decocms 4.463.4 → 4.464.1

package/dist/server/server.js

@@ -2256,7 +2256,7 @@ data:
 </head>`+$.slice(F)}return`<head>
 `+Y+`
 </head>
-`+$}function qI0($){if(!$||$.length===0)return[];return $.filter((Z)=>sY6.test(Z))}function aY6($){return[...$,...$.map((Z)=>Z.replace(/^http/,"ws"))]}function eY6($){if($.csp)return $.csp;let Z=$.resourceCsp;if(!Z)return ll$;let Q=qI0(Z.resourceDomains),Y=qI0(Z.connectDomains),X=qI0(Z.frameDomains),J=qI0(Z.baseUriDomains),G=Q.length>0,W=Y.length>0,K=X.length>0,H=J.length>0;if(!G&&!W&&!K&&!H)return ll$;let F=Q.join(" ");return["default-src 'none'",G?`script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' ${F}`:"script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",G?`style-src 'unsafe-inline' ${F}`:"style-src 'unsafe-inline'",G?`img-src * data: blob: ${F}`:"img-src * data: blob:",G?`media-src * data: blob: ${F}`:"media-src * data: blob:",G?`font-src data: ${F}`:"font-src data:",W?`connect-src ${aY6(Y).join(" ")}`:"connect-src 'none'",K?`frame-src ${X.join(" ")}`:"frame-src 'none'","worker-src blob:","form-action 'none'",H?`base-uri ${J.join(" ")}`:"base-uri 'none'"].join("; ")}var ll$,sY6;var ml$=D(()=>{ll$=["default-src 'none'","script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'","style-src 'unsafe-inline'","img-src * data: blob:","media-src * data: blob:","font-src data:","connect-src 'none'","frame-src 'none'","worker-src blob:","form-action 'none'","base-uri 'none'"].join("; ");sY6=/^https?:\/\/(\*\.)?[a-zA-Z0-9._-]+(:\d+)?\/?$/});function $X6($){let Z=$.lastFailureAt-$.firstFailureAt;return $.count>=No1&&Z>=Bo1}class rG1{options;kv=null;codec=Nj();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new il$.Kvm($).create(ZX6,{storage:dl$.StorageType.Memory,ttl:pl$.nanos(Do1)})}async recordFailure($){if(!this.kv)return oG1;let Z=Date.now();for(let Q=0;Q<QX6;Q++)try{let Y=await this.kv.get($);if(!(Y&&Y.operation!=="DEL"&&Y.operation!=="PURGE"&&Y.value?.length)){let W={count:1,firstFailureAt:Z,lastFailureAt:Z};return await this.kv.create($,this.codec.encode(W)),{count:W.count,shouldDisable:!1}}let J=this.codec.decode(Y.value),G={count:J.count+1,firstFailureAt:J.firstFailureAt,lastFailureAt:Z};return await this.kv.update($,this.codec.encode(G),Y.revision),{count:G.count,shouldDisable:$X6(G)}}catch{}return oG1}async recordSuccess($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}teardown(){this.kv=null}}class K40{async recordFailure(){return oG1}async recordSuccess(){}teardown(){}}function sG1($){nl$=$??new K40}function aG1(){return nl$}var dl$,il$,pl$,oG1,ZX6="DECOCMS_CONN_CIRCUIT",QX6=5,nl$;var eG1=D(()=>{dl$=C(MK(),1),il$=C(EA(),1),pl$=C(yz(),1),oG1={count:0,shouldDisable:!1};nl$=new K40});function tl$($){if(!$)return{decision:"skip"};if($.startsWith("notifications/"))return{decision:"skip"};if(XX6.has($))return{decision:"skip"};let Z=YX6[$];if(Z)return{decision:"skip-if-list-cached",listType:Z};return{decision:"probe"}}async function ol$($){if($.method!=="POST")return;let Z=$.headers.get("content-length");if(Z&&Number(Z)>JX6)return;try{let Q=await $.clone().json(),X=(Array.isArray(Q)?Q[0]:Q)?.method;return typeof X==="string"?X:void 0}catch{return}}var YX6,XX6,JX6=64000;var rl$=D(()=>{YX6={"tools/list":"tools","resources/list":"resources","prompts/list":"prompts"},XX6=new Set(["ping"])});import{SpanStatusCode as MI0}from"@opentelemetry/api";async function II0($,Z){let Q=$.get("studioContext");try{let Y=Q.organization?.id??null,X=Z?Z:Y?xP(Y):null;if(!X)return $.json({error:"Agent ID or organization ID is required"},400);if(Z&&!Y)return $.json({error:"Organization context is required"},400);let J=await Q.tracer.startActiveSpan("studio.virtual_mcp.lookup",{attributes:{"virtual_mcp.id":X}},async(N)=>{try{let B=await Q.storage.virtualMcps.findById(X,Y??void 0);return N.setStatus({code:MI0.OK}),B}catch(B){throw N.setStatus({code:MI0.ERROR,message:B.message}),N.recordException(B),B}finally{N.end()}});if(!J)return $.json({error:"Agent not found"},404);if(Y&&J.organization_id!==Y)return $.json({error:"Agent not found"},404);if(J.status!=="active")return $.json({error:`Agent is inactive: ${J.id??"Decopilot"}`},503);if(Q.organization?.id&&J.organization_id!==Q.organization.id)return $.json({error:"Forbidden: Agent does not belong to your organization"},403);Q.connectionId=J.id??void 0;let G=g0(Q),W=null;if(J.id&&G&&p5(J.metadata)[G])W=await Ny(Q,J.id,G,$.req.query("branch")??void 0).catch(()=>null);let K=await Q.tracer.startActiveSpan("studio.virtual_mcp.create_client",{attributes:{"virtual_mcp.id":J.id??"decopilot"}},async(N)=>{try{let B=await hD(J,Q,!1,{includeSkillsCatalog:!0,additionalConnections:W?[W]:[],listTimeoutMs:YX0});return N.setStatus({code:MI0.OK}),B}catch(B){throw N.setStatus({code:MI0.ERROR,message:B.message}),N.recordException(B),B}finally{N.end()}}),H={name:J.id??"Decopilot",version:"1.0.0",title:J.title??void 0,description:J.description??void 0,icons:J.icon?[{src:J.icon}]:void 0},F=z2(K,H,{capabilities:{tools:{},resources:{},prompts:{}},instructions:K.getInstructions(),toolCallTimeoutMs:Bu}),U=new S3({enableJsonResponse:$.req.header("Accept")?.includes("application/json")??!1});return await F.connect(U),await QK(F,U,$.req.raw,`virtual-mcp:${J.id??"decopilot"}`,{onClose:()=>K.close()})}catch(Y){let X=Y;return console.error("[virtual-mcp] Error handling virtual MCP request:",X),$.json({error:"Internal server error",message:X.message},500)}}var VI0=()=>{let $=new Z1;return $.all("/gateway/:virtualMcpId?",async(Z)=>{let Q=Z.req.param("virtualMcpId")||Z.req.header("x-virtual-mcp-id");return II0(Z,Q)}),$.all("/virtual-mcp/:virtualMcpId?",async(Z)=>{let Q=Z.req.param("virtualMcpId")||Z.req.header("x-virtual-mcp-id");return II0(Z,Q)}),$};var kI0=D(()=>{SJ();n8();Ri();J8();Vd();xM0();ZJ();qi()});import{SpanStatusCode as SI0}from"@opentelemetry/api";var sl$=($,Z)=>{if($ instanceof gl)return Z.header("Retry-After",String(Math.ceil($.cooldownRemainingMs/1000))),Z.json({error:$.message},503);if($.message.includes("not found"))return Z.json({error:$.message},404);if($.message.includes("does not belong to the active organization"))return Z.json({error:"Connection not found"},404);if($.message.includes("inactive"))return Z.json({error:$.message},503);return Z.json({error:"Internal server error",message:$.message},500)},CI0=()=>{let $=new Z1;return $.all("/",async(Z)=>{return II0(Z,void 0)}),$.get("/:connectionId/ui-resource",async(Z)=>{let Q=Z.get("studioContext"),Y=Z.req.param("connectionId"),X=Z.req.query("uri");if(!X)return Z.json({error:"uri query param is required"},400);if(!Q.organization?.id)return Z.json({error:"Organization context is required"},403);let J=Bp0(Y),G;if(J){let B=g0(Q);if(!B)return Z.json({error:"Authentication required"},401);if(G=await Ny(Q,J,B,Z.req.query("branch")??void 0),!G)return Z.json({error:"Dev server not running"},503)}else if(G=await Q.storage.connections.findById(Y,Q.organization.id),!G||G.organization_id!==Q.organization.id)return Z.json({error:"Connection not found"},404);let W=Bj(G,Q,!1,x9()??void 0),K,H;try{let L=(await W.readResource({uri:X})).contents?.[0];K=L?.text,H=L?._meta?.ui?.csp}catch(B){return Z.json({error:B.message},502)}finally{await W.close().catch(()=>{})}if(typeof K!=="string")return Z.json({error:"Resource has no text content"},404);let F=cl$(K,{resourceCsp:H}),U=`"${Bun.hash(F).toString(36)}"`,N="private, no-cache";if(Z.req.header("if-none-match")===U)return new Response(null,{status:304,headers:{ETag:U,"Cache-Control":N}});return new Response(F,{headers:{"Content-Type":"text/html; charset=utf-8",ETag:U,"Cache-Control":N}})}),$.all("/:connectionId",async(Z)=>{let Q=Z.req.param("connectionId"),Y=Z.get("studioContext");if(Q.endsWith("_self")){let G=Q.slice(0,-5);if(!Y.organization||Y.organization.id!==G)return Z.json({error:"Connection not found"},404);let W=Mi(),K=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await W.connect(K),eD.run(Y,()=>QK(W,K,Z.req.raw,`mcp:self:${Q}`))}let X=Bp0(Q);if(X){if(!Y.organization?.id)return Z.json({error:"Organization context is required"},403);let G=g0(Y);if(!G)return Z.json({error:"Authentication required"},401);let W=await Ny(Y,X,G,Z.req.query("branch")??void 0);if(!W)return Z.json({error:"Dev server not running"},503);let K=cK0(W,Y,!1),H=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await K.connect(H),QK(K,H,Z.req.raw,`mcp:dev:${Q}`)}let J=null;try{try{if(!Y.organization?.id)return Z.json({error:"Organization context is required"},403);if(J=await Y.tracer.startActiveSpan("studio.connection.lookup",{attributes:{"connection.id":Q}},async(O)=>{ZK(Z,"mcp.find_connection");try{let w=await Y.storage.connections.findById(Q,Y.organization.id);return O.setStatus({code:SI0.OK}),w}catch(w){throw O.setStatus({code:SI0.ERROR,message:w.message}),O.recordException(w),w}finally{C3(Z,"mcp.find_connection"),O.end()}}),!J)throw Error("Connection not found");let G=J;if(G.organization_id!==Y.organization.id)throw Error("Connection does not belong to the active organization");let W=!1;if(G.status!=="active"){let O=Date.now()-new Date(G.updated_at).getTime();if(G.status==="error"&&!!G.connection_url&&O>=jp0)W=!0;else{if(G.status==="error"&&G.connection_url){let j=jp0-O;Z.header("Retry-After",String(Math.ceil(j/1000)))}throw Error(`Connection inactive: ${G.status}`)}}let K=await ol$(Z.req.raw),{decision:H,listType:F}=tl$(K),U=H==="probe";if(H==="skip-if-list-cached"&&F){let O=x9();U=O?await O.get(F,Q)===null:!0}if(W)U=!0;if(G.connection_url&&U)zG0(Q),await Y.tracer.startActiveSpan("studio.connection.handshake",{attributes:{"connection.id":Q,"connection.url":G.connection_url}},async(O)=>{ZK(Z,"mcp.client_handshake");try{if(await cX(G,Y,!1),PG0(Q),aG1().recordSuccess(Q),W)await Y.storage.connections.update(Q,{status:"active"}),console.info("[proxy] auto-recovered connection after successful re-probe",{connectionId:Q,org:Y.organization?.slug});O.setStatus({code:SI0.OK})}catch(w){throw O.setStatus({code:SI0.ERROR,message:w.message}),O.recordException(w),w}finally{C3(Z,"mcp.client_handshake"),O.end()}});ZK(Z,"mcp.create_server");let N=cK0(G,Y,!1);C3(Z,"mcp.create_server");let B=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});ZK(Z,"mcp.server_connect"),await N.connect(B),C3(Z,"mcp.server_connect"),ZK(Z,"mcp.handle_request");let L=await QK(N,B,Z.req.raw,`mcp:${Q}`);return C3(Z,"mcp.handle_request"),L}catch(G){if(G instanceof gl)throw G;if(J??=await Y.storage.connections.findById(Q,Y.organization?.id),J?.connection_url){let W=await $31({error:G,reqUrl:new URL(Z.req.raw.url),connectionId:Q,connectionUrl:J.connection_url,headers:{},orgSlug:Y.organization?.slug});if(W)return W;AG0(Q);let{shouldDisable:K}=await aG1().recordFailure(Q);if(K&&J.status==="active")await Y.storage.connections.update(Q,{status:"error"}),console.warn("[proxy] auto-disabled connection after sustained failures",{connectionId:Q,org:Y.organization?.slug,error:G.message})}throw G}}catch(G){return sl$(G,Z)}}),$.all("/:connectionId/call-tool/:toolName",async(Z)=>{let Q=Z.req.param("connectionId"),Y=Z.req.param("toolName"),X=Z.get("studioContext");if(!X.organization?.id)return Z.json({error:"Organization context is required"},403);let J=null;try{if(J=await X.storage.connections.findById(Q,X.organization.id),!J)return Z.json({error:"Connection not found"},404);if(J.organization_id!==X.organization.id)throw Error("Connection does not belong to the active organization");if(J.status!=="active")throw Error(`Connection inactive: ${J.status}`);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Request body must be valid JSON"},400)}let K=await(await cX(J,X,!1)).callTool({name:Y,arguments:G});if(K.isError)return new Response(JSON.stringify(K.content),{headers:{"Content-Type":"application/json"},status:500});return new Response(JSON.stringify(K.structuredContent??K.content),{headers:{"Content-Type":"application/json"}})}catch(G){if(J??=await X.storage.connections.findById(Q,X.organization.id),J?.connection_url){let W=await $31({error:G,reqUrl:new URL(Z.req.raw.url),connectionId:Q,connectionUrl:J.connection_url,headers:{},orgSlug:X.organization?.slug});if(W)return W}return sl$(G,Z)}}),$};var _I0=D(()=>{zA();Ri();J8();tG1();KD();qi();H40();mX();N00();ml$();Sr0();eG1();rl$();kI0();xM0();n8();Q31()});async function yE($,Z,Q,Y){if(Z.type!=="event"||!Z.connection_id)return{success:!0};let X=await $.storage.connections.findById(Z.connection_id);if(!X)return{success:!0};let J=$.organization?.id,G=$.organization?.slug;try{let W=await cX(X,$,!0),K=g$1.forClient(Z31(W)),H,F,U;if(Q&&Y&&J){let j=await Y.generateTokenPair();F=j.plaintext,U=j.hash,H=G?`${$.baseUrl}/api/${G}/trigger-callback`:`${$.baseUrl}/api/trigger-callback`}let N=5000,B=!1,L=new Promise((j,E)=>setTimeout(()=>{B=!0,E(Error("TRIGGER_CONFIGURE timeout"))},N)),O;try{O=await Promise.race([K.TRIGGER_CONFIGURE({type:Z.event_type,params:JSON.parse(Z.params??"{}"),enabled:Q,callbackUrl:H,callbackToken:F}),L])}catch(j){if(B&&Q&&Y&&J&&U)await Y.persistTokenHash(J,Z.connection_id,U);return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE threw on connection=${Z.connection_id} type=${Z.event_type}:`,j),{success:!1,error:String(j)}}let w=O;if(!w||w.success!==!0)return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE did not return success=true on connection=${Z.connection_id} type=${Z.event_type}. Raw payload:`,JSON.stringify(O)),{success:!1,error:`TRIGGER_CONFIGURE did not return success=true (got ${JSON.stringify(O)})`};try{if(Q&&Y&&J&&U)await Y.persistTokenHash(J,Z.connection_id,U);if(!Q&&Y&&J)await Y.deleteByConnection(Z.connection_id,J)}catch(j){console.error("[configureTriggerOnMcp] Token persistence failed after successful TRIGGER_CONFIGURE:",j)}return{success:!0}}catch(W){return{success:!1,error:String(W)}}}var F40=D(()=>{zA();_I0();h$1()});import{z as t5}from"zod";var Y31;var al$=D(()=>{Ay();S0();cZ();F40();Y31=c({name:"AUTOMATION_UPDATE",description:"Update an automation's config. Toggling active state reconfigures event triggers on MCPs.",annotations:{title:"Update Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:t5.object({id:t5.string(),name:t5.string().min(1).max(255).optional(),active:t5.boolean().optional(),messages:t5.union([t5.string(),t5.array(t5.looseObject({id:t5.string().optional(),role:t5.enum(["user","assistant","system"]),parts:t5.array(t5.record(t5.string(),t5.unknown())),metadata:t5.unknown().optional()}))]).optional(),models:t5.object({tier:zj,modelId:t5.string().optional(),credentialId:t5.string().optional()}).loose().optional(),tools:t5.array(t5.string()).nullable().optional(),maxAgentSteps:t5.number().int().min(1).max(100).nullable().optional(),temperature:t5.number().optional()}),outputSchema:t5.object({id:t5.string(),name:t5.string(),active:t5.boolean(),updated_at:t5.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findById($.id,Q.id);if(!Y)throw Error("Automation not found");let X={};if($.name!==void 0)X.name=$.name;if($.active!==void 0)X.active=$.active;if($.messages!==void 0){let G=EI0($.messages);X.messages=JSON.stringify(G)}if($.models!==void 0)X.models=JSON.stringify($.models);if($.tools!==void 0)X.tools=$.tools===null?null:JSON.stringify($.tools);if($.temperature!==void 0)X.temperature=$.temperature;if($.maxAgentSteps!==void 0)X.max_agent_steps=$.maxAgentSteps;let J=await Z.storage.automations.update($.id,Q.id,X);if($.active!==void 0&&$.active!