx6),ctaLabel:Fp.string().trim().max(Hx6).nullable().optional(),ctaUrl:Ux6.nullable().optional()}).refine(($)=>!$.ctaLabel===!$.ctaUrl,{message:"ctaLabel and ctaUrl must be set together",path:["ctaUrl"]})});import{z as BN1}from"zod";function DN1($){let Z=$??{},Q=new Set([...Object.keys(EA.shape),...Object.keys(Z)]),Y={};for(let X of Q)Y[X]=jZ(Z,X);return{flags:Z,effective:Y}}var Nx6,j68;var E68=D(()=>{t9();Nx6=BN1.string().min(1).max(64).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),j68=BN1.record(Nx6,BN1.boolean())});function z68($,Z,Q){let Y=Q;for(;;){if(Y=$.indexOf(Z,Y),Y===-1)return-1;let X=$[Y+Z.length];if(X===void 0||X===`
 `||X==="\r")return Y;Y+=Z.length}}function P68($,Z){let Q=z68($,Bx6(Z),0);if(Q===-1)return null;let Y=$.indexOf(`
 `,Q);if(Y===-1)return null;let X=z68($,Dx6(Z),Y);if(X===-1)return null;let J=$.lastIndexOf(`
 `,X);return{from:Y+1,to:J+1}}function A68($,Z){let Q=P68($,Z);return Q?$.slice(Q.from,Q.to):null}function T68($,Z,Q){let Y=P68($,Z);if(!Y)throw Error(`prompt region "${Z}" not found in source`);let X=Q.endsWith(`
@@ -3734,7 +3734,7 @@ ${J.join(`
 `)}`:X}function St6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var XY8=200,zt6=12,At6,Rt6=300,nC0=3;var CD1=D(()=>{Z7();a$();pC0();At6={aheadBy:0,behindBy:0,files:[]}});function _t6($){if(!$||$.includes(".."))return!1;return Ct6.test($)}function GY8($){return vt6.includes($)}function _D1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!_t6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function vD1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Ct6,vt6;var WY8=D(()=>{Ct6=/^[\w./@-]+$/;vt6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function l60($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function HY8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Qz(k7);let J=await bj($.storage,X,Y);if(J&&await DD($.storage,J)){let F=await RU($,J,{forceRefresh:!0}).catch((U)=>{throw new Qz(U instanceof Error?U.message:k7)});await KY8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Qz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await jm({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:k7;throw new Qz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await qU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=XL$(F instanceof Error?F.message:String(F));throw U?new Qz(N):F});await KY8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function KY8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Cp($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await JE(K,bt6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var bt6=10485760,Qz;var bD1=D(()=>{RW();yC0();w$0();qH0();i00();Z7();Qz=class Qz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function ft6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!xt6.test(Z))throw Error(`Invalid branch name: ${$}`)}function ty($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(yt6)])}async function ht6($,Z){let Q=$.var.studioContext,Y=bU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Af(G?.metadata?.runtime);if(W)return W;let K=IR0(Z.virtualMcpMetadata),H=K==="cms"?await UD1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)j$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function ut6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await gX($.var.studioContext)}catch{return null}}function oy($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function fp($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=l60(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=J0(Y);return Om(Y,J.id,X)}function fD1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=ED$(Z);if(Y!==void 0)return $.json({error:Q},429,{...G9,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof s6)return $.json({error:Q},409,G9);let X=VW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,G9)}return $.json({error:Q},502,G9)}async function xD1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function BY8($){try{let Z=await fp($),Q=await tC0(Z,$.get("vmClaim").branch);return $.json(Q,200,G9)}catch(Z){return fD1($,Z)}}function c60($,Z){let Y=(sC0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return sC0.set($,X),X.finally(()=>{if(sC0.get($)===X)sC0.delete($)}),Y}async function NQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,G9);let Y=Q?.runner??oy($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...G9}})}}let O=await B.text(),L=Q?.redactRepoDir?lt6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...G9}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function lt6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function aC0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function ct6($){return DY8.includes($)}var xt6,FY8=524288,UY8=65536,yt6=1e4,NY8=2000,gt6,sC0,G9,DY8,OY8=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",gt6),$.post("/:virtualMcpId/:branch/write",(Q)=>NQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>NQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>NQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>NQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>NQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>NQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>NQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!ct6(Y))return Q.json({error:`step must be one of: ${DY8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await UD1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await ut6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,G9);if(Y==="start"){let G=J0(Q.var.studioContext),W=Nd(X.virtualMcpMetadata);try{await TR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return NQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return DO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return NQ8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return BY8(Q);return Z(Q)});let Z=(Q)=>NQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(NY8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return BY8(Q);return NQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(NY8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await fp(Q),G=await oC0(J,Y.branch,X.base);return Q.json(G,200,G9)}catch(X){return fD1(Q,X)}return NQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,G9);let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return c60(X,async()=>{try{await ND1(W,Y,X);let K=l60(J,G);if(K)await HY8(W,Y,X,K)}catch(K){if(K instanceof Qz)return Q.json({error:K.message},403,G9);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,G9)}return NQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return c60(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,G9);try{let G=await fp(Q);return await JY8(G,Y.branch,J),Q.json({ok:!0},200,G9)}catch(G){let W=VW(G)===409||G instanceof s6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,G9)}});return c60(Y.claimName,()=>NQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return c60(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await fp(Q),H=W.base??await K.getDefaultBranch();return await rC0(K,Y.branch,H),Q.json({ok:!0},200,G9)}catch(W){return fD1(Q,W)}});let X=oy(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return c60(J,async()=>{try{await ND1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,G9)}return NQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",x5({maxSize:FY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=oy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=OD1(F)&&N?[F,U]:X?await Promise.all([aC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),aC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await fp(Q);return Promise.all([tC0(w,Y.branch),oC0(w,Y.branch)])})();await oG(K,J0(K).id,"suggesting a commit message");let L=await wQ8(K,B,O);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",x5({maxSize:FY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=oy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=OD1(F)&&N?[F,U]:X?await Promise.all([aC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),aC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await fp(Q);return Promise.all([tC0(w,Y.branch),oC0(w,Y.branch)])})();await oG(K,J0(K).id,"judging whether a change needs review");let L=await EQ8(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return xD1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",x5({maxSize:UY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=_D1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=vD1(J,W.resolveType);return xD1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",x5({maxSize:UY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):Bd(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=_D1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!GY8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=vD1(G,K.resolveType);return xD1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var LY8=D(()=>{J8();ZK();Sp();FD1();Ud();HQ8();yW();Dd();FQ8();xW();WH();UQ8();BQ8();L71();L$0();jD1();zQ8();Z7();T5();CD1();WY8();MR0();bD1();xt6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;gt6=fC0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=p0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=J0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{ft6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=z10({orgId:X.id,virtualMcpId:J,branch:G}),H=await g91(Q,G),F=h91(H,Y),U=KQ8({userId:F,projectRef:K}),N=W.metadata??null,B=await ht6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await gX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});sC0=new Map;G9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};DY8=["clone","install","start"]});function wY8($,Z,Q){let Y=yD1.get($);if(!Y)Y={pending:null,running:!1},yD1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)dt6($,Y);return J}async function dt6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await it6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)yD1.delete($)}}async function it6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await xp(Z,Q),W=await Z.listDecofileEntries(G,Y),K=VD1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=kD1(K,N),L=`${JSON.stringify(B,null,2)}
 `;await $Y8(Z.repo,L);let w=O[0]??`${iC0(Y)}/${PD1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of kD1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await ZY8(Z,F.values(),X),{decofile:B,skipped:O}=b60(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:KH(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:pt6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof s6)||J>=mt6-1)throw N;await O$(U7(2000,200,J,2,0.5))}}}function pt6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return w51(Y,$.deps.coAuthor)}var mt6=3,yD1;var jY8=D(()=>{pA0();hC0();i4();a$();Z7();pC0();yD1=new Map});import{createHmac as EY8,randomBytes as nt6,timingSafeEqual as tt6}from"crypto";function zY8(){if(eC0)return eC0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return eC0=$?Buffer.from($):nt6(32),eC0}function gD1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+ot6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=EY8("sha256",zY8()).update(Y).digest("base64url");return`${Y}.${X}`}function PY8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(EY8("sha256",zY8()).update(Y).digest("base64url"));if(X.length!==J.length||!tt6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var ot6=21600000,eC0=null;var AY8=D(()=>{X$()});function $_0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function rt6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=$_0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function TY8($){let Z;try{Z=$_0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=rt6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=$_0(G),K=W&&$_0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as yp}from"zod";function at6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&st6.test($)}function VY8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function m60($){let Z=$.get("decofileScope");return Om($.var.studioContext,Z.organizationId,Z.repository)}function d60($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof s6)return $.json({error:Q},409);let Y=VW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function kY8(){let $=new Z1;return $.use("/:virtualMcpId/:branch",IY8),$.use("/:virtualMcpId/:branch/*",IY8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await m60(Z),X=await QY8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(TY8(X.decofile),200,{...J,"content-type":"application/json"});let G=gD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(VY8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return d60(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await m60(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return d60(Z,X)}}),$.patch("/:virtualMcpId/:branch",$o6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=Zo6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=x60(X.data)}catch(G){if(G instanceof f60)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{gC0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(zD1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await m60(Z),W=await wY8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Cp(Y)},J),K=gD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:VY8(Z)})}catch(G){return d60(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await m60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(VW(W)!==409)throw W;await rC0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(VW(G)===409)return Z.json({error:"merge-conflict"},409);if(VW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return d60(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await m60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(VW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return d60(Z,Y)}}),$}var st6,RY8=500,qY8=1048576,MY8=1024,et6=8388608,$o6,Zo6,IY8;var SY8=D(()=>{MR0();hC0();J8();ZK();FD1();yC0();bD1();Z7();jY8();AY8();CD1();pC0();WH();st6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;$o6=x5({maxSize:et6,onError:($)=>$.json({error:"Payload too large"},413)}),Zo6=yp.object({set:yp.record(yp.string(),yp.unknown()).optional(),delete:yp.array(yp.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=RY8,{message:`Patch cannot touch more than ${RY8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=qY8),{message:`Each block must be at most ${qY8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=MY8),{message:`Each block key must be at most ${MY8} characters`}),IY8=fC0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!at6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!PY8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await IJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Bd(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=l60(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var CY8=($)=>{let Z=new Z1;if(Z.use("*",Kp),Z.use("*",Q58),Z.route("/",$58($.voiceSessions)),Z.route("/",iS0()),Z.route("/",g58()),Z.route("/",R58()),Z.route("/",n78()),Z.route("/",o78()),Z.route("/",h78()),Z.route("/",i78()),Z.route("/",l78()),Z.route("/",vC0()),Z.route("/tools",QQ8()),Z.route("/",e78()),Z.route("/",w78({kvStorage:$.kvStorage})),Z.route("/",O78()),Z.route("/fs",S78({getConnection:$.getNatsConnection})),Z.route("/sandbox",OY8()),Z.route("/decofile",kY8()),Z.route("/",f78()),Z.route("/",_78()),Z.route("/deco-sites",nS0()),Z.route("/hosting",B58()),Z.route("/monitor",z58()),Z.route("/sso",uS0()),Z.route("/",bC0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",K58()),$.mountDevAssets)Z.route("/dev-assets",sS0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",G88()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",b78()),Z.route("/mcp",fM0()),Z.route("/mcp/self",kC0()),Z.route("/mcp",hM0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var _Y8=D(()=>{J8();Z58();Y58();VS0();H58();CN1();D58();P58();aS0();rE();MN1();fN1();L78();j78();C78();v78();q80();jN1();uM0();ZD1();x78();y78();u78();c78();XD1();t78();r78();$Q8();JD1();YQ8();GD1();yM0();LY8();SY8()});import{z as ry}from"zod";class hD1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new xY8.Kvm(Z_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Z_0.StorageType.Memory,ttl:fY8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?bY8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await O$(200);continue}let G=vY8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await O$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,vY8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?bY8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var Z_0,xY8,fY8,vY8,bY8;var yY8=D(()=>{OJ();fU();a$();Z_0=C(OK(),1),xY8=C(YA(),1),fY8=C(Az(),1),vY8=new TextEncoder,bY8=ry.discriminatedUnion("state",[ry.object({state:ry.literal("ready"),agentId:ry.string()}),ry.object({state:ry.literal("creating"),expiresAt:ry.number()})])});import{z as gp}from"zod";function Qo6($){return{model:$.model,instructions:`${oR$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class uD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Qo6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:gp.object({session:gp.object({id:gp.string().min(1)}),transport:gp.object({type:gp.literal("webrtc"),sdp:gp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var gY8=D(()=>{fU()});var hY8;var uY8=D(()=>{hY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function lD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:nR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:hY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:VD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var lY8=D(()=>{fU();uY8()});import{z as nX}from"zod";import{createHash as Yo6,createHmac as Xo6}from"crypto";class Q_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Yo6("sha256").update(JSON.stringify(lD1($))).digest("hex"),this.conversationKey=Xo6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Q_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...lD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var cY8=D(()=>{lY8()});import{createHmac as Jo6,timingSafeEqual as Go6}from"crypto";import{z as hp}from"zod";function dY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Jo6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function iY8($,Z){let Q=Buffer.from(JSON.stringify(mY8.parse($))).toString("base64url");return`${Q}.${dY8(Q,Z)}`}function pY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(dY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Go6(W,G))return null;try{let K=mY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+VD)return null;return K.data}catch{return null}}var mY8;var nY8=D(()=>{fU();mY8=hp.object({sessionId:hp.string().uuid(),organizationId:hp.string().min(1).max(256),userId:hp.string().min(1).max(256),threadId:hp.string().min(1).max(256),expiresAt:hp.number().int().positive()})});import{z as cD1}from"zod";function tY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return mD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var mD1;var oY8=D(()=>{mD1=cD1.object({provider:cD1.enum(["elevenlabs","openai"]),model:cD1.string().trim().min(1).max(128)})});import{createHash as Wo6}from"crypto";import{z as up}from"zod";function lp($){return`user.${Wo6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class iD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new rY8.Kvm(X_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:X_0.StorageType.Memory,ttl:sY8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=tY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+VD},W=iY8(G,this.deps.secret),K=await this.kv(),H=lp(G),F=await K.get(H),U=F?.operation==="PUT"?Y_0.parse(F.json()):null,N=dD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:lp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=pY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=lp(Q),J=await Y.get(X),G=J?.operation==="PUT"?Y_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,dD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=lp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Y_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,dD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(lp($));if(Q?.operation==="PUT"&&Y_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(lp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var X_0,rY8,sY8,Y_0,dD1;var aY8=D(()=>{OJ();fU();nY8();oY8();X_0=C(OK(),1),rY8=C(YA(),1),sY8=C(Az(),1),Y_0=up.object({sessionId:up.string().uuid(),expiresAt:up.number(),connected:up.boolean().optional(),conversation:mD1.optional(),characters:up.number().int().nonnegative(),requests:up.number().int().nonnegative()}),dD1=new TextEncoder});function Ko6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Ho6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},eY8=()=>{let $=new Z1;return $.use("*",Ho6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Ko6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var $X8=D(()=>{J8();X$();_k0()});import{z as y1}from"zod";function zN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Eo6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function zo6($,Z,Q){try{return JSON.parse($)}catch{throw new YX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Po6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:zo6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ao6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nF(Q.function.parameters):nF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function To6($){if(!