==Y.active){let G=await Z.storage.automations.listTriggers(J.id),W=G.filter((K)=>K.type==="event");await Promise.allSettled(W.map(async(K)=>{let H=await yE(Z,K,$.active);if(!H.success)console.warn(`Failed to configure trigger ${K.id}: ${H.error}`)})),await vl$(G,$.active)}return{id:J.id,name:J.name,active:J.active,updated_at:J.updated_at}}})});import{z as vI0}from"zod";var X31;var el$=D(()=>{Ay();$6();S0();F40();X31=c({name:"AUTOMATION_DELETE",description:"Permanently delete an automation. Disables all event triggers on connected MCPs first.",annotations:{title:"Delete Automation",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:vI0.object({id:vI0.string()}),outputSchema:vI0.object({success:vI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),!await Z.storage.automations.findById($.id,Q.id))throw Error("Automation not found");let X=await Z.storage.automations.listTriggers($.id),J=X.filter((K)=>K.type==="event");await Promise.allSettled(J.map(async(K)=>{let H=await yE(Z,K,!1);if(!H.success)console.warn(`Failed to disable trigger ${K.id}: ${H.error}`)}));let{success:G}=await Z.storage.automations.delete($.id,Q.id);await bl$(X);let W=g0(Z);if(W)f1.capture({distinctId:W,event:"automation_deleted",groups:{organization:Q.id},properties:{organization_id:Q.id,automation_id:$.id,trigger_count:X.length}});return{success:G}}})});function Ii($){return`webhook_${$}`}function bI0($,Z,Q){if(!Z)throw Error("Cannot build webhook URL: organization slug missing from request context");return`${$}/api/${Z}/webhooks/${Q}`}import{z as $Y}from"zod";var $c$=300000,GX6=10,J31;var Zc$=D(()=>{yG1();Ay();fG1();S0();F40();J31=c({name:"AUTOMATION_TRIGGER_ADD",description:"Add a cron, event, or webhook trigger to an automation. For webhook triggers the response includes a one-time URL + secret token.",annotations:{title:"Add Trigger",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:$Y.object({automation_id:$Y.string(),type:$Y.enum(["cron","event","webhook"]),cron_expression:$Y.string().optional(),connection_id:$Y.string().optional(),event_type:$Y.string().optional(),params:$Y.record($Y.string(),$Y.string()).optional()}),outputSchema:$Y.object({id:$Y.string(),automation_id:$Y.string(),type:$Y.enum(["cron","event","webhook"]),created_at:$Y.string(),webhook:$Y.object({url:$Y.string(),token:$Y.string()}).nullable().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findById($.automation_id,Q.id);if(!Y)throw Error("Automation not found");if($.type==="cron"){if(!$.cron_expression)throw Error("cron_expression is required for cron triggers");let K=new PI0($.cron_expression,{timezone:"UTC"}).nextRuns(GX6);if(K.length===0)throw Error("Cron expression has no future runs");let H=1/0;for(let F=1;F<K.length;F++){let U=K[F].getTime()-K[F-1].getTime();if(U<H)H=U}if(K.length>=2&&Number.isFinite(H)&&H<$c$){let F=$c$/1000;throw Error(`Cron fires too frequently \u2014 minimum interval is ${F}s between runs (observed ${H/1000}s)`)}}if($.type==="event"){if(!$.connection_id)throw Error("connection_id is required for event triggers");if(!$.event_type)throw Error("event_type is required for event triggers");if(!await Z.storage.connections.findById($.connection_id,Q.id))throw Error("Connection not found");let K={id:"",automation_id:$.automation_id,type:"event",cron_expression:null,connection_id:$.connection_id,event_type:$.event_type,params:$.params?JSON.stringify($.params):null,last_run_at:null,next_run_at:null,api_key_id:null,created_at:""},H=await yE(Z,K,!0,Z.storage.triggerCallbackTokens);if(!H.success)throw Error(`Failed to configure trigger on connection: ${H.error}`)}let X=$.type==="cron"&&$.cron_expression?AI0($.cron_expression,new Date):null,J=await Z.storage.automations.addTrigger({automation_id:$.automation_id,type:$.type,cron_expression:$.type==="cron"?$.cron_expression:null,connection_id:$.type==="event"?$.connection_id:null,event_type:$.type==="event"?$.event_type:null,params:$.params?JSON.stringify($.params):null,next_run_at:X?.toISOString()??null}),G=null;if($.type==="webhook")try{let W=await Z.boundAuth.apiKey.create({name:`webhook:${Y.name}:${J.id.slice(0,8)}`,permissions:{[Ii(J.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:Y.id,trigger_id:J.id}});await Z.storage.automations.setTriggerApiKeyId(J.id,W.id),G={url:bI0(Z.baseUrl,Q.slug,J.id),token:W.key}}catch(W){await Z.storage.automations.removeTrigger(J.id,J.automation_id);let K=W instanceof Error?W.message:String(W);throw Error(`Failed to mint webhook token: ${K}`)}return await RI0(J,Y),{id:J.id,automation_id:J.automation_id,type:J.type,created_at:J.created_at,webhook:G}}})});import{z as xI0}from"zod";var G31;var Qc$=D(()=>{Ay();S0();F40();G31=c({name:"AUTOMATION_TRIGGER_REMOVE",description:"Remove a trigger from an automation. Disables associated event listeners on MCPs.",annotations:{title:"Remove Trigger",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:xI0.object({trigger_id:xI0.string()}),outputSchema:xI0.object({success:xI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findTriggerById($.trigger_id);if(!Y)throw Error("Trigger not found");if(!await Z.storage.automations.findById(Y.automation_id,Q.id))throw Error("Automation not found");if(Y.type==="event"){let G=await yE(Z,Y,!1,Z.storage.triggerCallbackTokens);if(!G.success)console.warn(`Failed to disable trigger ${Y.id}: ${G.error}`)}let{success:J}=await Z.storage.automations.removeTrigger(Y.id,Y.automation_id);if(Y.type==="cron")await iG1(Y.id);if(Y.type==="webhook"&&Y.api_key_id)try{await Z.boundAuth.apiKey.delete(Y.api_key_id)}catch(G){console.warn(`[trigger-remove] failed to delete api key ${Y.api_key_id} for trigger ${Y.id}:`,G instanceof Error?G.message:G)}return{success:J}}})});import{z as Vi}from"zod";var W31;var Yc$=D(()=>{S0();W31=c({name:"AUTOMATION_TRIGGER_ROTATE_TOKEN",description:"Rotate the secret token for a webhook automation trigger. Returns a new token; the old token is revoked.",annotations:{title:"Rotate Webhook Token",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Vi.object({trigger_id:Vi.string()}),outputSchema:Vi.object({trigger_id:Vi.string(),url:Vi.string(),token:Vi.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findTriggerById($.trigger_id);if(!Y)throw Error("Trigger not found");if(Y.type!=="webhook")throw Error("Trigger is not a webhook trigger");let X=await Z.storage.automations.findById(Y.automation_id,Q.id);if(!X)throw Error("Automation not found");let J=Y.api_key_id,G=await Z.boundAuth.apiKey.create({name:`webhook:${X.name}:${Y.id.slice(0,8)}`,permissions:{[Ii(Y.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:X.id,trigger_id:Y.id}});if(await Z.storage.automations.setTriggerApiKeyId(Y.id,G.id),J)try{await Z.boundAuth.apiKey.delete(J)}catch(W){console.warn(`[trigger-rotate] failed to delete old key ${J} for trigger ${Y.id}:`,W instanceof Error?W.message:W)}return{trigger_id:Y.id,url:bI0(Z.baseUrl,Q.slug,Y.id),token:G.key}}})});import{z as ki}from"zod";var K31;var Xc$=D(()=>{$6();S0();K31=c({name:"AUTOMATION_RUN",description:"Manually trigger an automation run. Bypasses configured triggers.",annotations:{title:"Run Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:ki.object({id:ki.string()}),outputSchema:ki.object({threadId:ki.string().optional(),error:ki.string().optional(),skipped:ki.string().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),!Z.automationRunner)throw Error("Automation runner not available");let Y=g0(Z);if(!Y)throw Error("User ID not available");let X=await Z.automationRunner($.id,Q.id,Y);if(f1.capture({distinctId:Y,event:"automation_run",groups:{organization:Q.id},properties:{organization_id:Q.id,automation_id:$.id,thread_id:"taskId"in X?X.taskId:void 0,status:"skipped"in X?"skipped":("error"in X)?"error":"started",skip_reason:"skipped"in X?X.skipped:void 0,error_message:"error"in X?X.error:void 0}}),"skipped"in X)return{skipped:X.skipped};if("error"in X)return{threadId:X.taskId,error:X.error};return{threadId:X.taskId}}})});import{z as OQ}from"zod";var WX6=500,H31;var Jc$=D(()=>{S6();S0();H31=c({name:"AUTOMATION_RUN_STATS",description:"Aggregate run counts (by status) and LLM token/cost totals for a single automation.",annotations:{title:"Automation Run Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:OQ.object({automation_id:OQ.string(),startDate:OQ.string().datetime().optional().describe("Filter runs at or after this ISO timestamp"),endDate:OQ.string().datetime().optional().describe("Filter runs at or before this ISO timestamp")}),outputSchema:OQ.object({runs:OQ.object({total:OQ.number(),completed:OQ.number(),failed:OQ.number(),inProgress:OQ.number()}),usage:OQ.object({calls:OQ.number(),inputTokens:OQ.number(),outputTokens:OQ.number(),totalTokens:OQ.number(),costUsd:OQ.number(),sampledRuns:OQ.number(),truncated:OQ.boolean()})}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),await BJ(),!await Z.storage.automations.findById($.automation_id,Q.id))throw Error("Automation not found");let X=await Z.storage.automations.getRunStats($.automation_id,Q.id,{startDate:$.startDate,endDate:$.endDate}),J=await Z.storage.automations.listRunThreadIds($.automation_id,Q.id,{startDate:$.startDate,endDate:$.endDate,limit:WX6}),G={calls:0,inputTokens:0,outputTokens:0,totalTokens:0,costUsd:0,sampledRuns:J.length,truncated:X.total>J.length};if(J.length>0){let W=await Z.storage.monitoring.queryThreadUsage({organizationId:Q.id,connectionId:"decopilot",threadIds:J,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});for(let K of W)G.calls+=K.calls,G.inputTokens+=K.inputTokens,G.outputTokens+=K.outputTokens,G.totalTokens+=K.totalTokens,G.costUsd+=K.costUsd}return{runs:X,usage:G}}})});var Gc$=D(()=>{zl$();Pl$();Al$();al$();el$();Zc$();Qc$();Yc$();Xc$();Jc$()});import{z as gE}from"zod";var HX6,FX6,F31;var Wc$=D(()=>{S0();HX6=gE.object({id:gE.string().min(1)}),FX6=gE.object({user:gE.object({id:gE.string(),name:gE.string(),email:gE.string(),image:gE.string().nullable()}).nullable()}),F31=c({name:"USER_GET",description:"Get a user's profile by ID. Only returns users who share an organization with the caller.",annotations:{title:"Get User",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HX6,outputSchema:FX6,handler:async($,Z)=>{await Z.access.check(),n(Z);let Q=g0(Z);if(!Q)throw Error("Authentication required");let Y=await Z.storage.users.findById($.id,Q);if(!Y)return{user:null};return{user:{id:Y.id,name:Y.name,email:Y.email,image:Y.image??null}}}})});import{z as UX6}from"zod";var NX6,U31;var Kc$=D(()=>{S0();cZ();NX6={tiers:{}},U31=c({name:"USER_MODEL_PREFERENCES_GET",description:"Get the calling user's personal chat tier \u2192 model overrides for the current organization. Absent tiers fall back to the org default.",annotations:{title:"Get User Model Preferences",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:UX6.object({}),outputSchema:y00,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");return await Z.storage.userModelPreferences.get(Y,Q.id)??NX6}})});function BX6($,Z,Q){let Y={};for(let X of zj.options){let J=$[X];if(!J||I3(Q,J.keyId,J.modelId)){Y[X]=J;continue}let G=Z?.[X];if(!(G?.keyId===J.keyId&&G?.modelId===J.modelId))throw Error("Model not allowed for your role");Y[X]=null}return Y}var N31;var Hc$=D(()=>{S0();cZ();By();N31=c({name:"USER_MODEL_PREFERENCES_UPDATE",description:"Set the calling user's personal chat tier \u2192 model overrides for the current organization. Only affects this user's chats; the org default and every non-chat path (automations, background tools) are unchanged. Omit a tier (or set it null) to fall back to the org default. Models the caller's role is not allowed to use are rejected.",annotations:{title:"Update User Model Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:y00,outputSchema:y00,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");let[X,J]=await Promise.all([V3(Z.db,Q.id,Q.role??Z.auth.user?.role),Z.storage.userModelPreferences.get(Y,Q.id)]);return await Z.storage.userModelPreferences.upsert(Y,Q.id,{tiers:BX6($.tiers,J?.tiers,X)})}})});var Fc$=D(()=>{Wc$();Kc$();Hc$()});import{z as LX6}from"zod";var B31;var Uc$=D(()=>{jl();S0();B31=c({name:"SIDEBAR_GET",description:"Get the project sidebar for the calling member: the organization's folders (the same for everyone), the member's own pinned, hidden and dismissed projects and hidden folders, and when they joined the organization.",annotations:{title:"Get Project Sidebar",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LX6.object({}),outputSchema:f0$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");let X=Z.storage.projectSidebar,[J,G,W]=await Promise.all([X.getFolders(Q.id),X.getPreferences(Y,Q.id),X.joinedAt(Y,Q.id)]);return{folders:J,preferences:G,joinedAt:W}}})});function Nc$($){x6.emit($,{id:crypto.randomUUID(),type:h0$,source:"project-sidebar",subject:$,data:{},time:new Date().toISOString()})}var Bc$=D(()=>{jl();RE()});import{z as Dc$}from"zod";var D31;var Lc$=D(()=>{jl();S0();Bc$();D31=c({name:"PROJECT_FOLDERS_SET",description:"Replace the organization's project folders: names, order, and which projects each holds. Org-wide, every member sees the change. A project listed in two folders stays in the first. Deleting a folder never deletes its projects.",annotations:{title:"Set Project Folders",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Dc$.object({folders:Ol}),outputSchema:Dc$.object({folders:Ol}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=await Z.storage.projectSidebar.setFolders(Q.id,$.folders);return Nc$(Q.id),{folders:Y}}})});var L31;var Oc$=D(()=>{jl();S0();L31=c({name:"SIDEBAR_PREFERENCES_SET",description:"Replace the calling member's own sidebar preferences: pinned, hidden and dismissed projects, and hidden folders. Affects only this member.",annotations:{title:"Set Sidebar Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:wl,outputSchema:wl,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");return Z.storage.projectSidebar.setPreferences(Y,Q.id,$)}})});var wc$=D(()=>{Uc$();Lc$();Oc$()});import _3 from"zod";var O31;var jc$=D(()=>{S0();VW();O31=c({name:"AI_PROVIDERS_LIST",description:"List all supported AI providers and their connection methods (API key, OAuth).",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:_3.object({}),outputSchema:_3.object({providers:_3.array(_3.object({id:_3.string(),name:_3.string(),description:_3.string(),logo:_3.string().optional(),supportedMethods:_3.array(_3.enum(["api-key","oauth-pkce"])),supportsTopUp:_3.boolean().optional(),supportsCredits:_3.boolean().optional(),supportsProvision:_3.boolean().optional()}))}),handler:async($,Z)=>{return n(Z),X0(Z),await Z.access.check(),{providers:Object.values(O9()).filter((Y)=>!!Y).map((Y)=>({...Y.info,supportedMethods:Y.supportedMethods,supportsTopUp:!!Y.getTopUpUrl,supportsCredits:!!Y.getCreditsBalance,supportsProvision:!!Y.provisionKey}))}}})});import h7 from"zod";var w31;var Ec$=D(()=>{S0();By();w31=c({name:"AI_PROVIDERS_LIST_MODELS",description:"List models available from an AI provider. Requires a valid stored API key.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:h7.object({keyId:h7.string().describe("The provider key ID to use")}),outputSchema:h7.object({models:h7.array(h7.object({providerId:h7.string(),modelId:h7.string(),title:h7.string(),description:h7.string().nullish(),logo:h7.string().nullish(),capabilities:h7.array(h7.string()),limits:h7.object({contextWindow:h7.coerce.number(),maxOutputTokens:h7.coerce.number().nullable()}).nullish(),costs:h7.object({input:h7.coerce.number(),output:h7.coerce.number()}).nullish(),asyncResearch:h7.boolean().optional()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let[Y,X]=await Promise.all([Z.aiProviders.listModels($.keyId,Q.id),V3(Z.db,Q.id,Q.role??Z.auth.user?.role)]);return{models:Y.filter((G)=>I3(X,$.keyId,G.modelId))}}})});import $L from"zod";var j31;var zc$=D(()=>{S0();VW();j31=c({name:"AI_PROVIDERS_ACTIVE",description:"List AI providers that have at least one API key configured and ready to use.",inputSchema:$L.object({}),outputSchema:$L.object({providers:$L.array($L.object({id:$L.string(),name:$L.string(),description:$L.string(),logo:$L.string().optional(),keyCount:$L.number()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.list({organizationId:Q.id}),X=new Map;for(let G of Y)X.set(G.providerId,(X.get(G.providerId)??0)+1);return{providers:[...X.entries()].flatMap(([G,W])=>{let H=O9()[G];if(!H)return console.warn(`AI provider "${G}" has stored keys but is not in the registry; skipping.`),[];return[{...H.info,keyCount:W}]})}}})});var dH=D(()=>{n8()});import iH from"zod";var Ty,E31;var U40=D(()=>{$6();S0();dH();Ty=iH.object({id:iH.string(),providerId:iH.string(),label:iH.string(),presetId:iH.string().nullable(),createdAt:iH.string()}),E31=c({name:"AI_PROVIDER_KEY_CREATE",description:"Store an API key for an AI provider. The key is encrypted at rest in the vault.",inputSchema:iH.object({providerId:iH.enum(vZ),label:iH.string().min(1).max(100),apiKey:iH.string().min(1),presetId:iH.string().min(1).max(64).optional()}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.create({providerId:$.providerId,label:$.label,apiKey:$.apiKey,organizationId:Q.id,createdBy:Z.auth.user.id,presetId:$.presetId??null});return f1.capture({distinctId:Z.auth.user.id,event:"ai_provider_key_created",groups:{organization:Q.id},properties:{organization_id:Q.id,provider_id:Y.providerId,preset_id:Y.presetId,key_id:Y.id,label:Y.label}}),{id:Y.id,providerId:Y.providerId,label:Y.label,presetId:Y.presetId,createdAt:Y.createdAt}}})});import fI0 from"zod";var Si=($,Z)=>$&&$.keyId===Z?null:$,wX6=($,Z)=>{let Q={tiers:{fast:Si($.tiers.fast,Z),smart:Si($.tiers.smart,Z),thinking:Si($.tiers.thinking,Z),image:Si($.tiers.image,Z),web_search:Si($.tiers.web_search,Z),deep_research:Si($.tiers.deep_research,Z)}},Y=Q.tiers.fast!==$.tiers.fast||Q.tiers.smart!==$.tiers.smart||Q.tiers.thinking!==$.tiers.thinking||Q.tiers.image!==$.tiers.image||Q.tiers.web_search!==$.tiers.web_search||Q.tiers.deep_research!==$.tiers.deep_research;return{config:Q,changed:Y}},z31;var Pc$=D(()=>{$6();S0();z31=c({name:"AI_PROVIDER_KEY_DELETE",description:"Delete a stored AI provider API key. Cannot be undone.",inputSchema:fI0.object({keyId:fI0.string().describe("The provider key ID to delete")}),outputSchema:fI0.object({success:fI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.organizationSettings.get(Q.id);if(Y?.simple_mode){let{config:X,changed:J}=wX6(Y.simple_mode,$.keyId);if(J)await Z.storage.organizationSettings.upsert(Q.id,{simple_mode:X})}return await Z.storage.aiProviderKeys.delete($.keyId,Q.id),f1.capture({distinctId:Z.auth.user.id,event:"ai_provider_key_deleted",groups:{organization:Q.id},properties:{organization_id:Q.id,key_id:$.keyId}}),{success:!0}}})});import yI0 from"zod";var P31;var Ac$=D(()=>{S0();U40();P31=c({name:"AI_PROVIDER_KEY_UPDATE",description:"Update the label and/or API key of a stored AI provider key. Pass apiKey to rotate the stored credential.",inputSchema:yI0.object({keyId:yI0.string(),label:yI0.string().min(1).max(100).optional(),apiKey:yI0.string().min(1).optional()}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.updateKey($.keyId,Q.id,{label:$.label,apiKey:$.apiKey});return{id:Y.id,providerId:Y.providerId,label:Y.label,presetId:Y.presetId,createdAt:Y.createdAt}}})});import Ci from"zod";var A31;var Tc$=D(()=>{S0();A31=c({name:"AI_PROVIDER_KEY_PREVIEW",description:"Get the label and a masked preview of a stored AI provider API key. The API key is partially obscured (only the last 4 characters are visible). For openai-compatible keys the baseUrl is also returned.",inputSchema:Ci.object({keyId:Ci.string()}),outputSchema:Ci.object({label:Ci.string(),maskedKey:Ci.string(),baseUrl:Ci.string().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);return await Z.access.check(),Z.storage.aiProviderKeys.getPreview($.keyId,Q.id)}})});import pH from"zod";var T31;var Rc$=D(()=>{S0();dH();By();T31=c({name:"AI_PROVIDER_KEY_LIST",description:"List stored AI provider API keys. Returns metadata only \u2014 secrets are never exposed.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:pH.object({providerId:pH.enum(tY0).optional()}),outputSchema:pH.object({keys:pH.array(pH.object({id:pH.string(),providerId:pH.string(),label:pH.string(),presetId:pH.string().nullable(),createdBy:pH.string(),createdAt:pH.string()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let[Y,X]=await Promise.all([Z.storage.aiProviderKeys.list({organizationId:Q.id,providerId:$.providerId}),V3(Z.db,Q.id,Q.role??Z.auth.user?.role)]);return{keys:Y.filter((W)=>Uh$(X,W.id)).map(({organizationId:W,...K})=>K)}}})});import{createHash as jX6,randomBytes as EX6}from"crypto";function qc$(){return EX6(32).toString("base64url")}function Mc$($){return jX6("sha256").update($).digest("base64url")}var Ic$=()=>{};import _i from"zod";function Vc$($){return $==="localhost"||$.endsWith(".localhost")||$==="127.0.0.1"||$==="[::1]"||$==="::1"}function zX6($){let Z=j0(),Q=Z.baseUrl??`http://localhost:${Z.port}`,Y=new URL($),X=new URL(Q);if(Y.origin===X.origin)return!0;return Y.protocol===X.protocol&&Vc$(Y.hostname)&&Vc$(X.hostname)}var R31;var kc$=D(()=>{S0();dH();VW();Ic$();s1();R31=c({name:"AI_PROVIDER_OAUTH_URL",description:"Get the OAuth PKCE authorization URL for a provider. Returns URL and state token.",inputSchema:_i.object({providerId:_i.enum(vZ),callbackUrl:_i.string().url().refine(($)=>{return zX6($)},{message:"callbackUrl must be on the same origin as BASE_URL"})}),outputSchema:_i.object({url:_i.string(),stateToken:_i.string().describe("Opaque token \u2014 pass to AI_PROVIDER_OAUTH_EXCHANGE")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=O9()[$.providerId];if(!Y)throw Error(`Unknown provider: ${$.providerId}`);if(!Y.supportedMethods.includes("oauth-pkce")||!Y.getOAuthUrl)throw Error(`Provider ${$.providerId} does not support OAuth PKCE`);let X=qc$(),J=Mc$(X),G=await Z.storage.oauthPkceStates.create(X,Q.id,Z.auth.user.id),W=new URL($.callbackUrl);W.searchParams.set("state",G);let K={callbackUrl:W.toString(),codeChallenge:J,codeChallengeMethod:"S256",organizationId:Q.id};return{url:Y.getOAuthUrl(K),stateToken:G}}})});import N40 from"zod";var q31;var Sc$=D(()=>{S0();dH();VW();U40();q31=c({name:"AI_PROVIDER_OAUTH_EXCHANGE",description:"Exchange an OAuth authorization code for an API key. Completes the OAuth flow started by AI_PROVIDER_OAUTH_URL.",inputSchema:N40.object({providerId:N40.enum(vZ),code:N40.string(),stateToken:N40.string().describe("The stateToken returned by AI_PROVIDER_OAUTH_URL"),label:N40.string().min(1).max(100)}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=O9()[$.providerId];if(!Y)throw Error(`Unknown provider: ${$.providerId}`);if(!Y.supportedMethods.includes("oauth-pkce")||!Y.exchangeOAuthCode)throw Error(`Provider ${$.providerId} does not support OAuth PKCE`);let X=g0(Z);if(!X)throw Error("Unable to determine user ID");let J=await Z.storage.oauthPkceStates.consume($.stateToken,Q.id,X),{apiKey:G}=await Y.exchangeOAuthCode({code:$.code,codeVerifier:J,codeChallengeMethod:"S256"}),W=await Z.storage.aiProviderKeys.upsert({providerId:$.providerId,label:$.label,apiKey:G,organizationId:Q.id,createdBy:X});return{id:W.id,providerId:W.providerId,label:W.label,presetId:W.presetId,createdAt:W.createdAt}}})});import Cc$ from"zod";var M31;var _c$=D(()=>{S0();dH();VW();hK();U40();M31=c({name:"AI_PROVIDER_PROVISION_KEY",description:"Auto-provision an API key for a provider that supports server-to-server key creation (e.g. Deco AI Gateway).",inputSchema:Cc$.object({providerId:Cc$.enum(vZ)}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.provisionKey)throw Error(`Provider ${$.providerId} does not support key provisioning`);let J=await r7(Y),G=await X.provisionKey(J,Q.id),W=await Z.storage.aiProviderKeys.upsert({providerId:$.providerId,label:"Auto-provisioned",apiKey:G,organizationId:Q.id,createdBy:Y});return{id:W.id,providerId:W.providerId,label:W.label,presetId:W.presetId,createdAt:W.createdAt}}})});function B40(){let $=j0();return $.aiGatewayEnabled&&!!$.aiGatewayAdminToken}async function vc$($,Z,Q){let Y=j0(),X=await fetch(`${Y.aiGatewayUrl}${$}`,{method:"POST",headers:{Authorization:`Bearer ${Y.aiGatewayAdminToken}`,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:AbortSignal.timeout(15000)}),J=await X.text().catch(()=>"");if(!X.ok){let G=X.status>=400&&X.status<500&&X.status!==408&&X.status!==429,W=`${Q} failed (${X.status}): ${J}`;throw G?new vi(X.status,W):Error(W)}}async function bi($){let Z=j0();if(!Z.aiGatewayEnabled)return;if(!Z.aiGatewayAdminToken)throw Error("DECO_AI_GATEWAY_ADMIN_TOKEN is not set \u2014 cannot place the gateway plan");await vc$("/api/admin/plans",{orgId:$.organizationId,planId:$.planId,note:$.note},"gateway plan change")}async function bc$($){if(!B40())throw Error("gateway admin not configured \u2014 cannot credit top-up");await vc$("/api/admin/credits",{orgId:$.organizationId,amountCents:$.amountCents,description:"Studio credit top-up (Stripe)",referenceId:$.referenceId},"gateway top-up credit")}var vi;var D40=D(()=>{s1();vi=class vi extends Error{status;constructor($,Z){super(Z);this.status=$;this.name="GatewayAdminPermanentError"}}});import xi from"zod";var PX6=1e6,I31;var xc$=D(()=>{D40();LD();k9();s1();S0();dH();VW();hK();I31=c({name:"AI_PROVIDER_TOPUP_URL",description:"Get a checkout URL to top up credits for a provider that supports it (e.g. Deco AI Gateway)",requiresFeature:"credits",inputSchema:xi.object({providerId:xi.enum(vZ),amountCents:xi.number().int().positive().max(PX6).describe("Amount in cents (e.g. 1000 = $10.00), max $10,000.00"),currency:xi.enum(["usd","brl"]).default("usd")}),outputSchema:xi.object({url:xi.string().describe("Checkout URL \u2014 open in browser to complete payment")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=j0();if($.providerId==="deco"&&X.stripeSecretKey&&B40()&&Q.slug){let K=await Z.storage.organizationBilling.getBilling(Q.id),H=`${c5()}${Dj(Q.slug)}`,{url:F}=await vL$({organizationId:Q.id,amountCents:$.amountCents,currency:$.currency,feePercent:X.topupFeePercent,customerId:K?.stripeCustomerId??null,successUrl:`${H}?topup=success`,cancelUrl:`${H}?topup=canceled`});return{url:F}}let J=O9()[$.providerId];if(!J)throw Error(`Unknown provider: ${$.providerId}`);if(!J.getTopUpUrl)throw Error(`Provider ${$.providerId} does not support credit top-ups`);let G=await r7(Y,Z.auth.user?.email);return{url:await J.getTopUpUrl(G,Q.id,$.amountCents,$.currency)}}})});import gI0 from"zod";function AX6($){return Number.isFinite($)}var V31;var fc$=D(()=>{S0();dH();VW();hK();V31=c({name:"AI_PROVIDER_CREDITS",description:"Get the current credit balance for a provider (providers that support it, e.g. Deco AI Gateway)",inputSchema:gI0.object({providerId:gI0.enum(vZ)}),outputSchema:gI0.object({balanceCents:gI0.number().describe("Remaining balance in cents (e.g. 1000 = $10.00)")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.getCreditsBalance)throw Error(`Provider ${$.providerId} does not expose a credits balance`);let J=await r7(Y),G=await X.getCreditsBalance(J,Q.id);if(!AX6(G.balanceCents))throw console.error(`AI provider "${$.providerId}" returned a non-finite credits balance for org ${Q.id}: ${G.balanceCents}`),Error(`Provider ${$.providerId} returned an invalid credits balance`);return G}})});function yc$($){return{plan:$.plan,features:$.features,usage:$.usage,credits:$.credits,tasks:$.tasks,periodStart:$.periodStart,periodEnd:$.periodEnd}}import qZ from"zod";var k31;var gc$=D(()=>{S0();dH();VW();hK();k31=c({name:"AI_PLAN_ENTITLEMENTS",description:"Get the organization's plan, its feature flags and the AI usage bar (a percentage, never a dollar amount)",inputSchema:qZ.object({providerId:qZ.enum(vZ)}),outputSchema:qZ.object({plan:qZ.object({id:qZ.string(),name:qZ.string()}),features:qZ.record(qZ.string(),qZ.boolean()),usage:qZ.object({percent:qZ.number(),state:qZ.enum(["ok","warn","exhausted"]),usedMicros:qZ.number().nullable(),limitMicros:qZ.number().nullable()}).nullable(),credits:qZ.object({remainingUsd:qZ.number()}).nullable(),tasks:qZ.object({allowed:qZ.boolean(),remaining:qZ.number().nullable(),denyReason:qZ.string().nullable()}),periodStart:qZ.string().nullable(),periodEnd:qZ.string().nullable()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.getEntitlements)throw Error(`Provider ${$.providerId} does not expose plans`);let J=await r7(Y);return yc$(await X.getEntitlements(J,Q.id))}})});function C31($){if(lc$=$,S31)return;let Z=$();if(!Z)return;S31=Z.subscribe(hc$);let Q=new TextDecoder;(async()=>{for await(let Y of S31)try{let X=JSON.parse(Q.decode(Y.data));if(typeof X.organizationId!=="string")continue;if(X.originId===uc$)continue;W$1(X.organizationId)}catch{}})()}function Ry($){W$1($);try{let Z=lc$?.()??null;if(!Z)return;let Q={originId:uc$,organizationId:$};Z.publish(hc$,TX6.encode(JSON.stringify(Q)))}catch(Z){console.warn("[plans] cross-pod cache invalidation failed to publish",{organizationId:$,error:Z instanceof Error?Z.message:String(Z)})}}var hc$="studio.plans.invalidate",uc$,lc$=null,S31=null,TX6;var L40=D(()=>{jH();uc$=crypto.randomUUID(),TX6=new TextEncoder});import l9 from"zod";function qX6($){if(!$.plansEnabled)return"Plans are not enabled on this deployment.";if(!$.entitlements)return"Could not read this organization's plan.";if($.entitlements.features.invoice_upgrade!==!0)return"This organization cannot add a plan to its invoice.";if($.entitlements.usageState!=="exhausted")return"Invoice upgrades open once this organization's AI usage limit is reached.";if($.subscriptionBound)return"This organization has an active subscription \u2014 change plans through billing.";if($.entitlements.planId===$.targetPlanId)return"This organization is already on that plan.";return null}var RX6,_31,v31,b31;var cc$=D(()=>{S0();dH();VW();hK();L40();D40();s1();$6();RX6=l9.object({id:l9.string(),name:l9.string(),features:l9.record(l9.string(),l9.boolean())}),_31=c({name:"AI_PLAN_LIST",description:"List the plans an organization can move to",inputSchema:l9.object({providerId:l9.enum(vZ)}),outputSchema:l9.object({plans:l9.array(RX6)}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X?.listPlans)throw Error(`Provider ${$.providerId} does not expose plans`);let J=await r7(Y);return{plans:await X.listPlans(J,Q.id)}}}),v31=c({name:"AI_PLAN_SET",description:"Drop the organization back to the free tier. Paid plans are granted by subscribing (ORGANIZATION_BILLING_CHECKOUT_START), never here.",inputSchema:l9.object({providerId:l9.enum(vZ),planId:l9.literal("free")}),outputSchema:l9.object({plan:l9.object({id:l9.string(),name:l9.string()}),features:l9.record(l9.string(),l9.boolean())}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");if((await Z.storage.organizationBilling.getBilling(Q.id))?.stripeSubscriptionId)throw Error("This organization has an active subscription \u2014 cancel it in billing first; the plan drops to free when it ends.");let J=O9()[$.providerId];if(!J?.setPlan)throw Error(`Provider ${$.providerId} does not expose plans`);let G=await r7(Y),W=await J.setPlan(G,Q.id,$.planId);return Ry(Q.id),{plan:W.plan,features:W.features}}});b31=c({name:"AI_PLAN_INVOICE_UPGRADE",description:"Move the organization to a paid plan now, billed on its next deco invoice. Only for organizations deco enabled for invoice billing.",inputSchema:l9.object({planId:l9.enum(["starter","business"])}),outputSchema:l9.object({planId:l9.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=j0().plansEnabled&&B40(),J=await Z.storage.organizationBilling.getBilling(Q.id),G=O9().deco,W=null;if(X&&G?.getEntitlements){let F=await G.getEntitlements(await r7(Y),Q.id);if(F.features&&typeof F.features==="object")W={planId:F.plan.id,features:F.features,usageState:F.usage?.state??null}}let K=qX6({plansEnabled:X,entitlements:W,subscriptionBound:!!J?.stripeSubscriptionId,targetPlanId:$.planId});if(K||!W)throw Error(K??"Could not read this organization's plan.");let H=Z.auth.user?.email??Y;return await bi({organizationId:Q.id,planId:$.planId,note:`invoice upgrade by ${H} at ${new Date().toISOString()} \u2014 bill on next invoice`}),Ry(Q.id),$Q({event:"plan_invoice_upgrade",organizationId:Q.id,userId:Y,properties:{plan_id:$.planId,previous_plan_id:W.planId,org_slug:Q.slug,org_name:Q.name}}),{planId:$.planId}}})});var mc$=D(()=>{jc$();Ec$();zc$();U40();Pc$();Ac$();Tc$();Rc$();kc$();Sc$();_c$();xc$();fc$();gc$();cc$()});import hE from"zod";function VX6($){let Z=$.trim();if(Z.startsWith(IX6))throw Error("That looks like a Console API key, which bills per-token API usage instead of your subscription. Run `claude setup-token` and paste the token it prints.");if(/\s/.test(Z))throw Error("The token must not contain spaces or line breaks");if(Z.length===0)throw Error("The token must not be empty");return Z}var x31,IX6="sk-ant-api",dc$,ic$,pc$;var nc$=D(()=>{S0();x31=hE.object({connected:hE.boolean(),linkedAt:hE.string().nullable(),expiresAt:hE.string().nullable().describe("Known expiry, or null when the token carries none we can read")});dc$=c({name:"CLAUDE_SUBSCRIPTION_CONNECT",description:"Link the caller's Claude subscription with a token from `claude setup-token`, so their claude-code runs bill against their own Pro/Max plan. Stored encrypted, for the caller only.",inputSchema:hE.object({token:hE.string().min(1).describe("The token printed by `claude setup-token` (sk-ant-oat\u2026)")}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");let Y=VX6($.token);return{connected:!0,...await Z.storage.claudeSubscriptions.upsert({userId:Q,accessToken:Y})}}}),ic$=c({name:"CLAUDE_SUBSCRIPTION_STATUS",description:"Whether the caller has a linked Claude subscription token, and since when.",inputSchema:hE.object({}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");let Y=await Z.storage.claudeSubscriptions.find(Q);if(!Y)return{connected:!1,linkedAt:null,expiresAt:null};return{connected:!