$)return;return{openai:{response_format:$}}}function Ro6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ZX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function QX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Fo6=256,Uo6,No6,Bo6,Do6,Oo6,Lo6,wo6,jo6,YX8,XX8,JX8;var GX8=D(()=>{y4();J8();Sp();vH();Uo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),No6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Bo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(No6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Do6=y1.object({type:y1.literal("text")}),Oo6=y1.object({type:y1.literal("json_object")}),Lo6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),wo6=y1.union([Do6,Oo6,Lo6]),jo6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Bo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Uo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:wo6.optional(),user:y1.string().optional()});YX8=class YX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};XX8=new Z1;XX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=jo6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Eo6(J.model);if(!G)return $.json(zN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(zN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Po6(J.messages),N=J.tools?Ao6(J.tools):void 0,B=To6(J.response_format),O=Ro6(),L=Math.floor(Date.now()/1000);if(J.stream)return DO($,async(w)=>{let j=ZX8(F,U,N,J,B,$.req.raw.signal);try{let E=Fd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=Fo6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:QX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ZX8(F,U,N,J,B,$.req.raw.signal),j=await gU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:QX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zN(X.message,"server_error"),500)}});JX8=XX8});function qo6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function WX8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!qo6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var KX8=D(()=>{J8();aG()});var FX8;var HX8=D(()=>{FX8={name:"decocms",version:"4.429.15",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function Vo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Io6}}var UX8,Io6="https://ph.studio.decocms.com",NX8;var BX8=D(()=>{J8();Vs();uf();I9();X$();XN1();HX8();UX8=new Z1;UX8.get("/",($)=>{let Z={version:FX8.version,theme:X5$(),...pK().logo&&{logo:pK().logo},...hD()&&{internalUrl:kp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:a48(),posthog:Vo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:MO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});NX8=UX8});function sy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function pD1($){return(sy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function DX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(sy($))}&sz=${Z}`}function ko6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function OX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=ko6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as z$}from"zod";var So6,LX8;var wX8=D(()=>{So6=z$.object({check_id:z$.string(),title:z$.string(),description:z$.string().optional(),impact:z$.string().optional(),why:z$.string().optional(),category:z$.string(),severity:z$.string(),value_band:z$.string().optional(),value_driver:z$.string().optional(),controllability:z$.string().optional(),pages:z$.array(z$.string()),tasks:z$.array(z$.string()),evidence:z$.string(),sample_scope:z$.string().optional(),sources:z$.array(z$.string())}),LX8=z$.object({domain:z$.string(),brand:z$.string(),favicon:z$.string().optional(),scanned_at:z$.string().nullable(),lang:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),totals:z$.object({measured:z$.number(),registry_total:z$.number(),passed:z$.number(),failed:z$.number(),blocked:z$.number()}),buckets:z$.array(z$.object({id:z$.enum(["critical","important","worth"]),label:z$.string(),items:z$.array(So6)})),passing:z$.object({count:z$.number(),items:z$.array(z$.object({check_id:z$.string(),title:z$.string()}))}),not_measured:z$.object({count:z$.number(),groups:z$.array(z$.object({reason:z$.string(),label:z$.string(),count:z$.number(),checks:z$.array(z$.string())}))}),categories:z$.array(z$.object({key:z$.string(),label:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),pass:z$.number(),fail:z$.number()})),screenshots:z$.array(z$.object({url:z$.string(),page_type:z$.string().optional(),viewport:z$.enum(["desktop","mobile"]),image_url:z$.string()}))})});function jX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${EW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function J_0($,Z={}){let Q=await fetch(jX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return LX8.parse(await Q.json())}async function EX8($,Z={}){let Q=await fetch(jX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var nD1=D(()=>{wX8();tB()});import{join as zX8}from"path";async function _o6($){try{let Z=await J_0($,{signal:AbortSignal.timeout(Co6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||pD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function vo6($,Z){let Q=sy($),Y=Z?.brand?.trim()||pD1(Q),X=DX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=OX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class uD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Qo6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:gp.object({session:gp.object({id:gp.string().min(1)}),transport:gp.object({type:gp.literal("webrtc"),sdp:gp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var gY8=D(()=>{fU()});var hY8;var uY8=D(()=>{hY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function lD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:nR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:hY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:VD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var lY8=D(()=>{fU();uY8()});import{z as nX}from"zod";import{createHash as Yo6,createHmac as Xo6}from"crypto";class Q_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Yo6("sha256").update(JSON.stringify(lD1($))).digest("hex"),this.conversationKey=Xo6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Q_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...lD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var cY8=D(()=>{lY8()});import{createHmac as Jo6,timingSafeEqual as Go6}from"crypto";import{z as hp}from"zod";function dY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Jo6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function iY8($,Z){let Q=Buffer.from(JSON.stringify(mY8.parse($))).toString("base64url");return`${Q}.${dY8(Q,Z)}`}function pY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(dY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Go6(W,G))return null;try{let K=mY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+VD)return null;return K.data}catch{return null}}var mY8;var nY8=D(()=>{fU();mY8=hp.object({sessionId:hp.string().uuid(),organizationId:hp.string().min(1).max(256),userId:hp.string().min(1).max(256),threadId:hp.string().min(1).max(256),expiresAt:hp.number().int().positive()})});import{z as cD1}from"zod";function tY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return mD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var mD1;var oY8=D(()=>{mD1=cD1.object({provider:cD1.enum(["elevenlabs","openai"]),model:cD1.string().trim().min(1).max(128)})});import{createHash as Wo6}from"crypto";import{z as up}from"zod";function lp($){return`user.${Wo6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class iD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new rY8.Kvm(X_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:X_0.StorageType.Memory,ttl:sY8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=tY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+VD},W=iY8(G,this.deps.secret),K=await this.kv(),H=lp(G),F=await K.get(H),U=F?.operation==="PUT"?Y_0.parse(F.json()):null,N=dD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:lp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=pY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=lp(Q),J=await Y.get(X),G=J?.operation==="PUT"?Y_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,dD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=lp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Y_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,dD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(lp($));if(Q?.operation==="PUT"&&Y_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(lp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var X_0,rY8,sY8,Y_0,dD1;var aY8=D(()=>{OJ();fU();nY8();oY8();X_0=C(OK(),1),rY8=C(YA(),1),sY8=C(Az(),1),Y_0=up.object({sessionId:up.string().uuid(),expiresAt:up.number(),connected:up.boolean().optional(),conversation:mD1.optional(),characters:up.number().int().nonnegative(),requests:up.number().int().nonnegative()}),dD1=new TextEncoder});function Ko6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Ho6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},eY8=()=>{let $=new Z1;return $.use("*",Ho6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Ko6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var $X8=D(()=>{J8();X$();_k0()});import{z as y1}from"zod";function zN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Eo6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function zo6($,Z,Q){try{return JSON.parse($)}catch{throw new YX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Po6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:zo6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ao6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nF(Q.function.parameters):nF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function To6($){if(!$)return;return{openai:{response_format:$}}}function Ro6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function ZX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function QX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Fo6=256,Uo6,No6,Bo6,Do6,Oo6,Lo6,wo6,jo6,YX8,XX8,JX8;var GX8=D(()=>{y4();J8();Sp();vH();Uo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),No6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Bo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(No6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Do6=y1.object({type:y1.literal("text")}),Oo6=y1.object({type:y1.literal("json_object")}),Lo6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),wo6=y1.union([Do6,Oo6,Lo6]),jo6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Bo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Uo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:wo6.optional(),user:y1.string().optional()});YX8=class YX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};XX8=new Z1;XX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=jo6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Eo6(J.model);if(!G)return $.json(zN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(zN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Po6(J.messages),N=J.tools?Ao6(J.tools):void 0,B=To6(J.response_format),O=Ro6(),L=Math.floor(Date.now()/1000);if(J.stream)return DO($,async(w)=>{let j=ZX8(F,U,N,J,B,$.req.raw.signal);try{let E=Fd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=Fo6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:QX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=ZX8(F,U,N,J,B,$.req.raw.signal),j=await gU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:QX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zN(X.message,"server_error"),500)}});JX8=XX8});function qo6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function WX8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!qo6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var KX8=D(()=>{J8();aG()});var FX8;var HX8=D(()=>{FX8={name:"decocms",version:"4.429.16",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function Vo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Io6}}var UX8,Io6="https://ph.studio.decocms.com",NX8;var BX8=D(()=>{J8();Vs();uf();I9();X$();XN1();HX8();UX8=new Z1;UX8.get("/",($)=>{let Z={version:FX8.version,theme:X5$(),...pK().logo&&{logo:pK().logo},...hD()&&{internalUrl:kp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:a48(),posthog:Vo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:MO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});NX8=UX8});function sy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function pD1($){return(sy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function DX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(sy($))}&sz=${Z}`}function ko6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function OX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=ko6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as z$}from"zod";var So6,LX8;var wX8=D(()=>{So6=z$.object({check_id:z$.string(),title:z$.string(),description:z$.string().optional(),impact:z$.string().optional(),why:z$.string().optional(),category:z$.string(),severity:z$.string(),value_band:z$.string().optional(),value_driver:z$.string().optional(),controllability:z$.string().optional(),pages:z$.array(z$.string()),tasks:z$.array(z$.string()),evidence:z$.string(),sample_scope:z$.string().optional(),sources:z$.array(z$.string())}),LX8=z$.object({domain:z$.string(),brand:z$.string(),favicon:z$.string().optional(),scanned_at:z$.string().nullable(),lang:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),totals:z$.object({measured:z$.number(),registry_total:z$.number(),passed:z$.number(),failed:z$.number(),blocked:z$.number()}),buckets:z$.array(z$.object({id:z$.enum(["critical","important","worth"]),label:z$.string(),items:z$.array(So6)})),passing:z$.object({count:z$.number(),items:z$.array(z$.object({check_id:z$.string(),title:z$.string()}))}),not_measured:z$.object({count:z$.number(),groups:z$.array(z$.object({reason:z$.string(),label:z$.string(),count:z$.number(),checks:z$.array(z$.string())}))}),categories:z$.array(z$.object({key:z$.string(),label:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),pass:z$.number(),fail:z$.number()})),screenshots:z$.array(z$.object({url:z$.string(),page_type:z$.string().optional(),viewport:z$.enum(["desktop","mobile"]),image_url:z$.string()}))})});function jX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${EW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function J_0($,Z={}){let Q=await fetch(jX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return LX8.parse(await Q.json())}async function EX8($,Z={}){let Q=await fetch(jX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var nD1=D(()=>{wX8();tB()});import{join as zX8}from"path";async function _o6($){try{let Z=await J_0($,{signal:AbortSignal.timeout(Co6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||pD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function vo6($,Z){let Q=sy($),Y=Z?.brand?.trim()||pD1(Q),X=DX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=OX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
     `)}function bo6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function PX8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=sy(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(zX8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${EW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(xo6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=sy(Q.req.param("file").replace(/\.md$/,""));try{let X=await EX8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(fo6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?zX8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await _o6(sy(Y)),K=vo6(Y,W);return Q.html(bo6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var Co6=2500,xo6=1e4,fo6=1e4;var AX8=D(()=>{J8();tB();nD1();X$()});function G_0($,Z){return fetch(`${EW({})}${$}`,Z)}async function yo6($,Z){let Q=await J_0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function ho6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var go6,LO,TX8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},RX8;var qX8=D(()=>{J8();Z3();tB();nD1();go6=new Set(["complete","errored","terminated","unknown"]);LO=new Z1;LO.use("*",async($,Z)=>{let Q=await x8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});LO.use("/link-token/*",TX8);LO.use("/suggest",TX8);LO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await yo6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});LO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=ho6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await G_0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${rw({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});LO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await G_0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${rw({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:go6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});LO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await G_0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});LO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await G_0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});RX8=LO});var uo6=1048576,tD1;var MX8=D(()=>{J8();ZK();X$();mU1();tD1=new Z1;tD1.post("/webhook",x5({maxSize:uo6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=E0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!U48(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=N48(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await B48(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as lo6}from"crypto";function do6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return lo6(Buffer.from(X),Buffer.from(Y))}function io6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function IX8($){let Z=new Z1;return Z.post("/webhook",x5({maxSize:co6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!do6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!mo6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return b10().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=io6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await po6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function po6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await gb$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var co6=5242880,mo6;var VX8=D(()=>{J8();ZK();xW();C7();mo6=new Set(["check_suite","issue_comment"])});import{DBOS as rD1,SchedulerMode as no6}from"@dbos-inc/dbos-sdk";async function oo6(){try{return await ro6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function ro6(){if(!v10())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (V91(),I91)),Promise.resolve().then(() => (M91(),q91))]),Q=await b10(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=D8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=XT$({sandboxes:J,pools:G,records:await JT$(X,J,G),legacyPools:JT0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await GT$(K,MH0(X,new UX(E0().encryptionKey)),{now:W,orgFsLifetimeMs:KT0}),U=0,N=0,B=0;for(let O of H)try{let L=await Y.pushCredentials(O);U+=L.stored,N+=L.kept}catch(L){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${L instanceof Error?L.message:String(L)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function so6($,Z){let Q=await rD1.runStep(oo6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function kX8(){if(oD1)return;if(!E0().agentSandboxEnabled||!v10())return;oD1=rD1.registerWorkflow(so6,{name:"sandboxCredentialPushWorkflow"}),rD1.registerScheduled(oD1,{name:"sandboxCredentialPushWorkflow",crontab:to6,mode:no6.ExactlyOncePerIntervalWhenActive})}var to6="1-59/10 * * * *",oD1=null;var SX8=D(()=>{SG();BL();L41();HT0();GT0();xW();X$()});function CX8($){let Z=new YO($.db,new UX($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=e_$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new lQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var _X8=D(()=>{J8();BL();c71();FE();n40()});import{DBOS as Yz,SchedulerMode as ao6}from"@dbos-inc/dbos-sdk";function vX8($){aD1=$}function $O1(){if(!aD1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return aD1}function ZO1(){let $=$O1();return new YO($.db,new UX($.encryptionKey))}async function Yr6($){try{let Z=await ZO1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await VH($O1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new lQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${$r6}m"`,W=0,K;for(let H=0;H<Zr6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await aH1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function Xr6($,Z){let Q=await Yz.runStep(()=>ZO1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Yz.runStep(()=>Yr6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function Jr6($,Z){try{let Q=await ZO1().getById($);if(!Q?.enabled)return"disabled";let Y=await VH($O1().db,Q.organizationId);if(!Y)return"disabled";let X=await aH1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function Gr6($,Z){await Yz.sleep(xk0()+Qr6),await Yz.runStep(()=>Jr6($,Z),{name:"settleJiraMove"})}async function bX8($,Z){if(!eD1)throw Error("[jira-trigger] settle workflow is not registered");await Yz.startWorkflow(eD1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function xX8(){if(sD1)return;eD1=Yz.registerWorkflow(Gr6,{name:"jiraSettleWorkflow"}),sD1=Yz.registerWorkflow(Xr6,{name:"jiraTriggerSweepWorkflow"}),Yz.registerScheduled(sD1,{name:"jiraTriggerSweepWorkflow",crontab:eo6,mode:ao6.ExactlyOncePerIntervalWhenActive})}var eo6="7-59/10 * * * *",$r6=35,Zr6=5,Qr6=5000,aD1=null,eD1=null,sD1=null;var QO1=D(()=>{BL();n40();kd();FE();rH1();fk0()});function fX8($){let Z=new YO($.db,new UX($.encryptionKey));async function Q(X,J){let G=xe$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await bX8(W.id,G)}let Y=new Z1;return Y.post("/webhook/:secret",x5({maxSize:Wr6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var Wr6=1048576;var yX8=D(()=>{J8();ZK();BL();QO1();fk0();n40()});function gX8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var hX8,Kr6,Hr6,uX8;var lX8=D(()=>{J8();OJ();yd();oc();hX8=new Z1,Kr6=["range","if-none-match","if-modified-since"],Hr6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];hX8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Wp($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await X80(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&AW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return gX8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of Kr6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of Hr6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),gX8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});uX8=hX8});var i60=b((ay)=>{var Fr6=ay&&ay.