(Y.expiresAt!==null&&new Date(Y.expiresAt)<=new Date),...Y}}}),pc$=c({name:"CLAUDE_SUBSCRIPTION_DISCONNECT",description:"Unlink the caller's Claude subscription and delete the stored token.",inputSchema:hE.object({}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");return await Z.storage.claudeSubscriptions.delete(Q),{connected:!1,linkedAt:null,expiresAt:null}}})});import NN from"zod";var hI0;var f31=D(()=>{hI0=NN.object({id:NN.string(),scope:NN.enum(["user","organization"]),userId:NN.string().nullable(),name:NN.string(),description:NN.string().nullable(),createdBy:NN.string(),createdAt:NN.string(),updatedBy:NN.string(),updatedAt:NN.string()})});import O40 from"zod";var SX6=65536,y31;var tc$=D(()=>{S0();f31();y31=c({name:"SECRET_CREATE",description:"Create a secret. The value is encrypted at rest in the credential vault and never returned by any tool. Scope 'user' is private to the caller within this organization; scope 'organization' is visible to all org members.",inputSchema:O40.object({scope:O40.enum(["user","organization"]),name:O40.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/,{message:"Name may only contain letters, digits, underscore, dot, and hyphen."}),value:O40.string().min(1).max(SX6),description:O40.string().max(500).optional()}),outputSchema:hI0,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=Z.auth.user.id,X=$.scope==="user"?{kind:"user",userId:Y}:{kind:"organization"};return await Z.storage.secrets.create({organizationId:Q.id,scope:X,name:$.name,value:$.value,description:$.description??null,createdBy:Y})}})});import uI0 from"zod";var g31;var oc$=D(()=>{S0();f31();g31=c({name:"SECRET_LIST",description:"List secrets visible to the caller: all organization-scoped secrets, plus user-scoped secrets owned by the caller. Values are never returned.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:uI0.object({scope:uI0.enum(["user","organization"]).optional()}),outputSchema:uI0.object({secrets:uI0.array(hI0)}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=Z.auth.user.id,X=$.scope==="user"?{kind:"user",userId:Y}:$.scope==="organization"?{kind:"organization"}:void 0;return{secrets:await Z.storage.secrets.list({organizationId:Q.id,callerUserId:Y,scope:X})}}})});var rc$=D(()=>{tc$();oc$()});var qy=b((yX6)=>{var h31;(function($){$.HEADER="header",$.QUERY="query"})(h31||(h31={}));var u31;(function($){$.HEADER="header",$.QUERY="query"})(u31||(u31={}));var l31;(function($){$.HTTP="http",$.HTTPS="https"})(l31||(l31={}));var w40;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(w40||(w40={}));var _X6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>w40.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>w40.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},vX6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},bX6=($)=>{return _X6($)},xX6=($)=>{return vX6($)},c31;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(c31||(c31={}));var fX6="__smithy_context",m31;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(m31||(m31={}));var d31;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(d31||(d31={}));yX6.AlgorithmId=w40;yX6.EndpointURLScheme=l31;yX6.FieldPosition=c31;yX6.HttpApiKeyAuthLocation=u31;yX6.HttpAuthLocation=h31;yX6.IniSectionType=m31;yX6.RequestHandlerProtocol=d31;yX6.SMITHY_CONTEXT_KEY=fX6;yX6.getDefaultClientConfiguration=bX6;yX6.resolveDefaultRuntimeConfig=xX6});var BN=b(($J6)=>{var{SMITHY_CONTEXT_KEY:sc$}=qy(),tX6=($)=>$[sc$]||($[sc$]={});class lI0{method;protocol;hostname;port;path;query;headers;username;password;fragment;body;constructor($){this.method=$.method||"GET",this.hostname=$.hostname||"localhost",this.port=$.port,this.query=$.query||{},this.headers=$.headers||{},this.body=$.body,this.protocol=$.protocol?$.protocol.slice(-1)!==":"?`${$.protocol}:`:$.protocol:"https:",this.path=$.path?$.path.charAt(0)!=="/"?`/${$.path}`:$.path:"/",this.username=$.username,this.password=$.password,this.fragment=$.fragment}static clone($){let Z=new lI0({...$,headers:{...$.headers}});if(Z.query)Z.query=oX6(Z.query);return Z}static isInstance($){if(!$)return!1;let Z=$;return"method"in Z&&"protocol"in Z&&"hostname"in Z&&"path"in Z&&typeof Z.query==="object"&&typeof Z.headers==="object"}clone(){return lI0.clone(this)}}function oX6($){return Object.keys($).reduce((Z,Q)=>{let Y=$[Q];return{...Z,[Q]:Array.isArray(Y)?[...Y]:Y}},{})}class ac${statusCode;reason;headers;body;constructor($){this.statusCode=$.statusCode,this.reason=$.reason,this.headers=$.headers||{},this.body=$.body}static isInstance($){if(!$)return!1;let Z=$;return typeof Z.statusCode==="number"&&typeof Z.headers==="object"}}var rX6=new RegExp("^(?!.*-$)(?!-)[a-zA-Z0-9-]{1,63}$"),ec$=($,Z=!1)=>{if(!Z)return rX6.test($);let Q=$.split(".");for(let Y of Q)if(!ec$(Y))return!1;return!0};function sX6($){return/^[a-z0-9][a-z0-9\.\-]*[a-z0-9]$/.test($)}var aX6=($)=>{if(typeof $==="function")return $;let Z=Promise.resolve($);return()=>Z};function $m$($){let Z={};if($=$.replace(/^\?/,""),$)for(let Q of $.split("&")){let[Y,X=null]=Q.split("=");if(Y=decodeURIComponent(Y),X)X=decodeURIComponent(X);if(!(Y in Z))Z[Y]=X;else if(Array.isArray(Z[Y]))Z[Y].push(X);else Z[Y]=[Z[Y],X]}return Z}var cI0=($)=>{if(typeof $==="string")return cI0(new URL($));let{hostname:Z,pathname:Q,port:Y,protocol:X,search:J}=$,G;if(J)G=$m$(J);return{hostname:Z,port:Y?parseInt(Y):void 0,protocol:X,path:Q,query:G}},eX6=($)=>{if(typeof $==="object"){if("url"in $){let Z=cI0($.url);if($.headers){Z.headers={};for(let Q in $.headers)Z.headers[Q.toLowerCase()]=$.headers[Q].join(", ")}return Z}return $}return cI0($)};$J6.HttpRequest=lI0;$J6.HttpResponse=ac$;$J6.getSmithyContext=tX6;$J6.isValidHostLabel=ec$;$J6.isValidHostname=sX6;$J6.normalizeProvider=aX6;$J6.parseQueryString=$m$;$J6.parseUrl=cI0;$J6.toEndpointV1=eX6});var nH=b((TJ6)=>{var{getSmithyContext:Zm$,HttpResponse:FJ6,toEndpointV1:UJ6}=BN(),mI0=($)=>{if(typeof $==="function")return $();return $},n31=($,Z,Q,Y,X)=>({name:Z,namespace:$,traits:Q,input:Y,output:X}),NJ6=($)=>(Z,Q)=>async(Y)=>{let{response:X}=await Z(Y),{operationSchema:J}=Zm$(Q),[,G,W,K,H,F]=J??[];try{let U=await $.protocol.deserializeResponse(n31(G,W,K,H,F),{...$,...Q},X);return{response:X,output:U}}catch(U){if(Object.defineProperty(U,"$response",{value:X,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in U)){try{U.message+=`
+`+$}function qI0($){if(!$||$.length===0)return[];return $.filter((Z)=>sY6.test(Z))}function aY6($){return[...$,...$.map((Z)=>Z.replace(/^http/,"ws"))]}function eY6($){if($.csp)return $.csp;let Z=$.resourceCsp;if(!Z)return ll$;let Q=qI0(Z.resourceDomains),Y=qI0(Z.connectDomains),X=qI0(Z.frameDomains),J=qI0(Z.baseUriDomains),G=Q.length>0,W=Y.length>0,K=X.length>0,H=J.length>0;if(!G&&!W&&!K&&!H)return ll$;let F=Q.join(" ");return["default-src 'none'",G?`script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' ${F}`:"script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",G?`style-src 'unsafe-inline' ${F}`:"style-src 'unsafe-inline'",G?`img-src * data: blob: ${F}`:"img-src * data: blob:",G?`media-src * data: blob: ${F}`:"media-src * data: blob:",G?`font-src data: ${F}`:"font-src data:",W?`connect-src ${aY6(Y).join(" ")}`:"connect-src 'none'",K?`frame-src ${X.join(" ")}`:"frame-src 'none'","worker-src blob:","form-action 'none'",H?`base-uri ${J.join(" ")}`:"base-uri 'none'"].join("; ")}var ll$,sY6;var ml$=D(()=>{ll$=["default-src 'none'","script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'","style-src 'unsafe-inline'","img-src * data: blob:","media-src * data: blob:","font-src data:","connect-src 'none'","frame-src 'none'","worker-src blob:","form-action 'none'","base-uri 'none'"].join("; ");sY6=/^https?:\/\/(\*\.)?[a-zA-Z0-9._-]+(:\d+)?\/?$/});function $X6($){let Z=$.lastFailureAt-$.firstFailureAt;return $.count>=No1&&Z>=Bo1}class rG1{options;kv=null;codec=Nj();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new il$.Kvm($).create(ZX6,{storage:dl$.StorageType.Memory,ttl:pl$.nanos(Do1)})}async recordFailure($){if(!this.kv)return oG1;let Z=Date.now();for(let Q=0;Q<QX6;Q++)try{let Y=await this.kv.get($);if(!(Y&&Y.operation!=="DEL"&&Y.operation!=="PURGE"&&Y.value?.length)){let W={count:1,firstFailureAt:Z,lastFailureAt:Z};return await this.kv.create($,this.codec.encode(W)),{count:W.count,shouldDisable:!1}}let J=this.codec.decode(Y.value),G={count:J.count+1,firstFailureAt:J.firstFailureAt,lastFailureAt:Z};return await this.kv.update($,this.codec.encode(G),Y.revision),{count:G.count,shouldDisable:$X6(G)}}catch{}return oG1}async recordSuccess($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}teardown(){this.kv=null}}class K40{async recordFailure(){return oG1}async recordSuccess(){}teardown(){}}function sG1($){nl$=$??new K40}function aG1(){return nl$}var dl$,il$,pl$,oG1,ZX6="DECOCMS_CONN_CIRCUIT",QX6=5,nl$;var eG1=D(()=>{dl$=C(MK(),1),il$=C(EA(),1),pl$=C(yz(),1),oG1={count:0,shouldDisable:!1};nl$=new K40});function tl$($){if(!$)return{decision:"skip"};if($.startsWith("notifications/"))return{decision:"skip"};if(XX6.has($))return{decision:"skip"};let Z=YX6[$];if(Z)return{decision:"skip-if-list-cached",listType:Z};return{decision:"probe"}}async function ol$($){if($.method!=="POST")return;let Z=$.headers.get("content-length");if(Z&&Number(Z)>JX6)return;try{let Q=await $.clone().json(),X=(Array.isArray(Q)?Q[0]:Q)?.method;return typeof X==="string"?X:void 0}catch{return}}var YX6,XX6,JX6=64000;var rl$=D(()=>{YX6={"tools/list":"tools","resources/list":"resources","prompts/list":"prompts"},XX6=new Set(["ping"])});import{SpanStatusCode as MI0}from"@opentelemetry/api";async function II0($,Z){let Q=$.get("studioContext");try{let Y=Q.organization?.id??null,X=Z?Z:Y?xP(Y):null;if(!X)return $.json({error:"Agent ID or organization ID is required"},400);if(Z&&!Y)return $.json({error:"Organization context is required"},400);let J=await Q.tracer.startActiveSpan("studio.virtual_mcp.lookup",{attributes:{"virtual_mcp.id":X}},async(N)=>{try{let B=await Q.storage.virtualMcps.findById(X,Y??void 0);return N.setStatus({code:MI0.OK}),B}catch(B){throw N.setStatus({code:MI0.ERROR,message:B.message}),N.recordException(B),B}finally{N.end()}});if(!J)return $.json({error:"Agent not found"},404);if(Y&&J.organization_id!==Y)return $.json({error:"Agent not found"},404);if(J.status!=="active")return $.json({error:`Agent is inactive: ${J.id??"Decopilot"}`},503);if(Q.organization?.id&&J.organization_id!==Q.organization.id)return $.json({error:"Forbidden: Agent does not belong to your organization"},403);Q.connectionId=J.id??void 0;let G=g0(Q),W=null;if(J.id&&G&&p5(J.metadata)[G])W=await Ny(Q,J.id,G,$.req.query("branch")??void 0).catch(()=>null);let K=await Q.tracer.startActiveSpan("studio.virtual_mcp.create_client",{attributes:{"virtual_mcp.id":J.id??"decopilot"}},async(N)=>{try{let B=await hD(J,Q,!1,{includeSkillsCatalog:!0,additionalConnections:W?[W]:[],listTimeoutMs:YX0});return N.setStatus({code:MI0.OK}),B}catch(B){throw N.setStatus({code:MI0.ERROR,message:B.message}),N.recordException(B),B}finally{N.end()}}),H={name:J.id??"Decopilot",version:"1.0.0",title:J.title??void 0,description:J.description??void 0,icons:J.icon?[{src:J.icon}]:void 0},F=z2(K,H,{capabilities:{tools:{},resources:{},prompts:{}},instructions:K.getInstructions(),toolCallTimeoutMs:Bu}),U=new S3({enableJsonResponse:$.req.header("Accept")?.includes("application/json")??!1});return await F.connect(U),await QK(F,U,$.req.raw,`virtual-mcp:${J.id??"decopilot"}`,{onClose:()=>K.close()})}catch(Y){let X=Y;return console.error("[virtual-mcp] Error handling virtual MCP request:",X),$.json({error:"Internal server error",message:X.message},500)}}var VI0=()=>{let $=new Z1;return $.all("/gateway/:virtualMcpId?",async(Z)=>{let Q=Z.req.param("virtualMcpId")||Z.req.header("x-virtual-mcp-id");return II0(Z,Q)}),$.all("/virtual-mcp/:virtualMcpId?",async(Z)=>{let Q=Z.req.param("virtualMcpId")||Z.req.header("x-virtual-mcp-id");return II0(Z,Q)}),$};var kI0=D(()=>{SJ();n8();Ri();J8();Vd();xM0();ZJ();qi()});import{SpanStatusCode as SI0}from"@opentelemetry/api";var sl$=($,Z)=>{if($ instanceof gl)return Z.header("Retry-After",String(Math.ceil($.cooldownRemainingMs/1000))),Z.json({error:$.message},503);if($.message.includes("not found"))return Z.json({error:$.message},404);if($.message.includes("does not belong to the active organization"))return Z.json({error:"Connection not found"},404);if($.message.includes("inactive"))return Z.json({error:$.message},503);return Z.json({error:"Internal server error",message:$.message},500)},CI0=()=>{let $=new Z1;return $.all("/",async(Z)=>{return II0(Z,void 0)}),$.get("/:connectionId/ui-resource",async(Z)=>{let Q=Z.get("studioContext"),Y=Z.req.param("connectionId"),X=Z.req.query("uri");if(!X)return Z.json({error:"uri query param is required"},400);if(!Q.organization?.id)return Z.json({error:"Organization context is required"},403);let J=Bp0(Y),G;if(J){let B=g0(Q);if(!B)return Z.json({error:"Authentication required"},401);if(G=await Ny(Q,J,B,Z.req.query("branch")??void 0),!G)return Z.json({error:"Dev server not running"},503)}else if(G=await Q.storage.connections.findById(Y,Q.organization.id),!G||G.organization_id!==Q.organization.id)return Z.json({error:"Connection not found"},404);let W=Bj(G,Q,!1,x9()??void 0),K,H;try{let L=(await W.readResource({uri:X})).contents?.[0];K=L?.text,H=L?._meta?.ui?.csp}catch(B){return Z.json({error:B.message},502)}finally{await W.close().catch(()=>{})}if(typeof K!=="string")return Z.json({error:"Resource has no text content"},404);let F=cl$(K,{resourceCsp:H}),U=`"${Bun.hash(F).toString(36)}"`,N="private, no-cache";if(Z.req.header("if-none-match")===U)return new Response(null,{status:304,headers:{ETag:U,"Cache-Control":N}});return new Response(F,{headers:{"Content-Type":"text/html; charset=utf-8",ETag:U,"Cache-Control":N}})}),$.all("/:connectionId",async(Z)=>{let Q=Z.req.param("connectionId"),Y=Z.get("studioContext");if(Q.endsWith("_self")){let G=Q.slice(0,-5);if(!Y.organization||Y.organization.id!==G)return Z.json({error:"Connection not found"},404);let W=Mi(),K=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await W.connect(K),eD.run(Y,()=>QK(W,K,Z.req.raw,`mcp:self:${Q}`))}let X=Bp0(Q);if(X){if(!Y.organization?.id)return Z.json({error:"Organization context is required"},403);let G=g0(Y);if(!G)return Z.json({error:"Authentication required"},401);let W=await Ny(Y,X,G,Z.req.query("branch")??void 0);if(!W)return Z.json({error:"Dev server not running"},503);let K=cK0(W,Y,!1),H=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});return await K.connect(H),QK(K,H,Z.req.raw,`mcp:dev:${Q}`)}let J=null;try{try{if(!Y.organization?.id)return Z.json({error:"Organization context is required"},403);if(J=await Y.tracer.startActiveSpan("studio.connection.lookup",{attributes:{"connection.id":Q}},async(O)=>{ZK(Z,"mcp.find_connection");try{let w=await Y.storage.connections.findById(Q,Y.organization.id);return O.setStatus({code:SI0.OK}),w}catch(w){throw O.setStatus({code:SI0.ERROR,message:w.message}),O.recordException(w),w}finally{C3(Z,"mcp.find_connection"),O.end()}}),!J)throw Error("Connection not found");let G=J;if(G.organization_id!==Y.organization.id)throw Error("Connection does not belong to the active organization");let W=!1;if(G.status!=="active"){let O=Date.now()-new Date(G.updated_at).getTime();if(G.status==="error"&&!!G.connection_url&&O>=jp0)W=!0;else{if(G.status==="error"&&G.connection_url){let j=jp0-O;Z.header("Retry-After",String(Math.ceil(j/1000)))}throw Error(`Connection inactive: ${G.status}`)}}let K=await ol$(Z.req.raw),{decision:H,listType:F}=tl$(K),U=H==="probe";if(H==="skip-if-list-cached"&&F){let O=x9();U=O?await O.get(F,Q)===null:!0}if(W)U=!0;if(G.connection_url&&U)zG0(Q),await Y.tracer.startActiveSpan("studio.connection.handshake",{attributes:{"connection.id":Q,"connection.url":G.connection_url}},async(O)=>{ZK(Z,"mcp.client_handshake");try{if(await cX(G,Y,!1),PG0(Q),aG1().recordSuccess(Q),W)await Y.storage.connections.update(Q,{status:"active"}),console.info("[proxy] auto-recovered connection after successful re-probe",{connectionId:Q,org:Y.organization?.slug});O.setStatus({code:SI0.OK})}catch(w){throw O.setStatus({code:SI0.ERROR,message:w.message}),O.recordException(w),w}finally{C3(Z,"mcp.client_handshake"),O.end()}});ZK(Z,"mcp.create_server");let N=cK0(G,Y,!1);C3(Z,"mcp.create_server");let B=new S3({enableJsonResponse:Z.req.raw.headers.get("Accept")?.includes("application/json")??!1});ZK(Z,"mcp.server_connect"),await N.connect(B),C3(Z,"mcp.server_connect"),ZK(Z,"mcp.handle_request");let L=await QK(N,B,Z.req.raw,`mcp:${Q}`);return C3(Z,"mcp.handle_request"),L}catch(G){if(G instanceof gl)throw G;if(J??=await Y.storage.connections.findById(Q,Y.organization?.id),J?.connection_url){let W=await $31({error:G,reqUrl:new URL(Z.req.raw.url),connectionId:Q,connectionUrl:J.connection_url,headers:{},orgSlug:Y.organization?.slug});if(W)return W;AG0(Q);let{shouldDisable:K}=await aG1().recordFailure(Q);if(K&&J.status==="active")await Y.storage.connections.update(Q,{status:"error"}),console.warn("[proxy] auto-disabled connection after sustained failures",{connectionId:Q,org:Y.organization?.slug,error:G.message})}throw G}}catch(G){return sl$(G,Z)}}),$.all("/:connectionId/call-tool/:toolName",async(Z)=>{let Q=Z.req.param("connectionId"),Y=Z.req.param("toolName"),X=Z.get("studioContext");if(!X.organization?.id)return Z.json({error:"Organization context is required"},403);let J=null;try{if(J=await X.storage.connections.findById(Q,X.organization.id),!J)return Z.json({error:"Connection not found"},404);if(J.organization_id!==X.organization.id)throw Error("Connection does not belong to the active organization");if(J.status!=="active")throw Error(`Connection inactive: ${J.status}`);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Request body must be valid JSON"},400)}let K=await(await cX(J,X,!1)).callTool({name:Y,arguments:G});if(K.isError)return new Response(JSON.stringify(K.content),{headers:{"Content-Type":"application/json"},status:500});return new Response(JSON.stringify(K.structuredContent??K.content),{headers:{"Content-Type":"application/json"}})}catch(G){if(J??=await X.storage.connections.findById(Q,X.organization.id),J?.connection_url){let W=await $31({error:G,reqUrl:new URL(Z.req.raw.url),connectionId:Q,connectionUrl:J.connection_url,headers:{},orgSlug:X.organization?.slug});if(W)return W}return sl$(G,Z)}}),$};var _I0=D(()=>{zA();Ri();J8();tG1();KD();qi();H40();mX();N00();ml$();Sr0();eG1();rl$();kI0();xM0();n8();Q31()});async function yE($,Z,Q,Y){if(Z.type!=="event"||!Z.connection_id)return{success:!0};let X=await $.storage.connections.findById(Z.connection_id);if(!X)return{success:!0};let J=$.organization?.id,G=$.organization?.slug;try{let W=await cX(X,$,!0),K=g$1.forClient(Z31(W)),H,F,U;if(Q&&Y&&J){let j=await Y.generateTokenPair();F=j.plaintext,U=j.hash,H=G?`${$.baseUrl}/api/${G}/trigger-callback`:`${$.baseUrl}/api/trigger-callback`}let N=5000,B=!1,L=new Promise((j,E)=>setTimeout(()=>{B=!0,E(Error("TRIGGER_CONFIGURE timeout"))},N)),O;try{O=await Promise.race([K.TRIGGER_CONFIGURE({type:Z.event_type,params:JSON.parse(Z.params??"{}"),enabled:Q,callbackUrl:H,callbackToken:F}),L])}catch(j){if(B&&Q&&Y&&J&&U)await Y.persistTokenHash(J,Z.connection_id,U);return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE threw on connection=${Z.connection_id} type=${Z.event_type}:`,j),{success:!1,error:String(j)}}let w=O;if(!w||w.success!==!0)return console.error(`[configureTriggerOnMcp] TRIGGER_CONFIGURE did not return success=true on connection=${Z.connection_id} type=${Z.event_type}. Raw payload:`,JSON.stringify(O)),{success:!1,error:`TRIGGER_CONFIGURE did not return success=true (got ${JSON.stringify(O)})`};try{if(Q&&Y&&J&&U)await Y.persistTokenHash(J,Z.connection_id,U);if(!Q&&Y&&J)await Y.deleteByConnection(Z.connection_id,J)}catch(j){console.error("[configureTriggerOnMcp] Token persistence failed after successful TRIGGER_CONFIGURE:",j)}return{success:!0}}catch(W){return{success:!1,error:String(W)}}}var F40=D(()=>{zA();_I0();h$1()});import{z as t5}from"zod";var Y31;var al$=D(()=>{Ay();S0();cZ();F40();Y31=c({name:"AUTOMATION_UPDATE",description:"Update an automation's config. Toggling active state reconfigures event triggers on MCPs.",annotations:{title:"Update Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:t5.object({id:t5.string(),name:t5.string().min(1).max(255).optional(),active:t5.boolean().optional(),messages:t5.union([t5.string(),t5.array(t5.looseObject({id:t5.string().optional(),role:t5.enum(["user","assistant","system"]),parts:t5.array(t5.record(t5.string(),t5.unknown())),metadata:t5.unknown().optional()}))]).optional(),models:t5.object({tier:zj,modelId:t5.string().optional(),credentialId:t5.string().optional()}).loose().optional(),tools:t5.array(t5.string()).nullable().optional(),maxAgentSteps:t5.number().int().min(1).max(100).nullable().optional(),temperature:t5.number().optional()}),outputSchema:t5.object({id:t5.string(),name:t5.string(),active:t5.boolean(),updated_at:t5.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findById($.id,Q.id);if(!Y)throw Error("Automation not found");let X={};if($.name!==void 0)X.name=$.name;if($.active!==void 0)X.active=$.active;if($.messages!==void 0){let G=EI0($.messages);X.messages=JSON.stringify(G)}if($.models!==void 0)X.models=JSON.stringify($.models);if($.tools!==void 0)X.tools=$.tools===null?null:JSON.stringify($.tools);if($.temperature!==void 0)X.temperature=$.temperature;if($.maxAgentSteps!==void 0)X.max_agent_steps=$.maxAgentSteps;let J=await Z.storage.automations.update($.id,Q.id,X);if($.active!==void 0&&$.active!==Y.active){let G=await Z.storage.automations.listTriggers(J.id),W=G.filter((K)=>K.type==="event");await Promise.allSettled(W.map(async(K)=>{let H=await yE(Z,K,$.active);if(!H.success)console.warn(`Failed to configure trigger ${K.id}: ${H.error}`)})),await vl$(G,$.active)}return{id:J.id,name:J.name,active:J.active,updated_at:J.updated_at}}})});import{z as vI0}from"zod";var X31;var el$=D(()=>{Ay();$6();S0();F40();X31=c({name:"AUTOMATION_DELETE",description:"Permanently delete an automation. Disables all event triggers on connected MCPs first.",annotations:{title:"Delete Automation",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:vI0.object({id:vI0.string()}),outputSchema:vI0.object({success:vI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),!await Z.storage.automations.findById($.id,Q.id))throw Error("Automation not found");let X=await Z.storage.automations.listTriggers($.id),J=X.filter((K)=>K.type==="event");await Promise.allSettled(J.map(async(K)=>{let H=await yE(Z,K,!1);if(!H.success)console.warn(`Failed to disable trigger ${K.id}: ${H.error}`)}));let{success:G}=await Z.storage.automations.delete($.id,Q.id);await bl$(X);let W=g0(Z);if(W)f1.capture({distinctId:W,event:"automation_deleted",groups:{organization:Q.id},properties:{organization_id:Q.id,automation_id:$.id,trigger_count:X.length}});return{success:G}}})});function Ii($){return`webhook_${$}`}function bI0($,Z,Q){if(!Z)throw Error("Cannot build webhook URL: organization slug missing from request context");return`${$}/api/${Z}/webhooks/${Q}`}import{z as $Y}from"zod";var $c$=300000,GX6=10,J31;var Zc$=D(()=>{yG1();Ay();fG1();S0();F40();J31=c({name:"AUTOMATION_TRIGGER_ADD",description:"Add a cron, event, or webhook trigger to an automation. For webhook triggers the response includes a one-time URL + secret token.",annotations:{title:"Add Trigger",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:$Y.object({automation_id:$Y.string(),type:$Y.enum(["cron","event","webhook"]),cron_expression:$Y.string().optional(),connection_id:$Y.string().optional(),event_type:$Y.string().optional(),params:$Y.record($Y.string(),$Y.string()).optional()}),outputSchema:$Y.object({id:$Y.string(),automation_id:$Y.string(),type:$Y.enum(["cron","event","webhook"]),created_at:$Y.string(),webhook:$Y.object({url:$Y.string(),token:$Y.string()}).nullable().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findById($.automation_id,Q.id);if(!Y)throw Error("Automation not found");if($.type==="cron"){if(!$.cron_expression)throw Error("cron_expression is required for cron triggers");let K=new PI0($.cron_expression,{timezone:"UTC"}).nextRuns(GX6);if(K.length===0)throw Error("Cron expression has no future runs");let H=1/0;for(let F=1;F<K.length;F++){let U=K[F].getTime()-K[F-1].getTime();if(U<H)H=U}if(K.length>=2&&Number.isFinite(H)&&H<$c$){let F=$c$/1000;throw Error(`Cron fires too frequently \u2014 minimum interval is ${F}s between runs (observed ${H/1000}s)`)}}if($.type==="event"){if(!$.connection_id)throw Error("connection_id is required for event triggers");if(!$.event_type)throw Error("event_type is required for event triggers");if(!await Z.storage.connections.findById($.connection_id,Q.id))throw Error("Connection not found");let K={id:"",automation_id:$.automation_id,type:"event",cron_expression:null,connection_id:$.connection_id,event_type:$.event_type,params:$.params?JSON.stringify($.params):null,last_run_at:null,next_run_at:null,api_key_id:null,created_at:""},H=await yE(Z,K,!0,Z.storage.triggerCallbackTokens);if(!H.success)throw Error(`Failed to configure trigger on connection: ${H.error}`)}let X=$.type==="cron"&&$.cron_expression?AI0($.cron_expression,new Date):null,J=await Z.storage.automations.addTrigger({automation_id:$.automation_id,type:$.type,cron_expression:$.type==="cron"?$.cron_expression:null,connection_id:$.type==="event"?$.connection_id:null,event_type:$.type==="event"?$.event_type:null,params:$.params?JSON.stringify($.params):null,next_run_at:X?.toISOString()??null}),G=null;if($.type==="webhook")try{let W=await Z.boundAuth.apiKey.create({name:`webhook:${Y.name}:${J.id.slice(0,8)}`,permissions:{[Ii(J.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:Y.id,trigger_id:J.id}});await Z.storage.automations.setTriggerApiKeyId(J.id,W.id),G={url:bI0(Z.baseUrl,Q.slug,J.id),token:W.key}}catch(W){await Z.storage.automations.removeTrigger(J.id,J.automation_id);let K=W instanceof Error?W.message:String(W);throw Error(`Failed to mint webhook token: ${K}`)}return await RI0(J,Y),{id:J.id,automation_id:J.automation_id,type:J.type,created_at:J.created_at,webhook:G}}})});import{z as xI0}from"zod";var G31;var Qc$=D(()=>{Ay();S0();F40();G31=c({name:"AUTOMATION_TRIGGER_REMOVE",description:"Remove a trigger from an automation. Disables associated event listeners on MCPs.",annotations:{title:"Remove Trigger",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:xI0.object({trigger_id:xI0.string()}),outputSchema:xI0.object({success:xI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findTriggerById($.trigger_id);if(!Y)throw Error("Trigger not found");if(!await Z.storage.automations.findById(Y.automation_id,Q.id))throw Error("Automation not found");if(Y.type==="event"){let G=await yE(Z,Y,!1,Z.storage.triggerCallbackTokens);if(!G.success)console.warn(`Failed to disable trigger ${Y.id}: ${G.error}`)}let{success:J}=await Z.storage.automations.removeTrigger(Y.id,Y.automation_id);if(Y.type==="cron")await iG1(Y.id);if(Y.type==="webhook"&&Y.api_key_id)try{await Z.boundAuth.apiKey.delete(Y.api_key_id)}catch(G){console.warn(`[trigger-remove] failed to delete api key ${Y.api_key_id} for trigger ${Y.id}:`,G instanceof Error?G.message:G)}return{success:J}}})});import{z as Vi}from"zod";var W31;var Yc$=D(()=>{S0();W31=c({name:"AUTOMATION_TRIGGER_ROTATE_TOKEN",description:"Rotate the secret token for a webhook automation trigger. Returns a new token; the old token is revoked.",annotations:{title:"Rotate Webhook Token",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Vi.object({trigger_id:Vi.string()}),outputSchema:Vi.object({trigger_id:Vi.string(),url:Vi.string(),token:Vi.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.automations.findTriggerById($.trigger_id);if(!Y)throw Error("Trigger not found");if(Y.type!=="webhook")throw Error("Trigger is not a webhook trigger");let X=await Z.storage.automations.findById(Y.automation_id,Q.id);if(!X)throw Error("Automation not found");let J=Y.api_key_id,G=await Z.boundAuth.apiKey.create({name:`webhook:${X.name}:${Y.id.slice(0,8)}`,permissions:{[Ii(Y.id)]:["FIRE"]},metadata:{kind:"webhook_trigger",automation_id:X.id,trigger_id:Y.id}});if(await Z.storage.automations.setTriggerApiKeyId(Y.id,G.id),J)try{await Z.boundAuth.apiKey.delete(J)}catch(W){console.warn(`[trigger-rotate] failed to delete old key ${J} for trigger ${Y.id}:`,W instanceof Error?W.message:W)}return{trigger_id:Y.id,url:bI0(Z.baseUrl,Q.slug,Y.id),token:G.key}}})});import{z as ki}from"zod";var K31;var Xc$=D(()=>{$6();S0();K31=c({name:"AUTOMATION_RUN",description:"Manually trigger an automation run. Bypasses configured triggers.",annotations:{title:"Run Automation",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:ki.object({id:ki.string()}),outputSchema:ki.object({threadId:ki.string().optional(),error:ki.string().optional(),skipped:ki.string().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),!Z.automationRunner)throw Error("Automation runner not available");let Y=g0(Z);if(!Y)throw Error("User ID not available");let X=await Z.automationRunner($.id,Q.id,Y);if(f1.capture({distinctId:Y,event:"automation_run",groups:{organization:Q.id},properties:{organization_id:Q.id,automation_id:$.id,thread_id:"taskId"in X?X.taskId:void 0,status:"skipped"in X?"skipped":("error"in X)?"error":"started",skip_reason:"skipped"in X?X.skipped:void 0,error_message:"error"in X?X.error:void 0}}),"skipped"in X)return{skipped:X.skipped};if("error"in X)return{threadId:X.taskId,error:X.error};return{threadId:X.taskId}}})});import{z as OQ}from"zod";var WX6=500,H31;var Jc$=D(()=>{S6();S0();H31=c({name:"AUTOMATION_RUN_STATS",description:"Aggregate run counts (by status) and LLM token/cost totals for a single automation.",annotations:{title:"Automation Run Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:OQ.object({automation_id:OQ.string(),startDate:OQ.string().datetime().optional().describe("Filter runs at or after this ISO timestamp"),endDate:OQ.string().datetime().optional().describe("Filter runs at or before this ISO timestamp")}),outputSchema:OQ.object({runs:OQ.object({total:OQ.number(),completed:OQ.number(),failed:OQ.number(),inProgress:OQ.number()}),usage:OQ.object({calls:OQ.number(),inputTokens:OQ.number(),outputTokens:OQ.number(),totalTokens:OQ.number(),costUsd:OQ.number(),sampledRuns:OQ.number(),truncated:OQ.boolean()})}),handler:async($,Z)=>{n(Z);let Q=X0(Z);if(await Z.access.check(),await BJ(),!await Z.storage.automations.findById($.automation_id,Q.id))throw Error("Automation not found");let X=await Z.storage.automations.getRunStats($.automation_id,Q.id,{startDate:$.startDate,endDate:$.endDate}),J=await Z.storage.automations.listRunThreadIds($.automation_id,Q.id,{startDate:$.startDate,endDate:$.endDate,limit:WX6}),G={calls:0,inputTokens:0,outputTokens:0,totalTokens:0,costUsd:0,sampledRuns:J.length,truncated:X.total>J.length};if(J.length>0){let W=await Z.storage.monitoring.queryThreadUsage({organizationId:Q.id,connectionId:"decopilot",threadIds:J,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});for(let K of W)G.calls+=K.calls,G.inputTokens+=K.inputTokens,G.outputTokens+=K.outputTokens,G.totalTokens+=K.totalTokens,G.costUsd+=K.costUsd}return{runs:X,usage:G}}})});var Gc$=D(()=>{zl$();Pl$();Al$();al$();el$();Zc$();Qc$();Yc$();Xc$();Jc$()});import{z as gE}from"zod";var HX6,FX6,F31;var Wc$=D(()=>{S0();HX6=gE.object({id:gE.string().min(1)}),FX6=gE.object({user:gE.object({id:gE.string(),name:gE.string(),email:gE.string(),image:gE.string().nullable()}).nullable()}),F31=c({name:"USER_GET",description:"Get a user's profile by ID. Only returns users who share an organization with the caller.",annotations:{title:"Get User",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HX6,outputSchema:FX6,handler:async($,Z)=>{await Z.access.check(),n(Z);let Q=g0(Z);if(!Q)throw Error("Authentication required");let Y=await Z.storage.users.findById($.id,Q);if(!Y)return{user:null};return{user:{id:Y.id,name:Y.name,email:Y.email,image:Y.image??null}}}})});import{z as UX6}from"zod";var NX6,U31;var Kc$=D(()=>{S0();cZ();NX6={tiers:{}},U31=c({name:"USER_MODEL_PREFERENCES_GET",description:"Get the calling user's personal chat tier \u2192 model overrides for the current organization. Absent tiers fall back to the org default.",annotations:{title:"Get User Model Preferences",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:UX6.object({}),outputSchema:y00,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");return await Z.storage.userModelPreferences.get(Y,Q.id)??NX6}})});function BX6($,Z,Q){let Y={};for(let X of zj.options){let J=$[X];if(!J||I3(Q,J.keyId,J.modelId)){Y[X]=J;continue}let G=Z?.