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Ur6=ay&&ay.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Fr6(Z,$,Q)};Object.defineProperty(ay,"__esModule",{value:!0});Ur6(OG(),ay)});var dX8=b((cX8)=>{Object.defineProperty(cX8,"__esModule",{value:!0});cX8.version=void 0;cX8.version="3.4.0"});var nX8=b((PN)=>{var Nr6=PN&&PN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(PN,"__esModule",{value:!0});PN.NodeTransport=PN.VERSION=void 0;PN.nodeResolveHost=jr6;var s5=i60(),Br6=M0("net"),YO1=M0("tls"),Dr6=M0("path"),iX8=M0("fs"),Or6=Nr6(M0("dns")),Lr6=dX8();PN.VERSION=Lr6.version;var wr6="nats.js";class pX8{socket;version;lang;yields=[];signal=(0,s5.deferred)();closedNotification=(0,s5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=wr6,this.version=PN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,s5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw s5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new s5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new s5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,s5.deferred)(),Q,Y=(0,Br6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=s5.DataBuffer.concat(...this.yields),X=(0,s5.extractProtocolMessage)(Y);if(X!=="")try{let J=s5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s5.deferred)();try{if($=(0,Dr6.resolve)($),!(0,iX8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,iX8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,s5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,s5.deferred)();try{let X=(0,YO1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,s5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s5.deferred)();try{let Y=(0,YO1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof YO1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s5.render)($)}`);let Z=(0,s5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}PN.NodeTransport=pX8;function jr6($){let Z=(0,s5.deferred)();return Or6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var aX8=b((sX8)=>{Object.defineProperty(sX8,"__esModule",{value:!0});sX8.connect=Er6;var tX8=nX8(),oX8=i60(),rX8=i60();function Er6($={}){if((0,rX8.hasWsProtocol)($))return Promise.reject(rX8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,oX8.setTransportFactory)({factory:()=>{return new tX8.NodeTransport},dnsResolveFn:tX8.nodeResolveHost}),oX8.NatsConnectionImpl.connect($)}});var eX8=b((wO)=>{var Pr6=wO&&wO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Ar6=wO&&wO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Pr6(Z,$,Q)};Object.defineProperty(wO,"__esModule",{value:!0});wO.connect=void 0;var Tr6=aX8();Object.defineProperty(wO,"connect",{enumerable:!0,get:function(){return Tr6.connect}});Ar6(i60(),wO)});function YJ8($){let Z=$?.connectFn??Ir6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:Mr6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(qr6,Rr6,O-1,2,0.5);await O$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?$J8.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=QJ8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function Ir6($){return ZJ8.connect($)}var $J8,ZJ8,QJ8,Rr6=100,qr6=3000,Mr6=3000;var XJ8=D(()=>{a$();$J8=C(Az(),1),ZJ8=C(eX8(),1),QJ8=C(OK(),1)});function W_0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function K_0($,Z){return`${$}.${Z}`}class XO1{cache;constructor($){this.cache=W_0({ttlMs:$?.ttlMs??Vr6,maxSize:$?.maxSize??kr6})}async get($,Z){return this.cache.get(K_0($,Z))??null}async set($,Z,Q){this.cache.set(K_0($,Z),Q)}async invalidate($,Z){this.cache.delete(K_0($,Z)),this.cache.delete(K_0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var Vr6=600000,kr6=5000;var JJ8=()=>{};function H_0($,Z){return`${$}:${Z}`}function JO1($){let Z=W_0({ttlMs:$?.ttlMs??Sr6,maxSize:$?.maxSize??Cr6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(GJ8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(H_0(K,H))},set(K,H,F){Z.set(H_0(K,H),F)},invalidate(K,H){Z.delete(H_0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(GJ8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(H_0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var GJ8="studio.ai-provider-keys.invalidate",Sr6=30000,Cr6=5000;var WJ8=()=>{};class GO1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var KJ8=($)=>{let Z;return()=>Z??=$()},WO1,KO1;var HJ8=D(()=>{k6();WO1=KJ8(()=>e1.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),KO1=KJ8(()=>e1.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function gr6($=NJ8){return{name:tU,subjects:[`${tY1}.>`],storage:nH.StorageType.File,max_age:br6,max_bytes:fr6,max_msgs_per_subject:yr6,discard:nH.DiscardPolicy.Old,retention:nH.RetentionPolicy.Limits,duplicate_window:xr6,num_replicas:$}}class BJ8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function FJ8($){let Z=UJ8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function cr6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,vr6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function mr6($,Z){return $.info?.cluster?Z:1}function dr6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class HO1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=gr6(X);try{await Y.streams.info(tU),await Y.streams.update(tU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(tU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(tU),await Y.streams.add(J);else throw G}},Q=await E8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await nH.jetstreamManager($),X=mr6($,NJ8);try{await Z(Y,X)}catch(J){if(X<=1||!dr6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:pd});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=cr6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=Ay$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=rY1(H,{runId:Z}),N=performance.now()-F;WO1().record(N),KO1().add(1,{"org.id":Y??"unknown"}),lr6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?FJ8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),ur6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await E8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:FJ8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pd}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=rY1(Z,{runId:$,dedup:Q});WO1().record(performance.now()-X),KO1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Py$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?nH.DeliverPolicy.New:nH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=jE($),W;try{W=await E8(async()=>{return(await Y.consumers.get(tU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pd})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=YM0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(eq0()).pipeThrough($M0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(tU,{filter:jE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var nH,UJ8,_r6=($)=>{let Z;return()=>Z??=$()},vr6,br6=86400000000000,xr6=120000000000,fr6=4294967296,NJ8,yr6=500000,hr6,ur6,lr6;var DJ8=D(()=>{a$();sY1();XM0();ZM0();k6();HJ8();nH=C(OK(),1),UJ8=C(Az(),1),vr6=_r6(()=>e1.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),NJ8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);hr6=process.env.STREAM_ENCODE_TRACE==="1",ur6=process.env.DECOPILOT_STREAM_TRACE==="1";lr6=hr6?new BJ8:null});function F_0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,DF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var OJ8=D(()=>{p8()});class FO1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function ir6($,Z,Q={}){let Y=$.startsWith("thread:")?RH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function UO1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await xU($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await tm($,{threadId:X,runBranch:G?.branch}),K=await l00($,Q,N41(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=ir6(W,await TT0($,X),{flat:Bf(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await O3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var LJ8=D(()=>{Z7();yW();C7()});async function wJ8($,Z,Q){let Y=Z.organizationId;if(!uX(Z))return!1;if(!xf(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=zU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await $5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),L8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var jJ8=D(()=>{x4();cY();Cd();kH();P9()});function ar6($){return $ instanceof kX}function EJ8($,Z){return Z-$>=rr6}class NO1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??pr6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??tr6,Q=this.options.itemIntervalMs??nr6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-f71),YY1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-sr6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await $Y1(this.taskBoard,X,Y),await ZY1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==R$.progress||uX(W)||W.assigneeId!==R8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await UO1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!EJ8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:R$.progress,to:R$.review,reason:H}}).catch(()=>{}),L8(J,F),await SH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==R$.progress||G.assigneeId!