[X];if(!(G?.keyId===J.keyId&&G?.modelId===J.modelId))throw Error("Model not allowed for your role");Y[X]=null}return Y}var N31;var Hc$=D(()=>{S0();cZ();By();N31=c({name:"USER_MODEL_PREFERENCES_UPDATE",description:"Set the calling user's personal chat tier \u2192 model overrides for the current organization. Only affects this user's chats; the org default and every non-chat path (automations, background tools) are unchanged. Omit a tier (or set it null) to fall back to the org default. Models the caller's role is not allowed to use are rejected.",annotations:{title:"Update User Model Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:y00,outputSchema:y00,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");let[X,J]=await Promise.all([V3(Z.db,Q.id,Q.role??Z.auth.user?.role),Z.storage.userModelPreferences.get(Y,Q.id)]);return await Z.storage.userModelPreferences.upsert(Y,Q.id,{tiers:BX6($.tiers,J?.tiers,X)})}})});var Fc$=D(()=>{Wc$();Kc$();Hc$()});import{z as LX6}from"zod";var B31;var Uc$=D(()=>{jl();S0();B31=c({name:"SIDEBAR_GET",description:"Get the project sidebar for the calling member: the organization's folders (the same for everyone), the member's own pinned, hidden and dismissed projects and hidden folders, and when they joined the organization.",annotations:{title:"Get Project Sidebar",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LX6.object({}),outputSchema:f0$,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");let X=Z.storage.projectSidebar,[J,G,W]=await Promise.all([X.getFolders(Q.id),X.getPreferences(Y,Q.id),X.joinedAt(Y,Q.id)]);return{folders:J,preferences:G,joinedAt:W}}})});function Nc$($){x6.emit($,{id:crypto.randomUUID(),type:h0$,source:"project-sidebar",subject:$,data:{},time:new Date().toISOString()})}var Bc$=D(()=>{jl();RE()});import{z as Dc$}from"zod";var D31;var Lc$=D(()=>{jl();S0();Bc$();D31=c({name:"PROJECT_FOLDERS_SET",description:"Replace the organization's project folders: names, order, and which projects each holds. Org-wide, every member sees the change. A project listed in two folders stays in the first. Deleting a folder never deletes its projects.",annotations:{title:"Set Project Folders",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Dc$.object({folders:Ol}),outputSchema:Dc$.object({folders:Ol}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=await Z.storage.projectSidebar.setFolders(Q.id,$.folders);return Nc$(Q.id),{folders:Y}}})});var L31;var Oc$=D(()=>{jl();S0();L31=c({name:"SIDEBAR_PREFERENCES_SET",description:"Replace the calling member's own sidebar preferences: pinned, hidden and dismissed projects, and hidden folders. Affects only this member.",annotations:{title:"Set Sidebar Preferences",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:wl,outputSchema:wl,handler:async($,Z)=>{n(Z),await Z.access.check();let Q=X0(Z),Y=Z.auth?.user?.id;if(!Y)throw Error("No authenticated user in context");return Z.storage.projectSidebar.setPreferences(Y,Q.id,$)}})});var wc$=D(()=>{Uc$();Lc$();Oc$()});import _3 from"zod";var O31;var jc$=D(()=>{S0();VW();O31=c({name:"AI_PROVIDERS_LIST",description:"List all supported AI providers and their connection methods (API key, OAuth).",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:_3.object({}),outputSchema:_3.object({providers:_3.array(_3.object({id:_3.string(),name:_3.string(),description:_3.string(),logo:_3.string().optional(),supportedMethods:_3.array(_3.enum(["api-key","oauth-pkce"])),supportsTopUp:_3.boolean().optional(),supportsCredits:_3.boolean().optional(),supportsProvision:_3.boolean().optional()}))}),handler:async($,Z)=>{return n(Z),X0(Z),await Z.access.check(),{providers:Object.values(O9()).filter((Y)=>!!Y).map((Y)=>({...Y.info,supportedMethods:Y.supportedMethods,supportsTopUp:!!Y.getTopUpUrl,supportsCredits:!!Y.getCreditsBalance,supportsProvision:!!Y.provisionKey}))}}})});import h7 from"zod";var w31;var Ec$=D(()=>{S0();By();w31=c({name:"AI_PROVIDERS_LIST_MODELS",description:"List models available from an AI provider. Requires a valid stored API key.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:h7.object({keyId:h7.string().describe("The provider key ID to use")}),outputSchema:h7.object({models:h7.array(h7.object({providerId:h7.string(),modelId:h7.string(),title:h7.string(),description:h7.string().nullish(),logo:h7.string().nullish(),capabilities:h7.array(h7.string()),limits:h7.object({contextWindow:h7.coerce.number(),maxOutputTokens:h7.coerce.number().nullable()}).nullish(),costs:h7.object({input:h7.coerce.number(),output:h7.coerce.number()}).nullish(),asyncResearch:h7.boolean().optional()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let[Y,X]=await Promise.all([Z.aiProviders.listModels($.keyId,Q.id),V3(Z.db,Q.id,Q.role??Z.auth.user?.role)]);return{models:Y.filter((G)=>I3(X,$.keyId,G.modelId))}}})});import $L from"zod";var j31;var zc$=D(()=>{S0();VW();j31=c({name:"AI_PROVIDERS_ACTIVE",description:"List AI providers that have at least one API key configured and ready to use.",inputSchema:$L.object({}),outputSchema:$L.object({providers:$L.array($L.object({id:$L.string(),name:$L.string(),description:$L.string(),logo:$L.string().optional(),keyCount:$L.number()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.list({organizationId:Q.id}),X=new Map;for(let G of Y)X.set(G.providerId,(X.get(G.providerId)??0)+1);return{providers:[...X.entries()].flatMap(([G,W])=>{let H=O9()[G];if(!H)return console.warn(`AI provider "${G}" has stored keys but is not in the registry; skipping.`),[];return[{...H.info,keyCount:W}]})}}})});var dH=D(()=>{n8()});import iH from"zod";var Ty,E31;var U40=D(()=>{$6();S0();dH();Ty=iH.object({id:iH.string(),providerId:iH.string(),label:iH.string(),presetId:iH.string().nullable(),createdAt:iH.string()}),E31=c({name:"AI_PROVIDER_KEY_CREATE",description:"Store an API key for an AI provider. The key is encrypted at rest in the vault.",inputSchema:iH.object({providerId:iH.enum(vZ),label:iH.string().min(1).max(100),apiKey:iH.string().min(1),presetId:iH.string().min(1).max(64).optional()}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.create({providerId:$.providerId,label:$.label,apiKey:$.apiKey,organizationId:Q.id,createdBy:Z.auth.user.id,presetId:$.presetId??null});return f1.capture({distinctId:Z.auth.user.id,event:"ai_provider_key_created",groups:{organization:Q.id},properties:{organization_id:Q.id,provider_id:Y.providerId,preset_id:Y.presetId,key_id:Y.id,label:Y.label}}),{id:Y.id,providerId:Y.providerId,label:Y.label,presetId:Y.presetId,createdAt:Y.createdAt}}})});import fI0 from"zod";var Si=($,Z)=>$&&$.keyId===Z?null:$,wX6=($,Z)=>{let Q={tiers:{fast:Si($.tiers.fast,Z),smart:Si($.tiers.smart,Z),thinking:Si($.tiers.thinking,Z),image:Si($.tiers.image,Z),web_search:Si($.tiers.web_search,Z),deep_research:Si($.tiers.deep_research,Z)}},Y=Q.tiers.fast!==$.tiers.fast||Q.tiers.smart!==$.tiers.smart||Q.tiers.thinking!==$.tiers.thinking||Q.tiers.image!==$.tiers.image||Q.tiers.web_search!==$.tiers.web_search||Q.tiers.deep_research!==$.tiers.deep_research;return{config:Q,changed:Y}},z31;var Pc$=D(()=>{$6();S0();z31=c({name:"AI_PROVIDER_KEY_DELETE",description:"Delete a stored AI provider API key. Cannot be undone.",inputSchema:fI0.object({keyId:fI0.string().describe("The provider key ID to delete")}),outputSchema:fI0.object({success:fI0.boolean()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.organizationSettings.get(Q.id);if(Y?.simple_mode){let{config:X,changed:J}=wX6(Y.simple_mode,$.keyId);if(J)await Z.storage.organizationSettings.upsert(Q.id,{simple_mode:X})}return await Z.storage.aiProviderKeys.delete($.keyId,Q.id),f1.capture({distinctId:Z.auth.user.id,event:"ai_provider_key_deleted",groups:{organization:Q.id},properties:{organization_id:Q.id,key_id:$.keyId}}),{success:!0}}})});import yI0 from"zod";var P31;var Ac$=D(()=>{S0();U40();P31=c({name:"AI_PROVIDER_KEY_UPDATE",description:"Update the label and/or API key of a stored AI provider key. Pass apiKey to rotate the stored credential.",inputSchema:yI0.object({keyId:yI0.string(),label:yI0.string().min(1).max(100).optional(),apiKey:yI0.string().min(1).optional()}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=await Z.storage.aiProviderKeys.updateKey($.keyId,Q.id,{label:$.label,apiKey:$.apiKey});return{id:Y.id,providerId:Y.providerId,label:Y.label,presetId:Y.presetId,createdAt:Y.createdAt}}})});import Ci from"zod";var A31;var Tc$=D(()=>{S0();A31=c({name:"AI_PROVIDER_KEY_PREVIEW",description:"Get the label and a masked preview of a stored AI provider API key. The API key is partially obscured (only the last 4 characters are visible). For openai-compatible keys the baseUrl is also returned.",inputSchema:Ci.object({keyId:Ci.string()}),outputSchema:Ci.object({label:Ci.string(),maskedKey:Ci.string(),baseUrl:Ci.string().optional()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);return await Z.access.check(),Z.storage.aiProviderKeys.getPreview($.keyId,Q.id)}})});import pH from"zod";var T31;var Rc$=D(()=>{S0();dH();By();T31=c({name:"AI_PROVIDER_KEY_LIST",description:"List stored AI provider API keys. Returns metadata only \u2014 secrets are never exposed.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:pH.object({providerId:pH.enum(tY0).optional()}),outputSchema:pH.object({keys:pH.array(pH.object({id:pH.string(),providerId:pH.string(),label:pH.string(),presetId:pH.string().nullable(),createdBy:pH.string(),createdAt:pH.string()}))}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let[Y,X]=await Promise.all([Z.storage.aiProviderKeys.list({organizationId:Q.id,providerId:$.providerId}),V3(Z.db,Q.id,Q.role??Z.auth.user?.role)]);return{keys:Y.filter((W)=>Uh$(X,W.id)).map(({organizationId:W,...K})=>K)}}})});import{createHash as jX6,randomBytes as EX6}from"crypto";function qc$(){return EX6(32).toString("base64url")}function Mc$($){return jX6("sha256").update($).digest("base64url")}var Ic$=()=>{};import _i from"zod";function Vc$($){return $==="localhost"||$.endsWith(".localhost")||$==="127.0.0.1"||$==="[::1]"||$==="::1"}function zX6($){let Z=j0(),Q=Z.baseUrl??`http://localhost:${Z.port}`,Y=new URL($),X=new URL(Q);if(Y.origin===X.origin)return!0;return Y.protocol===X.protocol&&Vc$(Y.hostname)&&Vc$(X.hostname)}var R31;var kc$=D(()=>{S0();dH();VW();Ic$();s1();R31=c({name:"AI_PROVIDER_OAUTH_URL",description:"Get the OAuth PKCE authorization URL for a provider. Returns URL and state token.",inputSchema:_i.object({providerId:_i.enum(vZ),callbackUrl:_i.string().url().refine(($)=>{return zX6($)},{message:"callbackUrl must be on the same origin as BASE_URL"})}),outputSchema:_i.object({url:_i.string(),stateToken:_i.string().describe("Opaque token \u2014 pass to AI_PROVIDER_OAUTH_EXCHANGE")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=O9()[$.providerId];if(!Y)throw Error(`Unknown provider: ${$.providerId}`);if(!Y.supportedMethods.includes("oauth-pkce")||!Y.getOAuthUrl)throw Error(`Provider ${$.providerId} does not support OAuth PKCE`);let X=qc$(),J=Mc$(X),G=await Z.storage.oauthPkceStates.create(X,Q.id,Z.auth.user.id),W=new URL($.callbackUrl);W.searchParams.set("state",G);let K={callbackUrl:W.toString(),codeChallenge:J,codeChallengeMethod:"S256",organizationId:Q.id};return{url:Y.getOAuthUrl(K),stateToken:G}}})});import N40 from"zod";var q31;var Sc$=D(()=>{S0();dH();VW();U40();q31=c({name:"AI_PROVIDER_OAUTH_EXCHANGE",description:"Exchange an OAuth authorization code for an API key. Completes the OAuth flow started by AI_PROVIDER_OAUTH_URL.",inputSchema:N40.object({providerId:N40.enum(vZ),code:N40.string(),stateToken:N40.string().describe("The stateToken returned by AI_PROVIDER_OAUTH_URL"),label:N40.string().min(1).max(100)}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=O9()[$.providerId];if(!Y)throw Error(`Unknown provider: ${$.providerId}`);if(!Y.supportedMethods.includes("oauth-pkce")||!Y.exchangeOAuthCode)throw Error(`Provider ${$.providerId} does not support OAuth PKCE`);let X=g0(Z);if(!X)throw Error("Unable to determine user ID");let J=await Z.storage.oauthPkceStates.consume($.stateToken,Q.id,X),{apiKey:G}=await Y.exchangeOAuthCode({code:$.code,codeVerifier:J,codeChallengeMethod:"S256"}),W=await Z.storage.aiProviderKeys.upsert({providerId:$.providerId,label:$.label,apiKey:G,organizationId:Q.id,createdBy:X});return{id:W.id,providerId:W.providerId,label:W.label,presetId:W.presetId,createdAt:W.createdAt}}})});import Cc$ from"zod";var M31;var _c$=D(()=>{S0();dH();VW();hK();U40();M31=c({name:"AI_PROVIDER_PROVISION_KEY",description:"Auto-provision an API key for a provider that supports server-to-server key creation (e.g. Deco AI Gateway).",inputSchema:Cc$.object({providerId:Cc$.enum(vZ)}),outputSchema:Ty,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.provisionKey)throw Error(`Provider ${$.providerId} does not support key provisioning`);let J=await r7(Y),G=await X.provisionKey(J,Q.id),W=await Z.storage.aiProviderKeys.upsert({providerId:$.providerId,label:"Auto-provisioned",apiKey:G,organizationId:Q.id,createdBy:Y});return{id:W.id,providerId:W.providerId,label:W.label,presetId:W.presetId,createdAt:W.createdAt}}})});function B40(){let $=j0();return $.aiGatewayEnabled&&!!$.aiGatewayAdminToken}async function vc$($,Z,Q){let Y=j0(),X=await fetch(`${Y.aiGatewayUrl}${$}`,{method:"POST",headers:{Authorization:`Bearer ${Y.aiGatewayAdminToken}`,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:AbortSignal.timeout(15000)}),J=await X.text().catch(()=>"");if(!X.ok){let G=X.status>=400&&X.status<500&&X.status!==408&&X.status!