==R8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await CH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),ar6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+or6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==R$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),L8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!EJ8(WD(Q,Z.reviewCycleStartedAt),Date.now()))return;await SH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!uX(Y))return!1;let X=Y.assigneeId===R8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await UO1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await bd(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await wJ8(G,Y,W))return!0;if(await qg$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!rQ1(W))return!1;return await _d(G,Y,{previewMatchesHead:sQ1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await DE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var pr6=60000,nr6=300000,tr6=50,or6=60000,rr6=900000,sr6=120000;var zJ8=D(()=>{x4();Oq0();LJ8();pU();O80();kH();jJ8();P9();IW();XY1();C7();l$0();vd()});import{readdir as er6,rm as U_0}from"fs/promises";import{join as N_0}from"path";async function B_0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-$s6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await ey($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await PJ8($,X,Z);else if(!X.startsWith(".")){let J=N_0($,X),G=await ey(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await PJ8(J,K,Z)}if((await ey(J)).length===0)await U_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function PJ8($,Z,Q){let Y=0,X=N_0($,Z),J=await ey(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=N_0(X,W),H=await ey(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=N_0(K,U);await U_0(B,{recursive:!0,force:!0}),Y++}}if((await ey(K)).length===0)await U_0(K,{recursive:!0,force:!0})}if((await ey(X)).length===0)await U_0(X,{recursive:!0,force:!0});return Y}async function ey($){try{return(await er6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var $s6=30;var BO1=()=>{};import{DBOS as DO1,SchedulerMode as Zs6}from"@dbos-inc/dbos-sdk";async function Ys6(){let $=[WK(),Kg(),VN()],Z=0;for(let Q of $)try{Z+=await B_0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function Xs6($,Z){await DO1.runStep(()=>Ys6(),{name:"monitoringRetention"})}function TJ8(){if(AJ8)return;AJ8=!0;let $=DO1.registerWorkflow(Xs6,{name:"monitoringRetentionWorkflow"});DO1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Qs6,mode:Zs6.ExactlyOncePerIntervalWhenActive})}var Qs6="23 4 * * *",AJ8=!1;var RJ8=D(()=>{_3();BO1()});function qJ8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await cQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await NA($.db,Z,Y.role);return X.boundAuth=xU1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new aP(Q,void 0,X.boundAuth,Y.role,"self"),BE(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var MJ8=D(()=>{fK();wU()});function Js6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Gs6(){return{services:Js6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function Ks6(){for(let $ of Ws6)$()}function IJ8($){let Z=[...OO1.logs,$];OO1={...OO1,logs:Z.length>500?Z.slice(-500):Z},Ks6()}function LO1(){return Hs6}var OO1,Ws6,Hs6=!1;var wO1=D(()=>{OO1=Gs6(),Ws6=new Set});import{EventEmitter as Fs6}from"events";var jO1;var VJ8=D(()=>{wO1();jO1=new Fs6;jO1.on("request",($)=>{IJ8($)})});function kJ8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=cp(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>cp(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${cp(N.method)}${W9.reset}`}}catch{}}let W=cp(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${cp(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=Ns6(Y),H=G?"\u25C0":"\u2190";if(!LO1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=Us6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!LO1())console.log(`${W9.dim}${O}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);jO1.emit("request",{method:Y,path:cp(X),status:U,duration:F,timestamp:new Date})}}}var W9,Us6=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},Ns6=($)=>{return W9[$]||W9.reset},cp=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var SJ8=D(()=>{wO1();VJ8();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as bJ8}from"crypto";import{mkdir as Bs6,readdir as Ds6,rm as CJ8,stat as xJ8}from"fs/promises";import{join as zO1,relative as Os6}from"path";import{z as Q8}from"zod";function yJ8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return zO1(Ls6,Z)}function gJ8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function EO1($,Z){let Q=yJ8($),Y=gJ8(Z);return zO1(Q,Y)}function ws6($,Z,Q,Y){let X=E0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return bJ8("sha256",X).update(J).digest("hex")}function vJ8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=ws6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${gJ8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function hJ8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${bJ8("md5","etag").update(Y).digest("hex")}"`}async function uJ8($,Z,Q,Y,X){try{let J=await Ds6($,{withFileTypes:!0});for(let G of J){let W=zO1($,G.name),H=Os6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await uJ8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await xJ8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:hJ8(W,F.mtime,F.size)})}catch{}}}}catch{}}function lJ8($,Z){let Y=J0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Q8.object({prefix:Q8.string().optional(),maxKeys:Q8.number().optional().default(1000),continuationToken:Q8.string().optional(),delimiter:Q8.string().optional()}),outputSchema:Q8.object({objects:Q8.array(Q8.object({key:Q8.string(),size:Q8.number(),lastModified:Q8.string(),etag:Q8.string()})),nextContinuationToken:Q8.string().optional(),isTruncated:Q8.boolean(),commonPrefixes:Q8.array(Q8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=yJ8(Y);await Bs6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await uJ8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({contentType:Q8.string().optional(),contentLength:Q8.number(),lastModified:Q8.string(),etag:Q8.string(),metadata:Q8.record(Q8.string(),Q8.string()).optional()}),handler:async(X)=>{let J=X,G=EO1(Y,J.key),W=await xJ8(G);return{contentType:bN1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:hJ8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=aD(J.expiresIn,_J8);return{url:vJ8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional(),contentType:Q8.string().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=aD(J.expiresIn,_J8);return{url:vJ8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({success:Q8.boolean(),key:Q8.string()}),handler:async(X)=>{let J=X,G=EO1(Y,J.key);try{return await CJ8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Q8.object({keys:Q8.array(Q8.string()).max(1000)}),outputSchema:Q8.object({deleted:Q8.array(Q8.string()),errors:Q8.array(Q8.object({key:Q8.string(),message:Q8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=EO1(Y,K);try{await CJ8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function PO1($,Z,Q){let Y=lJ8(Z,Q),X=new Ww({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:vZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Q8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Q8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new z3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),iW(X,J,$,"mcp:dev-assets")}async function cJ8($,Z,Q,Y){let J=lJ8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var Ls6="./data/assets",_J8=3600,fJ8,mJ8;var dJ8=D(()=>{X$();ed();J8();CJ0();ad();NJ();eD();aS0();fJ8=new Z1;fJ8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return PO1($.req.raw,Z,Y)});mJ8=fJ8});var iJ8={};$6(iJ8,{mountDevRoutes:()=>js6});function js6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return PO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await cJ8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",mJ8);let Q=new Z1;Q.use("*",iH({mountPath:"/api/dev-assets"})),Q.route("/",sS0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var pJ8=D(()=>{J8();IN1();aS0();dJ8()});var QG8={};$6(QG8,{watchHandler:()=>ZG8,resolveCorsOrigin:()=>eJ8,isSsoExemptPath:()=>sJ8,isAllowedOAuthRedirectUri:()=>$G8,createApp:()=>Vs6});import{readFileSync as Es6}from"fs";import{PrometheusSerializer as zs6}from"@opentelemetry/exporter-prometheus";import{DBOS as jO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Ts6,oAuthProtectedResourceMetadata as Rs6}from"better-auth/plugins";async function Ps6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,tJ8(nJ8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),tJ8(nJ8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function tJ8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function sJ8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${yS0}/`)||$.startsWith(`${CS0}/`)}function aJ8($){return $==="local.studio.decocms.com"}function eJ8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(aJ8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function $G8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||aJ8($.hostname)}async function Vs6($={}){let Z=$.database??D8(),Q=!1;_5.stop().catch((K0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",K0)});let Y,X,J,G,W=new XO1,K,H,F,U=null;if($.disableNats)K=JO1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new R80,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(K0)=>{return(async()=>{let H0=K0.getReader();try{while(!0){let{done:R0}=await H0.read();if(R0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=YJ8();let K0=E0().natsCredsPath,H0;if(K0)try{H0=Es6(K0,"utf8")}catch(w8){console.error(`[app] failed to read NATS_CREDS at ${K0}; connecting anonymously`,w8)}U.init(E0().natsUrls,H0?{creds:H0}:void 0);let R0=Q$1()?new h11({getJetStream:()=>U.getJetStream()}):null;R0?.init().catch(()=>{}),Y=R0;let A0=new a91({getJetStream:()=>U.getJetStream()});A0.init().catch(()=>{}),X=A0;let D1=new yf(dQ1,{getJetStream:()=>U.getJetStream()}),x$=new yf(c$0,{getJetStream:()=>U.getJetStream()});D1.init().catch(()=>{}),x$.init().catch(()=>{}),J={reads:D1,cards:x$};let i$=new vJ1({getJetStream:()=>U.getJetStream()});i$.init().catch(()=>{}),G=i$,K=JO1({getConnection:()=>U.getConnection()}),H=new GO1({getConnection:()=>U.getConnection()}),F=new HO1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),v48(U),U.onReady(()=>{R0?.init().catch((w8)=>{console.error("[McpListCache] Deferred init failed:",w8)}),A0.init().catch((w8)=>{console.error("[SkillCatalogCache] Deferred init failed:",w8)}),D1.init().catch((w8)=>{console.error("[PrReadCache] Deferred init failed:",w8)}),x$.init().catch((w8)=>{console.error("[PrCardCache] Deferred init failed:",w8)}),i$.init().catch((w8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",w8)}),K.start(),xN$(()=>U.getConnection()),F.init().catch((w8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",w8)})})}if(Xz)await Xz();u11(Y),$Z1(X),iQ1(J),bJ1(G);let B={storage:new oh(Z.db),sseHub:_5,onThreadFinished:async(K0,H0)=>fd(new D3(Z.db),K0,H0,new kG(Z.db))},O=new YX1(B),L=new d40(Z.db),w=new FO1(L);w.start(),Tg$(H),H.start((K0)=>{cq0(K0),O.execute({type:"CANCEL",taskId:K0}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((K0)=>{console.error("[Decopilot] CancelBroadcast start failed:",K0)}),U?.onReady(()=>{H.start().catch((K0)=>{console.error("[CancelBroadcast] Deferred start failed:",K0)})});let j=()=>U?.getConnection()??null;AN1(j),U?.onReady(()=>AN1(j)),OG1(j),U?.onReady(()=>OG1(j)),F.init().catch((K0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",K0)}),Xz=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),t68(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),fN$(),G.teardown(),u11(null),$Z1(null),iQ1(null),bJ1(null)};let E=new Z1;if(E.use("*",SJ1({enabled:(K0)=>Gp(K0,"debug")==="1"})),E.use("*",x_0),E.use("/*",V48({origin:(K0,H0)=>eJ8(K0,{baseUrl:E0().baseUrl,requestOrigin:new URL(H0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(K0,H0)=>{if(await H0(),K0.req.path.includes("/files/"))return;if(K0.req.path.includes("/fs/")&&K0.req.path.endsWith("/read"))return;K0.header("X-Frame-Options","DENY"),K0.header("Content-Security-Policy","frame-ancestors 'none'")}),!E0().noTui)E.use("*",kJ8());E.use("*",async(K0,H0)=>{if(await H0(),ap(K0.req.path))return;if(K0.res.status>=500){let A0=await K0.res.clone().text();console.error(`[5xx Response] ${K0.req.method} ${K0.req.path} - ${K0.res.status}:`,A0)}}),E.get(aY.HEALTH,(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);return K0.json({status:"ok"})}),E.get(aY.HEALTH_LIVE,(K0)=>{return K0.json({status:"ok"})}),E.get(aY.HEALTH_READY,async(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await Ps6(Z.pool)?"up":"down"},U)H0.nats=U.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let R0=H0.postgres.status==="up",A0=R0?200:503;return K0.json({status:R0?"ready":"not_ready",services:H0},A0)}),E.get(aY.METRICS,async(K0)=>{try{let H0=await h_0.collect(),R0=As6.serialize(H0.resourceMetrics);return K0.text(R0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),K0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${aY.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(K0)=>{let H0=K0.req.param("queueName");if(!qs6.has(H0))return K0.json({error:`Unknown queue: ${H0}`},404);let[R0,A0]=await Promise.all([jO.listQueuedWorkflows({queueName:H0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),jO.listQueuedWorkflows({queueName:H0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return K0.json({queue_length:R0.length,in_flight:A0.length})}),E.route("/api/config",NX8),E.route("/api/_reports",RX8),E.route("/api/_stripe",tD1),E.route("/api/_github",IX8({taskBoard:()=>i,contextFactory:()=>g})),E.route("/api/_git",Dp);let T={db:Z.db,encryptionKey:E0().encryptionKey};E.route("/api/_jira",fX8(T)),E.route("/api/_jira",CX8(T)),E.route("/report",PX8($.clientDir)),E.route("/api/auth/custom",e48),E.route("/api/auth/desktop",Y68),E.all("/api/auth/admin/*",x68),E.all("/api/auth/*",async(K0)=>{return await x8.handler(K0.req.raw)});let A=J88();A.use("/.well-known/oauth-protected-resource/mcp/:connectionId",Y60),A.use("/mcp/:connectionId/.well-known/oauth-protected-resource",Y60),E.route("/",A),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",c40),E.route("/",F88()),E.use("/oauth-proxy/:connectionId/*",Y60),E.all("/oauth-proxy/:connectionId/*",oJ8);let P=async(K0)=>{let R0=await Ms6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",Y60),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",P);let q=async(K0)=>{let R0=await Is6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=S48({ttlMs:120000}),_=await Z48({db:Z.db,auth:x8,encryption:{key:E0().encryptionKey},observability:{tracer:IO,meter:e1},modelListCache:W,providerKeyCache:K,memberRoleCache:x});cQ.set(_),jp1({db:Z.db,baseUrl:m5()}),Q48({db:Z.db}),G48({db:Z.db}),D48({db:Z.db}),vX8({db:Z.db,encryptionKey:E0().encryptionKey}),Zb$({db:Z.db}),z48({db:Z.db}),Rb$({db:Z.db});let V=EX0(Z.db),y=new _r(Z.db),g=qJ8({db:Z.db});MJ1({storage:V,studioContextFactory:g}),BX1({systemDatabaseUrl:Ws0(E0().databaseUrl,E0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}}),GX1({dispatchRunFn:Dy$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}});let l=new oh(Z.db),i=new D3(Z.db),p=new kG(Z.db),U0=new NO1(i,g,p);if(E0().taskBoardReviewSweeperEnabled){U0.start();let K0=Xz;Xz=async()=>{await K0?.(),U0.dispose()}}xy$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let K0=U?.getConnection();return K0?await rJ8.jetstreamManager(K0):null},messageParts:l.messageParts(),resolveRun:async(K0)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",K0).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(K0,H0)=>{let R0=await l.completeRunIfNotCompleted(K0,H0);if(F_0(_5,H0,K0,R0),R0)await fd(i,K0,H0,p);return R0},markRunRequiresAction:async(K0,H0)=>{let R0=await l.requiresActionIfInProgress(K0,H0);return F_0(_5,H0,K0,R0),R0},markRunFailed:async(K0,H0,R0,A0)=>{let D1=await l.markRunFailed(K0,H0,R0,A0);if(F_0(_5,H0,K0,D1),D1)await fd(i,K0,H0,p);return D1},clearSynthesizedError:async(K0,H0)=>{await l.messageParts().replaceMessageParts(K0,wE(K0,H0),[])},persistTitle:(K0,H0,R0)=>l.update(K0,H0,{title:R0}),onTitleUpdated:async({runId:K0,orgId:H0,title:R0})=>{let A0=await l.get(K0,H0).catch(()=>null);_5.emit(H0,DF(K0,A0?.status??"in_progress",{title:R0,virtualMcpId:A0?.virtual_mcp_id??void 0,createdBy:A0?.created_by,triggerId:A0?.trigger_id,branch:A0?.branch??null,harnessId:A0?.harness_id??void 0,createdAt:A0?.created_at,updatedAt:A0?.updated_at}))},bumpProgress:async({runId:K0,orgId:H0})=>{await l.bumpProgress(K0,H0)},recordCompleted:async({runId:K0,orgId:H0,distinctId:R0,usage:A0})=>{f1.capture({distinctId:R0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",input_tokens:A0.inputTokens,output_tokens:A0.outputTokens,total_tokens:A0.totalTokens}})},recordFailed:async({runId:K0,orgId:H0,distinctId:R0,reason:A0,kind:D1})=>{f1.capture({distinctId:R0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",error_category:D1,error_message:A0}})},purgeRun:async(K0)=>{F.purge(K0)}}),uf$({studioContextFactory:g,systemDatabaseUrl:Ws0(E0().databaseUrl,E0().databasePgSsl),streamBuffer:F}),TJ8(),Ep1(),X48(),K48(),L48(),xX8(),Gb$(),A48(),qb$(),kX8();let v0=async(K0,H0,R0)=>{let A0=await V.findById(K0,H0);if(!A0)throw Error("Automation not found");return kJ1({automationId:A0.id,organizationId:A0.organization_id,triggerId:null})},G0=new Np(V,({automation:K0,trigger:H0,contextMessages:R0,idempotencyKey:A0})=>T80({automationId:K0.id,organizationId:K0.organization_id,triggerId:H0.id,contextMessages:R0},{idempotencyKey:A0})),N0=[WK(),Kg(),VN()];for(let K0 of N0)B_0(K0).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let o=()=>x8.api.deleteAllExpiredApiKeys().catch((K0)=>console.error("[auth] Expired API key cleanup failed:",K0));o(),setInterval(o,86400000).unref(),E.use("*",async(K0,H0)=>{if(v_0(K0.req.path))return H0();let R0={measure:async(D1,x$)=>{dW(K0,D1);try{return await x$()}finally{P3(K0,D1)}}},A0=await cQ.create(K0.req.raw,{timings:R0});A0.automationRunner=v0,K0.set("studioContext",A0);try{await H0()}finally{let D1=A0.pendingRevalidations;if(D1.length>0)Promise.race([Promise.allSettled(D1),O$(30000)]).catch((i$)=>console.error("[studio] revalidation cleanup error:",i$))}}),E.use("/api/:org/decopilot/*",Kp),E.use("/api/:org/v1/*",Kp),E.use("/api/:org/files/*",Kp),E.use("*",async(K0,H0)=>{if(sJ8(K0.req.path))return H0();let R0=K0.get("studioContext");if(!R0?.organization?.id||!R0?.auth?.user?.id)return H0();if(!(await R0.storage.orgSsoConfig.getByOrgId(R0.organization.id))?.enforced)return H0();if(!await R0.storage.orgSsoSessions.isValid(R0.auth.user.id,R0.organization.id))return K0.json({error:"SSO authentication required for this organization"},403);return H0()});let $0=new Z1;$0.use("*",iH({mountPath:"/api/org-sso"})),$0.route("/",uS0()),E.route("/api/org-sso",$0),E.get("/api/tools/management",(K0)=>{return K0.json({tools:cn0,grouped:sP()})}),E.use("/mcp/*",async(K0,H0)=>{dW(K0,"mcp");try{return await H0()}finally{P3(K0,"mcp")}});let Z0=async(K0,H0)=>{let R0=K0.var.studioContext;if(!R0.auth.user?.id&&!R0.auth.apiKey?.id){let A0=new URL(K0.req.url),D1=K0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),x$=D1?`${D1}://${A0.host}`:A0.origin;return K0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${x$}${A0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(E.use("/mcp/:connectionId?",Z0),E.use("/mcp/gateway/:virtualMcpId?",Z0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Z0),E.use("/mcp/self",Z0),AW()){let{mountDevRoutes:K0}=(pJ8(),P_0(iJ8));K0(E,Z0)}let r=new Z1;r.use("*",iH({mountPath:"/mcp"})),r.route("/",fM0()),E.route("/mcp",r);let Y0=new Z1;Y0.use("*",iH({mountPath:"/mcp/self"})),Y0.route("/",kC0()),E.route("/mcp/self",Y0);let d0=new Z1;d0.use("*",iH({mountPath:"/mcp"})),d0.route("/",hM0()),E.route("/mcp",d0),E.use("/api/:org/models/*",async(K0,H0)=>{dW(K0,"llm_models");try{return await H0()}finally{P3(K0,"llm_models")}});let S0=r68({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",S0),E.route("/api",uX8);let W1=new Z1;W1.use("*",iH({mountPath:"/api"})),W1.route("/",vC0()),E.route("/api",W1),E.route("/api",JX8);let u0=new Z1;u0.use("*",iH({mountPath:"/api"})),u0.route("/",bC0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",u0);let L0=new br(Z.db),j0=new Z1;j0.use("*",iH({mountPath:"/api"})),j0.route("/",iS0()),E.route("/api",j0),E.route("/api/deco-sites",U58()),E.route("/api/deco-apps",eY8());let l0=new Z1;l0.use("*",iH({mountPath:"/api/deco-sites"})),l0.route("/",nS0()),E.route("/api/deco-sites",l0),E.route(yS0,f68()),E.route(m78,p78()),E.route("/api/_editor-resolve",WX8()),E.route(J68,G68()),E.route(CS0,L68());let O1=E0(),Q1=O1.elevenlabsApiKey?new Q_0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,_0={openai:O1.openaiLiveApiKey?new uD1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:Q1?new hD1(Q1,()=>U?.getConnection()??null):null},m0=new iD1({adapter:Q1,conversationAdapters:_0,defaults:O1,secret:O1.studioJwtSecret??O1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),i0=CY8({voiceSessions:m0,kvStorage:L0,runRegistry:O,streamBuffer:F,sseHub:_5,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:AW(),mcpAuth:Z0,oauthProxyHandler:oJ8,watchHandler:ZG8,betterAuthProtectedResourceHandler:P,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((K0)=>{return K0.json({error:"Not Found",path:K0.req.path},404)}),E.onError(a68),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([_5.stop(),Xz?Promise.resolve(Xz()).finally(()=>{Xz=null}):Promise.resolve()]),U)await U.drain().catch((K0)=>console.error("[shutdown] NATS drain error:",K0));console.log("[shutdown] Flushing telemetry..."),await oX().catch((K0)=>console.error("[shutdown] Telemetry flush error:",K0)),console.log("[shutdown] Closing database..."),await zZ$(Z).catch((K0)=>console.error("[shutdown] Database close error:",K0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await jO.registerQueue(C3,{partitionQueue:!0,concurrency:TJ1,minPollingIntervalMs:RJ1}),await jO.registerQueue(S3,{partitionQueue:!0,concurrency:UX1,priorityEnabled:!0}),await jO.registerQueue(MN,{workerConcurrency:E0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await jO.registerQueue(IN,{workerConcurrency:E0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await jO.registerQueue(qO,{partitionQueue:!0,concurrency:hf$}),await jO.registerQueue(Hz,Tb$),await VN1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((K0)=>jO.deleteQueue(K0))),await qJ1(Z.pool),lY$().catch((K0)=>{console.error("[studio-pack-backfill] failed:",K0)}),zp1().catch((K0)=>{console.error("[org-fs] public-sets boot sync kick failed:",K0)})}})}var rJ8,nJ8=5000,Xz=null,oJ8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await cQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Qp(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await m40(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=H88(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=E0().baseUrl??j.origin;try{if(!$G8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(R48(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let A,P=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),U0=p.indexOf(":");if(U0!==-1){let v0=decodeURIComponent(p.slice(0,U0)),G0=decodeURIComponent(p.slice(U0+1));P=v0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)P=g;if(typeof l==="string"&&l)q=l;let i=new URLSearchParams;for(let[p,U0]of y.entries())i.append(p,U0.toString());A=i.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{A=g}let i=typeof l==="object"&&l!==null&&!Array.isArray(l);if(A===void 0&&!i)A=g;if(A===void 0){let p=l,U0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...U0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},A=JSON.stringify(p),E["Content-Type"]="application/json"}}else A=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:A,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,i=null;try{i=await Yp(G.connection_url)??O}catch{i=O}let p={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:P,clientSecret:q,tokenEndpoint:i};await new w9(X.db,X.vault).upsert(p)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},ZG8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!dU(Y)||!await iU(Z)))return $.json({error:"forbidden"},403);let W=G?eR0:Y;if(G)fD({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return DO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!_5.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{_5.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),_5.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),_5.remove(W,K),N()})})})},As6,qs6,Ms6=()=>Rs6(x8),Is6=()=>Ts6(x8);var YG8=D(()=>{a$();X$();Pp1();J48();H48();w48();k80();IQ1();T48();l$0();I9();oc();p8();J8();MS0();k48();CJ1();Z3();wU();sU1();SG();k6();G6();XN1();X68();W68();w68();FN1();y68();jN1();qN1();MN1();UH();KS0();IN1();e68();VS0();_Y8();yY8();gY8();cY8();aY8();CN1();$X8();yM0();q80();GX8();uM0();GD1();KX8();XD1();BX8();AX8();qX8();MX8();VX8();SX8();_X8();yX8();QO1();fN1();lX8();JD1();ZD1();W50();XJ8();SJ();yT0();nQ1();$00();Q00();fJ1();JJ8();WJ8();TN1();DJ8();XX1();OJ8();Do();yr();xD();P9();jU1();zJ8();RJ8();Y30();BO1();_3();kN1();bD();ZX1();Y30();aq0();Vn0();kn0();MJ8();au();SJ8();Sp();sU1();Vd();dd();mq0();rJ8=C(OK(),1);As6=new zs6,qs6=new Set([C3,S3,MN,IN,qO,Hz])});var WG8={};$6(WG8,{resolveClientDir:()=>xs6,resolveAssetPathWithTraversalCheck:()=>GG8,isPathWithinDirectory:()=>JG8,createAssetHandler:()=>fs6});import{resolve as p60,dirname as ks6,join as Ss6,extname as Cs6,basename as _s6,sep as XG8}from"path";function vs6($,Z){if($===Z||_s6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${XG8}assets${XG8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function JG8($,Z){let Q=p60(Z),Y=p60($);return Y===Q||Y.startsWith(Q+"/")}function GG8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=p60(Z,Q);if(!JG8(Y,Z))return null;return Y}function xs6($,Z="../client"){let Q=new URL($),Y=ks6(Q.pathname);return p60(Y,Z)}function fs6($={}){let{env:Z="production",clientDir:Q=bs6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=GG8({requestPath:W,clientDir:Q});if(!K)return null;let H=Ss6(K,"index.html"),F=p60(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Cs6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:vs6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var bs6="./dist/client";var KG8=()=>{};var HG8={};$6(HG8,{tryUpgradePreviewWs:()=>ms6,tryHandlePreviewHttp:()=>cs6,previewWebSocketHandler:()=>ds6,parsePreviewBaseDomain:()=>ls6,isPreviewWsData:()=>D_0,extractHandleFromHost:()=>AO1});function hs6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function us6(){return new Response(gs6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function ls6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function AO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function cs6($,Z){let Q=AO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return t60(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(um)&&hs6($))return us6();return X.headers.delete(um),X}function t60($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function D_0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function ms6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=AO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return t60(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return t60(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return t60(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return t60(426,"upgrade failed");return}function n60($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var ys6=256,gs6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',ds6;var FG8=D(()=>{q10();ds6={open($){let Z=$.data;if(!D_0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),n60($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{n60($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{n60($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!D_0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=ys6){n60($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!D_0(Z))return;n60($,Z,1000,"")}}});var DG8={};$6(DG8,{printBanner:()=>ps6,bannerLines:()=>BG8,BANNER_LINES:()=>UG8,BANNER_GRADIENT:()=>NG8});function is6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function BG8($){let Z=UG8.map((Q,Y)=>{let[X,J,G]=is6(NG8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function ps6($){console.log("");for(let Z of BG8($))console.log(Z);console.log("")}var UG8,NG8;var OG8=D(()=>{UG8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],NG8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a$();var xO1="13";function fO1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:xO1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a$();import vG8 from"pg";var yO1=8314027461559302n,bG8=600000,xG8=500;async function gO1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=bG8}=$,X=$.log??((K)=>console.log(K)),J=new vG8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[yO1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await O$(xG8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[yO1.toString()])}catch{}await J.end().catch(()=>{})}}X$();q_0();k6();function v38(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function c_0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function PL1(){let $=v38();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:c_0($,"--cpu-prof-dir")??process.cwd(),name:c_0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(c_0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}i_0();var F50;function SL1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Nz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),F50=setInterval(()=>void Z().catch(()=>{}),$),F50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(F50)clearInterval(F50)}}import*as f38 from"bun:jsc";var{startSamplingProfiler:y38,samplingProfilerStackTraces:g38}=f38;function CL1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{y38()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=g38()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function _L1(){PL1();let $=[SL1(),kL1(),CL1()];return()=>{for(let Z of $)Z()}}import{existsSync as $a6}from"fs";var WG=E0();jL1();var{DBOS:o60,DBOSClient:ns6}=await import("@dbos-inc/dbos-sdk");function VO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var ts6=[C3,S3,MN,IN,qO,Hz],os6=WG.dispatchRole==="worker"?ts6:WG.dispatchRole==="api"?[]:void 0;o60.setConfig(fO1({systemDatabaseUrl:VO1(WG.databaseUrl,WG.databasePgSsl),poolSize:WG.dbosPoolSize,executorID:WG.podName,listenQueues:os6}));var{createApp:rs6}=await Promise.resolve().then(() => (YG8(),QG8)),{isServerPath:ss6}=await Promise.resolve().then(() => (W50(),ZL1)),{createAssetHandler:as6,resolveClientDir:zG8}=await Promise.resolve().then(() => (KG8(),WG8)),es6=WG.port,LG8=zG8(import.meta.url,"../client"),PG8=$a6(LG8)?LG8:zG8(import.meta.url,"../dist/client"),Za6=as6({clientDir:PG8,isServerPath:ss6}),Qa6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function Ya6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(Qa6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:Xa6,tryHandlePreviewHttp:Ja6,tryUpgradePreviewWs:Ga6,previewWebSocketHandler:TO1,isPreviewWsData:RO1}=await Promise.resolve().then(() => (FG8(),HG8)),{getOrInitSharedRunner:AG8}=await Promise.resolve().then(() => (xW(),ER$)),TG8=Xa6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),wG8={baseDomain:TG8??"",getRunner:AG8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())AG8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var O_0=await rs6({clientDir:PG8}),qO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),jG8=process.env.DBOS_CONDUCTOR_URL?.trim();await gO1({databaseUrl:VO1(WG.databaseUrl,WG.databasePgSsl)},()=>o60.launch({...qO1?{conductorKey:qO1}:{},...qO1&&jG8?{conductorURL:jG8}:{}}));console.log(`[dbos] application version: ${o60.applicationVersion}`);var MO1=5,IO1=0;await E8(async()=>{IO1++;try{return await O_0.initDbos()}catch($){let Z=IO1>=MO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${IO1}/${MO1} failed, ${Z}`,$),$}},{maxAttempts:MO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!WG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (OG8(),DG8));console.log("");for(let Z of $())console.log(Z)}var Wa6=Bun.serve({idleTimeout:0,port:es6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(TG8){let Y=await Ga6($,Z,wG8);if(Y===void 0)return;if(Y)return Y;let X=await Ja6($,wG8);if(X)return X}let Q=await Za6($);if(Q)return Ya6(Q);return O_0.fetch($,{server:Z})},websocket:{open($){if(RO1($.data))TO1.open($)},message($,Z){if(RO1($.data))TO1.message($,Z)},close($){if(RO1($.data))TO1.close($)}},development:!1}),Ka6=_L1();if(WG.localMode)Promise.resolve().then(() => (uf(),Sq0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (uf(),Sq0));Z()}catch{}});var EG8=!1;async function Ha6($){let Z;try{Z=await ns6.create({systemDatabaseUrl:VO1(WG.databaseUrl,WG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:S3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:S3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function L_0($){if(EG8)return;EG8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{Ka6(),O_0.markShuttingDown();let J=uO1(WG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await O$(J),await Wa6.stop(!0);let G=o60.executorID;await o60.shutdown(),await Ha6(G),await O_0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>L_0("SIGTERM"));process.on("SIGINT",()=>L_0("SIGINT"));process.on("SIGHUP",()=>L_0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),L_0("uncaughtException")});