==429,W=`${Q} failed (${X.status}): ${J}`;throw G?new vi(X.status,W):Error(W)}}async function bi($){let Z=j0();if(!Z.aiGatewayEnabled)return;if(!Z.aiGatewayAdminToken)throw Error("DECO_AI_GATEWAY_ADMIN_TOKEN is not set \u2014 cannot place the gateway plan");await vc$("/api/admin/plans",{orgId:$.organizationId,planId:$.planId,note:$.note},"gateway plan change")}async function bc$($){if(!B40())throw Error("gateway admin not configured \u2014 cannot credit top-up");await vc$("/api/admin/credits",{orgId:$.organizationId,amountCents:$.amountCents,description:"Studio credit top-up (Stripe)",referenceId:$.referenceId},"gateway top-up credit")}var vi;var D40=D(()=>{s1();vi=class vi extends Error{status;constructor($,Z){super(Z);this.status=$;this.name="GatewayAdminPermanentError"}}});import xi from"zod";var PX6=1e6,I31;var xc$=D(()=>{D40();LD();k9();s1();S0();dH();VW();hK();I31=c({name:"AI_PROVIDER_TOPUP_URL",description:"Get a checkout URL to top up credits for a provider that supports it (e.g. Deco AI Gateway)",requiresFeature:"credits",inputSchema:xi.object({providerId:xi.enum(vZ),amountCents:xi.number().int().positive().max(PX6).describe("Amount in cents (e.g. 1000 = $10.00), max $10,000.00"),currency:xi.enum(["usd","brl"]).default("usd")}),outputSchema:xi.object({url:xi.string().describe("Checkout URL \u2014 open in browser to complete payment")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=j0();if($.providerId==="deco"&&X.stripeSecretKey&&B40()&&Q.slug){let K=await Z.storage.organizationBilling.getBilling(Q.id),H=`${c5()}${Dj(Q.slug)}`,{url:F}=await vL$({organizationId:Q.id,amountCents:$.amountCents,currency:$.currency,feePercent:X.topupFeePercent,customerId:K?.stripeCustomerId??null,successUrl:`${H}?topup=success`,cancelUrl:`${H}?topup=canceled`});return{url:F}}let J=O9()[$.providerId];if(!J)throw Error(`Unknown provider: ${$.providerId}`);if(!J.getTopUpUrl)throw Error(`Provider ${$.providerId} does not support credit top-ups`);let G=await r7(Y,Z.auth.user?.email);return{url:await J.getTopUpUrl(G,Q.id,$.amountCents,$.currency)}}})});import gI0 from"zod";function AX6($){return Number.isFinite($)}var V31;var fc$=D(()=>{S0();dH();VW();hK();V31=c({name:"AI_PROVIDER_CREDITS",description:"Get the current credit balance for a provider (providers that support it, e.g. Deco AI Gateway)",inputSchema:gI0.object({providerId:gI0.enum(vZ)}),outputSchema:gI0.object({balanceCents:gI0.number().describe("Remaining balance in cents (e.g. 1000 = $10.00)")}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.getCreditsBalance)throw Error(`Provider ${$.providerId} does not expose a credits balance`);let J=await r7(Y),G=await X.getCreditsBalance(J,Q.id);if(!AX6(G.balanceCents))throw console.error(`AI provider "${$.providerId}" returned a non-finite credits balance for org ${Q.id}: ${G.balanceCents}`),Error(`Provider ${$.providerId} returned an invalid credits balance`);return G}})});function yc$($){return{plan:$.plan,features:$.features,usage:$.usage,credits:$.credits,tasks:$.tasks,periodStart:$.periodStart,periodEnd:$.periodEnd}}import qZ from"zod";var k31;var gc$=D(()=>{S0();dH();VW();hK();k31=c({name:"AI_PLAN_ENTITLEMENTS",description:"Get the organization's plan, its feature flags and the AI usage bar (a percentage, never a dollar amount)",inputSchema:qZ.object({providerId:qZ.enum(vZ)}),outputSchema:qZ.object({plan:qZ.object({id:qZ.string(),name:qZ.string()}),features:qZ.record(qZ.string(),qZ.boolean()),usage:qZ.object({percent:qZ.number(),state:qZ.enum(["ok","warn","exhausted"]),usedMicros:qZ.number().nullable(),limitMicros:qZ.number().nullable()}).nullable(),credits:qZ.object({remainingUsd:qZ.number()}).nullable(),tasks:qZ.object({allowed:qZ.boolean(),remaining:qZ.number().nullable(),denyReason:qZ.string().nullable()}),periodStart:qZ.string().nullable(),periodEnd:qZ.string().nullable()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X)throw Error(`Unknown provider: ${$.providerId}`);if(!X.getEntitlements)throw Error(`Provider ${$.providerId} does not expose plans`);let J=await r7(Y);return yc$(await X.getEntitlements(J,Q.id))}})});function C31($){if(lc$=$,S31)return;let Z=$();if(!Z)return;S31=Z.subscribe(hc$);let Q=new TextDecoder;(async()=>{for await(let Y of S31)try{let X=JSON.parse(Q.decode(Y.data));if(typeof X.organizationId!=="string")continue;if(X.originId===uc$)continue;W$1(X.organizationId)}catch{}})()}function Ry($){W$1($);try{let Z=lc$?.()??null;if(!Z)return;let Q={originId:uc$,organizationId:$};Z.publish(hc$,TX6.encode(JSON.stringify(Q)))}catch(Z){console.warn("[plans] cross-pod cache invalidation failed to publish",{organizationId:$,error:Z instanceof Error?Z.message:String(Z)})}}var hc$="studio.plans.invalidate",uc$,lc$=null,S31=null,TX6;var L40=D(()=>{jH();uc$=crypto.randomUUID(),TX6=new TextEncoder});import l9 from"zod";function qX6($){if(!$.plansEnabled)return"Plans are not enabled on this deployment.";if(!$.entitlements)return"Could not read this organization's plan.";if($.entitlements.features.invoice_upgrade!==!0)return"This organization cannot add a plan to its invoice.";if($.subscriptionBound)return"This organization has an active subscription \u2014 change plans through billing.";if($.entitlements.planId===$.targetPlanId)return"This organization is already on that plan.";return null}var RX6,_31,v31,b31;var cc$=D(()=>{S0();dH();VW();hK();L40();D40();s1();$6();RX6=l9.object({id:l9.string(),name:l9.string(),features:l9.record(l9.string(),l9.boolean())}),_31=c({name:"AI_PLAN_LIST",description:"List the plans an organization can move to",inputSchema:l9.object({providerId:l9.enum(vZ)}),outputSchema:l9.object({plans:l9.array(RX6)}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=O9()[$.providerId];if(!X?.listPlans)throw Error(`Provider ${$.providerId} does not expose plans`);let J=await r7(Y);return{plans:await X.listPlans(J,Q.id)}}}),v31=c({name:"AI_PLAN_SET",description:"Drop the organization back to the free tier. Paid plans are granted by subscribing (ORGANIZATION_BILLING_CHECKOUT_START), never here.",inputSchema:l9.object({providerId:l9.enum(vZ),planId:l9.literal("free")}),outputSchema:l9.object({plan:l9.object({id:l9.string(),name:l9.string()}),features:l9.record(l9.string(),l9.boolean())}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");if((await Z.storage.organizationBilling.getBilling(Q.id))?.stripeSubscriptionId)throw Error("This organization has an active subscription \u2014 cancel it in billing first; the plan drops to free when it ends.");let J=O9()[$.providerId];if(!J?.setPlan)throw Error(`Provider ${$.providerId} does not expose plans`);let G=await r7(Y),W=await J.setPlan(G,Q.id,$.planId);return Ry(Q.id),{plan:W.plan,features:W.features}}});b31=c({name:"AI_PLAN_INVOICE_UPGRADE",description:"Move the organization to a paid plan now, billed on its next deco invoice. Only for organizations deco enabled for invoice billing.",inputSchema:l9.object({planId:l9.enum(["starter","business"])}),outputSchema:l9.object({planId:l9.string()}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=g0(Z);if(!Y)throw Error("Unable to determine user ID");let X=j0().plansEnabled&&B40(),J=await Z.storage.organizationBilling.getBilling(Q.id),G=O9().deco,W=null;if(X&&G?.getEntitlements){let F=await G.getEntitlements(await r7(Y),Q.id);if(F.features&&typeof F.features==="object")W={planId:F.plan.id,features:F.features}}let K=qX6({plansEnabled:X,entitlements:W,subscriptionBound:!!J?.stripeSubscriptionId,targetPlanId:$.planId});if(K||!W)throw Error(K??"Could not read this organization's plan.");let H=Z.auth.user?.email??Y;return await bi({organizationId:Q.id,planId:$.planId,note:`invoice upgrade by ${H} at ${new Date().toISOString()} \u2014 bill on next invoice`}),Ry(Q.id),$Q({event:"plan_invoice_upgrade",organizationId:Q.id,userId:Y,properties:{plan_id:$.planId,previous_plan_id:W.planId,org_slug:Q.slug,org_name:Q.name}}),{planId:$.planId}}})});var mc$=D(()=>{jc$();Ec$();zc$();U40();Pc$();Ac$();Tc$();Rc$();kc$();Sc$();_c$();xc$();fc$();gc$();cc$()});import hE from"zod";function VX6($){let Z=$.trim();if(Z.startsWith(IX6))throw Error("That looks like a Console API key, which bills per-token API usage instead of your subscription. Run `claude setup-token` and paste the token it prints.");if(/\s/.test(Z))throw Error("The token must not contain spaces or line breaks");if(Z.length===0)throw Error("The token must not be empty");return Z}var x31,IX6="sk-ant-api",dc$,ic$,pc$;var nc$=D(()=>{S0();x31=hE.object({connected:hE.boolean(),linkedAt:hE.string().nullable(),expiresAt:hE.string().nullable().describe("Known expiry, or null when the token carries none we can read")});dc$=c({name:"CLAUDE_SUBSCRIPTION_CONNECT",description:"Link the caller's Claude subscription with a token from `claude setup-token`, so their claude-code runs bill against their own Pro/Max plan. Stored encrypted, for the caller only.",inputSchema:hE.object({token:hE.string().min(1).describe("The token printed by `claude setup-token` (sk-ant-oat\u2026)")}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");let Y=VX6($.token);return{connected:!0,...await Z.storage.claudeSubscriptions.upsert({userId:Q,accessToken:Y})}}}),ic$=c({name:"CLAUDE_SUBSCRIPTION_STATUS",description:"Whether the caller has a linked Claude subscription token, and since when.",inputSchema:hE.object({}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");let Y=await Z.storage.claudeSubscriptions.find(Q);if(!Y)return{connected:!1,linkedAt:null,expiresAt:null};return{connected:!(Y.expiresAt!==null&&new Date(Y.expiresAt)<=new Date),...Y}}}),pc$=c({name:"CLAUDE_SUBSCRIPTION_DISCONNECT",description:"Unlink the caller's Claude subscription and delete the stored token.",inputSchema:hE.object({}),outputSchema:x31,handler:async($,Z)=>{n(Z),X0(Z),await Z.access.check();let Q=g0(Z);if(!Q)throw Error("Unable to determine user ID");return await Z.storage.claudeSubscriptions.delete(Q),{connected:!1,linkedAt:null,expiresAt:null}}})});import NN from"zod";var hI0;var f31=D(()=>{hI0=NN.object({id:NN.string(),scope:NN.enum(["user","organization"]),userId:NN.string().nullable(),name:NN.string(),description:NN.string().nullable(),createdBy:NN.string(),createdAt:NN.string(),updatedBy:NN.string(),updatedAt:NN.string()})});import O40 from"zod";var SX6=65536,y31;var tc$=D(()=>{S0();f31();y31=c({name:"SECRET_CREATE",description:"Create a secret. The value is encrypted at rest in the credential vault and never returned by any tool. Scope 'user' is private to the caller within this organization; scope 'organization' is visible to all org members.",inputSchema:O40.object({scope:O40.enum(["user","organization"]),name:O40.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/,{message:"Name may only contain letters, digits, underscore, dot, and hyphen."}),value:O40.string().min(1).max(SX6),description:O40.string().max(500).optional()}),outputSchema:hI0,handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=Z.auth.user.id,X=$.scope==="user"?{kind:"user",userId:Y}:{kind:"organization"};return await Z.storage.secrets.create({organizationId:Q.id,scope:X,name:$.name,value:$.value,description:$.description??null,createdBy:Y})}})});import uI0 from"zod";var g31;var oc$=D(()=>{S0();f31();g31=c({name:"SECRET_LIST",description:"List secrets visible to the caller: all organization-scoped secrets, plus user-scoped secrets owned by the caller. Values are never returned.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:uI0.object({scope:uI0.enum(["user","organization"]).optional()}),outputSchema:uI0.object({secrets:uI0.array(hI0)}),handler:async($,Z)=>{n(Z);let Q=X0(Z);await Z.access.check();let Y=Z.auth.user.id,X=$.scope==="user"?{kind:"user",userId:Y}:$.scope==="organization"?{kind:"organization"}:void 0;return{secrets:await Z.storage.secrets.list({organizationId:Q.id,callerUserId:Y,scope:X})}}})});var rc$=D(()=>{tc$();oc$()});var qy=b((yX6)=>{var h31;(function($){$.HEADER="header",$.QUERY="query"})(h31||(h31={}));var u31;(function($){$.HEADER="header",$.QUERY="query"})(u31||(u31={}));var l31;(function($){$.HTTP="http",$.HTTPS="https"})(l31||(l31={}));var w40;(function($){$.MD5="md5",$.CRC32="crc32",$.CRC32C="crc32c",$.SHA1="sha1",$.SHA256="sha256"})(w40||(w40={}));var _X6=($)=>{let Z=[];if($.sha256!==void 0)Z.push({algorithmId:()=>w40.SHA256,checksumConstructor:()=>$.sha256});if($.md5!=null)Z.push({algorithmId:()=>w40.MD5,checksumConstructor:()=>$.md5});return{addChecksumAlgorithm(Q){Z.push(Q)},checksumAlgorithms(){return Z}}},vX6=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{Z[Q.algorithmId()]=Q.checksumConstructor()}),Z},bX6=($)=>{return _X6($)},xX6=($)=>{return vX6($)},c31;(function($){$[$.HEADER=0]="HEADER",$[$.TRAILER=1]="TRAILER"})(c31||(c31={}));var fX6="__smithy_context",m31;(function($){$.PROFILE="profile",$.SSO_SESSION="sso-session",$.SERVICES="services"})(m31||(m31={}));var d31;(function($){$.HTTP_0_9="http/0.9",$.HTTP_1_0="http/1.0",$.TDS_8_0="tds/8.0"})(d31||(d31={}));yX6.AlgorithmId=w40;yX6.EndpointURLScheme=l31;yX6.FieldPosition=c31;yX6.HttpApiKeyAuthLocation=u31;yX6.HttpAuthLocation=h31;yX6.IniSectionType=m31;yX6.RequestHandlerProtocol=d31;yX6.SMITHY_CONTEXT_KEY=fX6;yX6.getDefaultClientConfiguration=bX6;yX6.resolveDefaultRuntimeConfig=xX6});var BN=b(($J6)=>{var{SMITHY_CONTEXT_KEY:sc$}=qy(),tX6=($)=>$[sc$]||($[sc$]={});class lI0{method;protocol;hostname;port;path;query;headers;username;password;fragment;body;constructor($){this.method=$.method||"GET",this.hostname=$.hostname||"localhost",this.port=$.port,this.query=$.query||{},this.headers=$.headers||{},this.body=$.body,this.protocol=$.protocol?$.protocol.slice(-1)!==":"?`${$.protocol}:`:$.protocol:"https:",this.path=$.path?$.path.charAt(0)!=="/"?`/${$.path}`:$.path:"/",this.username=$.username,this.password=$.password,this.fragment=$.fragment}static clone($){let Z=new lI0({...$,headers:{...$.headers}});if(Z.query)Z.query=oX6(Z.query);return Z}static isInstance($){if(!$)return!1;let Z=$;return"method"in Z&&"protocol"in Z&&"hostname"in Z&&"path"in Z&&typeof Z.query==="object"&&typeof Z.headers==="object"}clone(){return lI0.clone(this)}}function oX6($){return Object.keys($).reduce((Z,Q)=>{let Y=$[Q];return{...Z,[Q]:Array.isArray(Y)?[...Y]:Y}},{})}class ac${statusCode;reason;headers;body;constructor($){this.statusCode=$.statusCode,this.reason=$.reason,this.headers=$.headers||{},this.body=$.body}static isInstance($){if(!$)return!1;let Z=$;return typeof Z.statusCode==="number"&&typeof Z.headers==="object"}}var rX6=new RegExp("^(?!.*-$)(?!-)[a-zA-Z0-9-]{1,63}$"),ec$=($,Z=!1)=>{if(!Z)return rX6.test($);let Q=$.split(".");for(let Y of Q)if(!ec$(Y))return!1;return!0};function sX6($){return/^[a-z0-9][a-z0-9\.\-]*[a-z0-9]$/.test($)}var aX6=($)=>{if(typeof $==="function")return $;let Z=Promise.resolve($);return()=>Z};function $m$($){let Z={};if($=$.replace(/^\?/,""),$)for(let Q of $.split("&")){let[Y,X=null]=Q.split("=");if(Y=decodeURIComponent(Y),X)X=decodeURIComponent(X);if(!(Y in Z))Z[Y]=X;else if(Array.isArray(Z[Y]))Z[Y].push(X);else Z[Y]=[Z[Y],X]}return Z}var cI0=($)=>{if(typeof $==="string")return cI0(new URL($));let{hostname:Z,pathname:Q,port:Y,protocol:X,search:J}=$,G;if(J)G=$m$(J);return{hostname:Z,port:Y?parseInt(Y):void 0,protocol:X,path:Q,query:G}},eX6=($)=>{if(typeof $==="object"){if("url"in $){let Z=cI0($.url);if($.headers){Z.headers={};for(let Q in $.headers)Z.headers[Q.toLowerCase()]=$.headers[Q].join(", ")}return Z}return $}return cI0($)};$J6.HttpRequest=lI0;$J6.HttpResponse=ac$;$J6.getSmithyContext=tX6;$J6.isValidHostLabel=ec$;$J6.isValidHostname=sX6;$J6.normalizeProvider=aX6;$J6.parseQueryString=$m$;$J6.parseUrl=cI0;$J6.toEndpointV1=eX6});var nH=b((TJ6)=>{var{getSmithyContext:Zm$,HttpResponse:FJ6,toEndpointV1:UJ6}=BN(),mI0=($)=>{if(typeof $==="function")return $();return $},n31=($,Z,Q,Y,X)=>({name:Z,namespace:$,traits:Q,input:Y,output:X}),NJ6=($)=>(Z,Q)=>async(Y)=>{let{response:X}=await Z(Y),{operationSchema:J}=Zm$(Q),[,G,W,K,H,F]=J??[];try{let U=await $.protocol.deserializeResponse(n31(G,W,K,H,F),{...$,...Q},X);return{response:X,output:U}}catch(U){if(Object.defineProperty(U,"$response",{value:X,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in U)){try{U.message+=`
   Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.`}catch(B){if(!Q.logger||Q.logger?.constructor?.name==="NoOpLogger")console.warn("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.");else Q.logger?.warn?.("Deserialization error: to see the raw response, inspect the hidden field {error}.$response on this object.")}if(typeof U.$responseBodyText<"u"){if(U.$response)U.$response.body=U.$responseBodyText}try{if(FJ6.isInstance(X)){let{headers:B={},statusCode:L}=X,O=Object.entries(B);U.$metadata={httpStatusCode:L,requestId:i31(/^x-[\w-]+-request-?id$/,O),extendedRequestId:i31(/^x-[\w-]+-id-2$/,O),cfId:i31(/^x-[\w-]+-cf-id$/,O)}}}catch(B){}}throw U}},i31=($,Z)=>{return(Z.find(([Q])=>{return Q.match($)})||[void 0,void 0])[1]},BJ6=($)=>(Z,Q)=>async(Y)=>{let{operationSchema:X}=Zm$(Q),[,J,G,W,K,H]=X??[],F=Q.endpointV2?async()=>UJ6(Q.endpointV2):$.endpoint,U=await $.protocol.serializeRequest(n31(J,G,W,K,H),Y.input,{...$,...Q,endpoint:F});return Z({...Y,request:U})},Qm$={name:"deserializerMiddleware",step:"deserialize",tags:["DESERIALIZER"],override:!0},Ym$={name:"serializerMiddleware",step:"serialize",tags:["SERIALIZER"],override:!0};function DJ6($){return{applyToStack:(Z)=>{Z.add(BJ6($),Ym$),Z.add(NJ6($),Qm$),$.protocol.setSerdeContext($)}}}class UG{name;namespace;traits;static assign($,Z){return Object.assign($,Z)}static[Symbol.hasInstance]($){let Z=this.prototype.isPrototypeOf($);if(!Z&&typeof $==="object"&&$!==null)return $.symbol===this.symbol;return Z}getName(){return this.namespace+"#"+this.name}}class nI0 extends UG{static symbol=Symbol.for("@smithy/lis");name;traits;valueSchema;symbol=nI0.symbol}var LJ6=($,Z,Q,Y)=>UG.assign(new nI0,{name:Z,namespace:$,traits:Q,valueSchema:Y});class tI0 extends UG{static symbol=Symbol.for("@smithy/map");name;traits;keySchema;valueSchema;symbol=tI0.symbol}var OJ6=($,Z,Q,Y,X)=>UG.assign(new tI0,{name:Z,namespace:$,traits:Q,keySchema:Y,valueSchema:X});class oI0 extends UG{static symbol=Symbol.for("@smithy/ope");name;traits;input;output;symbol=oI0.symbol}var wJ6=($,Z,Q,Y,X)=>UG.assign(new oI0,{name:Z,namespace:$,traits:Q,input:Y,output:X});class P40 extends UG{static symbol=Symbol.for("@smithy/str");name;traits;memberNames;memberList;symbol=P40.symbol}var jJ6=($,Z,Q,Y,X)=>UG.assign(new P40,{name:Z,namespace:$,traits:Q,memberNames:Y,memberList:X});class rI0 extends P40{static symbol=Symbol.for("@smithy/err");ctor;symbol=rI0.symbol}var EJ6=($,Z,Q,Y,X,J)=>UG.assign(new rI0,{name:Z,namespace:$,traits:Q,memberNames:Y,memberList:X,ctor:null}),dI0=[];function z40($){if(typeof $==="object")return $;if($=$|0,dI0[$])return dI0[$];let Z={},Q=0;for(let Y of["httpLabel","idempotent","idempotencyToken","sensitive","httpPayload","httpResponseCode","httpQueryParams"])if(($>>Q++&1)===1)Z[Y]=1;return dI0[$]=Z}var j40={it:Symbol.for("@smithy/nor-struct-it"),ns:Symbol.for("@smithy/ns")},iI0=[],pI0={};class QL{ref;memberName;static symbol=Symbol.for("@smithy/nor");symbol=QL.symbol;name;schema;_isMemberSchema;traits;memberTraits;normalizedTraits;constructor($,Z){this.ref=$,this.memberName=Z;let Q=[],Y=$,X=$;this._isMemberSchema=!1;while(p31(Y))Q.push(Y[1]),Y=Y[0],X=mI0(Y),this._isMemberSchema=!0;if(Q.length>0){this.memberTraits={};for(let J=Q.length-1;J>=0;--J){let G=Q[J];Object.assign(this.memberTraits,z40(G))}}else this.memberTraits=0;if(X instanceof QL){let J=this.memberTraits;Object.assign(this,X),this.memberTraits=Object.assign({},J,X.getMemberTraits(),this.getMemberTraits()),this.normalizedTraits=void 0,this.memberName=Z??X.memberName;return}if(this.schema=mI0(X),Xm$(this.schema))this.name=`${this.schema[1]}#${this.schema[2]}`,this.traits=this.schema[3];else this.name=this.memberName??String(X),this.traits=0;if(this._isMemberSchema&&!Z)throw Error(`@smithy/core/schema - NormalizedSchema member init ${this.getName(!0)} missing member name.`)}static[Symbol.hasInstance]($){let Z=this.prototype.isPrototypeOf($);if(!Z&&typeof $==="object"&&$!==null)return $.symbol===this.symbol;return Z}static of($){let Z=typeof $==="function"||typeof $==="object"&&$!==null;if(typeof $==="number"){if(iI0[$])return iI0[$]}else if(typeof $==="string"){if(pI0[$])return pI0[$]}else if(Z){if($[j40.ns])return $[j40.ns]}let Q=mI0($);if(Q instanceof QL)return Q;if(p31(Q)){let[X,J]=Q;if(X instanceof QL)return Object.assign(X.getMergedTraits(),z40(J)),X;throw Error(`@smithy/core/schema - may not init unwrapped member schema=${JSON.stringify($,null,2)}.`)}let Y=new QL(Q);if(Z)return $[j40.ns]=Y;if(typeof Q==="string")return pI0[Q]=Y;if(typeof Q==="number")return iI0[Q]=Y;return Y}getSchema(){let $=this.schema;if(Array.isArray($)&&$[0]===0)return $[4];return $}getName($=!1){let{name:Z}=this;return!$&&Z&&Z.includes("#")?Z.split("#")[1]:Z||void 0}getMemberName(){return this.memberName}isMemberSchema(){return this._isMemberSchema}isListSchema(){let $=this.getSchema();return typeof $==="number"?$>=64&&$<128:$[0]===1}isMapSchema(){let $=this.getSchema();return typeof $==="number"?$>=128&&$<=255:$[0]===2}isStructSchema(){let $=this.getSchema();if(typeof $!=="object")return!1;let Z=$[0];return Z===3||Z===-3||Z===4}isUnionSchema(){let $=this.getSchema();if(typeof $!=="object")return!1;return $[0]===4}isBlobSchema(){let $=this.getSchema();return $===21||$===42}isTimestampSchema(){let $=this.getSchema();return typeof $==="number"&&$>=4&&$<=7}isUnitSchema(){return this.getSchema()==="unit"}isDocumentSchema(){return this.getSchema()===15}isStringSchema(){return this.getSchema()===0}isBooleanSchema(){return this.getSchema()===2}isNumericSchema(){return this.getSchema()===1}isBigIntegerSchema(){return this.getSchema()===17}isBigDecimalSchema(){return this.getSchema()===19}isStreaming(){let{streaming:$}=this.getMergedTraits();return!!$||this.getSchema()===42}isIdempotencyToken(){return!!this.getMergedTraits().idempotencyToken}getMergedTraits(){return this.normalizedTraits??(this.normalizedTraits={...this.getOwnTraits(),...this.getMemberTraits()})}getMemberTraits(){return z40(this.memberTraits)}getOwnTraits(){return z40(this.traits)}getKeySchema(){let[$,Z]=[this.isDocumentSchema(),this.isMapSchema()];if(!$&&!Z)throw Error(`@smithy/core/schema - cannot get key for non-map: ${this.getName(!0)}`);let Q=this.getSchema(),Y=$?15:Q[4]??0;return E40([Y,0],"key")}getValueSchema(){let $=this.getSchema(),[Z,Q,Y]=[this.isDocumentSchema(),this.isMapSchema(),this.isListSchema()],X=typeof $==="number"?63&$:$&&typeof $==="object"&&(Q||Y)?$[3+$[0]]:Z?15:void 0;if(X!=null)return E40([X,0],Q?"value":"member");throw Error(`@smithy/core/schema - ${this.getName(!0)} has no value member.`)}getMemberSchema($){let Z=this.getSchema();if(this.isStructSchema()&&Z[4].includes($)){let Q=Z[4].indexOf($),Y=Z[5][Q];return E40(p31(Y)?Y:[Y,0],$)}if(this.isDocumentSchema())return E40([15,0],$);throw Error(`@smithy/core/schema - ${this.getName(!0)} has no member=${$}.`)}getMemberSchemas(){let $={};try{for(let[Z,Q]of this.structIterator())$[Z]=Q}catch(Z){}return $}getEventStreamMember(){if(this.isStructSchema()){for(let[$,Z]of this.structIterator())if(Z.isStreaming()&&Z.isStructSchema())return $}return""}*structIterator(){if(this.isUnitSchema())return;if(!this.isStructSchema())throw Error("@smithy/core/schema - cannot iterate non-struct schema.");let $=this.getSchema(),Z=$[4].length,Q=$[j40.it];if(Q&&Z===Q.length){yield*Q;return}Q=Array(Z);for(let Y=0;Y<Z;++Y){let X=$[4][Y],J=E40([$[5][Y],0],X);yield Q[Y]=[X,J]}$[j40.it]=Q}}function E40($,Z){if($ instanceof QL)return Object.assign($,{memberName:Z,_isMemberSchema:!0});return new QL($,Z)}var p31=($)=>Array.isArray($)&&$.length===2,Xm$=($)=>Array.isArray($)&&$.length>=5;class A40 extends UG{static symbol=Symbol.for("@smithy/sim");name;schemaRef;traits;symbol=A40.symbol}var zJ6=($,Z,Q,Y)=>UG.assign(new A40,{name:Z,namespace:$,traits:Y,schemaRef:Q}),PJ6=($,Z,Q,Y)=>UG.assign(new A40,{name:Z,namespace:$,traits:Q,schemaRef:Y}),AJ6={BLOB:21,STREAMING_BLOB:42,BOOLEAN:2,STRING:0,NUMERIC:1,BIG_INTEGER:17,BIG_DECIMAL:19,DOCUMENT:15,TIMESTAMP_DEFAULT:4,TIMESTAMP_DATE_TIME:5,TIMESTAMP_HTTP_DATE:6,TIMESTAMP_EPOCH_SECONDS:7,LIST_MODIFIER:64,MAP_MODIFIER:128};class ZL{namespace;schemas;exceptions;static registries=new Map;constructor($,Z=new Map,Q=new Map){this.namespace=$,this.schemas=Z,this.exceptions=Q}static for($){if(!ZL.registries.has($))ZL.registries.set($,new ZL($));return ZL.registries.get($)}copyFrom($){let{schemas:Z,exceptions:Q}=this;for(let[Y,X]of $.schemas)if(!Z.has(Y))Z.set(Y,X);for(let[Y,X]of $.exceptions)if(!Q.has(Y))Q.set(Y,X)}register($,Z){let Q=this.normalizeShapeId($);for(let Y of[this,ZL.for(Q.split("#")[0])])Y.schemas.set(Q,Z)}getSchema($){let Z=this.normalizeShapeId($);if(!this.schemas.has(Z)){if(!$.includes("#")){let Q="#"+$,Y=[];for(let[X,J]of this.schemas.entries())if(X.endsWith(Q))Y.push(J);if(Y.length===1)return Y[0]}throw Error(`@smithy/core/schema - schema not found for ${Z}`)}return this.schemas.get(Z)}registerError($,Z){let Q=$,Y=Q[1];for(let X of[this,ZL.for(Y)])X.schemas.set(Y+"#"+Q[2],Q),X.exceptions.set(Q,Z)}getErrorCtor($){let Z=$;if(this.exceptions.has(Z))return this.exceptions.get(Z);return ZL.for(Z[1]).exceptions.get(Z)}getBaseException(){for(let $ of this.exceptions.keys())if(Array.isArray($)){let[,Z,Q]=$,Y=Z+"#"+Q;if(Y.startsWith("smithy.ts.sdk.synthetic.")&&Y.endsWith("ServiceException"))return $}return}find($){for(let Z of this.schemas.values())if($(Z))return Z;return}clear(){this.schemas.clear(),this.exceptions.clear()}normalizeShapeId($){if($.includes("#"))return $;return this.namespace+"#"+$}}TJ6.ErrorSchema=rI0;TJ6.ListSchema=nI0;TJ6.MapSchema=tI0;TJ6.NormalizedSchema=QL;TJ6.OperationSchema=oI0;TJ6.SCHEMA=AJ6;TJ6.Schema=UG;TJ6.SimpleSchema=A40;TJ6.StructureSchema=P40;TJ6.TypeRegistry=ZL;TJ6.deref=mI0;TJ6.deserializerMiddlewareOption=Qm$;TJ6.error=EJ6;TJ6.getSchemaSerdePlugin=DJ6;TJ6.isStaticSchema=Xm$;TJ6.list=LJ6;TJ6.map=OJ6;TJ6.op=wJ6;TJ6.operation=n31;TJ6.serializerMiddlewareOption=Ym$;TJ6.sim=zJ6;TJ6.simAdapter=PJ6;TJ6.simpleSchemaCacheN=iI0;TJ6.simpleSchemaCacheS=pI0;TJ6.struct=jJ6;TJ6.traitsCache=dI0;TJ6.translateTraits=z40});var o5=b((kG6)=>{var{getSmithyContext:sJ6,normalizeProvider:aJ6}=BN();kG6.getSmithyContext=sJ6;kG6.normalizeProvider=aJ6;var{SMITHY_CONTEXT_KEY:eJ6,AlgorithmId:aI0}=qy();kG6.AlgorithmId=aI0;var{NormalizedSchema:$G6}=nH(),My=($,Z)=>{let Q=[];if($)Q.push($);if(Z)for(let Y of Z)Q.push(Y);return Q},uE=($,Z)=>{return`${$||"anonymous"}${Z&&Z.length>0?` (a.k.a. ${Z.join(",")})`:""}`},T40=()=>{let $=[],Z=[],Q=!1,Y=new Set,X=(U)=>U.sort((N,B)=>Jm$[B.step]-Jm$[N.step]||Gm$[B.priority||"normal"]-Gm$[N.priority||"normal"]),J=(U)=>{let N=!1,B=(L)=>{let O=My(L.name,L.aliases);if(O.includes(U)){N=!0;for(let w of O)Y.delete(w);return!1}return!0};return $=$.filter(B),Z=Z.filter(B),N},G=(U)=>{let N=!1,B=(L)=>{if(L.middleware===U){N=!0;for(let O of My(L.name,L.aliases))Y.delete(O);return!1}return!0};return $=$.filter(B),Z=Z.filter(B),N},W=(U)=>{return $.forEach((N)=>{U.add(N.middleware,{...N})}),Z.forEach((N)=>{U.addRelativeTo(N.middleware,{...N})}),U.identifyOnResolve?.(F.identifyOnResolve()),U},K=(U)=>{let N=[];return U.before.forEach((B)=>{if(B.before.length===0&&B.after.length===0)N.push(B);else N.push(...K(B))}),N.push(U),U.after.reverse().forEach((B)=>{if(B.before.length===0&&B.after.length===0)N.push(B);else N.push(...K(B))}),N},H=(U=!1)=>{let N=[],B=[],L={};return $.forEach((w)=>{let j={...w,before:[],after:[]};for(let E of My(j.name,j.aliases))L[E]=j;N.push(j)}),Z.forEach((w)=>{let j={...w,before:[],after:[]};for(let E of My(j.name,j.aliases))L[E]=j;B.push(j)}),B.forEach((w)=>{if(w.toMiddleware){let j=L[w.toMiddleware];if(j===void 0){if(U)return;throw Error(`${w.toMiddleware} is not found when adding ${uE(w.name,w.aliases)} middleware ${w.relation} ${w.toMiddleware}`)}if(w.relation==="after")j.after.push(w);if(w.relation==="before")j.before.push(w)}}),X(N).map(K).reduce((w,j)=>{return w.push(...j),w},[])},F={add:(U,N={})=>{let{name:B,override:L,aliases:O}=N,w={step:"initialize",priority:"normal",middleware:U,...N},j=My(B,O);if(j.length>0){if(j.some((E)=>Y.has(E))){if(!L)throw Error(`Duplicate middleware name '${uE(B,O)}'`);for(let E of j){let z=$.findIndex((P)=>P.name===E||P.aliases?.some((A)=>A===E));if(z===-1)continue;let T=$[z];if(T.step!==w.step||w.priority!==T.priority)throw Error(`"${uE(T.name,T.aliases)}" middleware with ${T.priority} priority in ${T.step} step cannot be overridden by "${uE(B,O)}" middleware with ${w.priority} priority in ${w.step} step.`);$.splice(z,1)}}for(let E of j)Y.add(E)}$.push(w)},addRelativeTo:(U,N)=>{let{name:B,override:L,aliases:O}=N,w={middleware:U,...N},j=My(B,O);if(j.length>0){if(j.some((E)=>Y.has(E))){if(!L)throw Error(`Duplicate middleware name '${uE(B,O)}'`);for(let E of j){let z=Z.findIndex((P)=>P.name===E||P.aliases?.some((A)=>A===E));if(z===-1)continue;let T=Z[z];if(T.toMiddleware!==w.toMiddleware||T.relation!==w.relation)throw Error(`"${uE(T.name,T.aliases)}" middleware ${T.relation} "${T.toMiddleware}" middleware cannot be overridden by "${uE(B,O)}" middleware ${w.relation} "${w.toMiddleware}" middleware.`);Z.splice(z,1)}}for(let E of j)Y.add(E)}Z.push(w)},clone:()=>W(T40()),use:(U)=>{U.applyToStack(F)},remove:(U)=>{if(typeof U==="string")return J(U);else return G(U)},removeByTag:(U)=>{let N=!1,B=(L)=>{let{tags:O,name:w,aliases:j}=L;if(O&&O.includes(U)){let E=My(w,j);for(let z of E)Y.delete(z);return N=!0,!1}return!0};return $=$.filter(B),Z=Z.filter(B),N},concat:(U)=>{let N=W(T40());return N.use(U),N.identifyOnResolve(Q||N.identifyOnResolve()||(U.identifyOnResolve?.()??!1)),N},applyToStack:W,identify:()=>{return H(!0).map((U)=>{let N=U.step??U.relation+" "+U.toMiddleware;return uE(U.name,U.aliases)+" - "+N})},identifyOnResolve(U){if(typeof U==="boolean")Q=U;return Q},resolve:(U,N)=>{for(let B of H().map((L)=>L.middleware).reverse())U=B(U,N);if(Q)console.log(F.identify());return U}};return F},Jm$={initialize:5,serialize:4,build:3,finalizeRequest:2,deserialize:1},Gm$={high:3,normal:2,low:1},ZG6=($)=>()=>{throw Error($)},QG6=($)=>()=>Promise.reject($),sI0=()=>{let $=new WeakSet;return(Z,Q)=>{if(typeof Q==="object"&&Q!==null){if($.has(Q))return"[Circular]";$.add(Q)}return Q}},YG6=($)=>{return new Promise((Z)=>setTimeout(Z,$*1000))},Hm$={minDelay:2,maxDelay:120},DN;(function($){$.ABORTED="ABORTED",$.FAILURE="FAILURE",$.SUCCESS="SUCCESS",$.RETRY="RETRY",$.TIMEOUT="TIMEOUT"})(DN||(DN={}));var XG6=($)=>{if($.state===DN.ABORTED){let Z=Error(`${JSON.stringify({...$,reason:"Request was aborted"},sI0())}`);throw Z.name="AbortError",Z}else if($.state===DN.TIMEOUT){let Z=Error(`${JSON.stringify({...$,reason:"Waiter has timed out"},sI0())}`);throw Z.name="TimeoutError",Z}else if($.state!==DN.SUCCESS)throw Error(`${JSON.stringify($,sI0())}`);return $},JG6=async({minDelay:$,maxDelay:Z,maxWaitTime:Q,abortController:Y,client:X,abortSignal:J},G,W)=>{let K={},[H,F]=[$*1000,Z*1000],U=0,N=Date.now()+Q*1000,B=Date.now()+60000,L=!1;while(!0){if(U>0){let j=KG6(H,F,U,N);if(Y?.signal?.aborted||J?.aborted)return K["AbortController signal aborted."]|=0,K["AbortController signal aborted."]+=1,{state:DN.ABORTED,observedResponses:K};if(Date.now()+j>N)return{state:DN.TIMEOUT,observedResponses:K};await YG6(j/1000)}let{state:O,reason:w}=await W(X,G);if(w){let j=WG6(w);K[j]|=0,K[j]+=1}if(O!==DN.RETRY)return{state:O,reason:w,final:w,observedResponses:K};if(U+=1,!L&&Date.now()>=B)GG6(K,X),L=!0}},GG6=($={},Z)=>{let Q=Object.keys($),Y=0;for(let G of Q){let W=$[G]|0;if(G.startsWith("403:"))Y+=W}let X=Z?.config?.logger,J=typeof X?.warn==="function"&&!X.constructor?.name?.includes?.("NoOpLogger")?X:console;if(Y>=3||Q[Q.length-1]?.startsWith("403:"))J.warn("@smithy/util-waiter WARN - 403 status code encountered during waiter polling.")},WG6=($)=>{let Z=$?.$response?.statusCode??$?.$metadata?.httpStatusCode;if($?.$responseBodyText)return`${Z?Z+": ":""}Deserialization error for body: ${$.$responseBodyText}`;if(Z){if($?.$response||$?.message)return`${Z??"Unknown"}: ${$?.message}`;return`${Z}: OK`}return String($?.message??JSON.stringify($,sI0())??"Unknown")},KG6=($,Z,Q,Y)=>{let X=Math.log(Z/$)/Math.log(2)+1;if(Q>X)return Z;let J=$*2**(Q-1),G=Math.min(J,Z),W=HG6($,G);if(Date.now()+W>Y){let K=Y-Date.now();return Math.max(0,K-500)}return W},HG6=($,Z)=>$+Math.random()*(Z-$),FG6=($)=>{if($.maxWaitTime<=0)throw Error("WaiterConfiguration.maxWaitTime must be greater than 0");else if($.minDelay<=0)throw Error("WaiterConfiguration.minDelay must be greater than 0");else if($.maxDelay<=0)throw Error("WaiterConfiguration.maxDelay must be greater than 0");else if($.maxWaitTime<=$.minDelay)throw Error(`WaiterConfiguration.maxWaitTime [${$.maxWaitTime}] must be greater than WaiterConfiguration.minDelay [${$.minDelay}] for this waiter`);else if($.maxDelay<$.minDelay)throw Error(`WaiterConfiguration.maxDelay [${$.maxDelay}] must be greater than WaiterConfiguration.minDelay [${$.minDelay}] for this waiter`)},Wm$=($)=>{let Z,Q=new Promise((Y)=>{if(Z=()=>Y({state:DN.ABORTED}),typeof $.addEventListener==="function")$.addEventListener("abort",Z);else $.onabort=Z});return{clearListener(){if(typeof $.removeEventListener==="function")$.removeEventListener("abort",Z)},aborted:Q}},UG6=async($,Z,Q)=>{let Y={...Hm$,...$};FG6(Y);let X=[JG6(Y,Z,Q)],J=[];if($.abortSignal){let{aborted:G,clearListener:W}=Wm$($.abortSignal);J.push(W),X.push(G)}if($.abortController?.signal){let{aborted:G,clearListener:W}=Wm$($.abortController.signal);J.push(W),X.push(G)}return Promise.race(X).then((G)=>{for(let W of J)W();return G})};class Fm${config;middlewareStack=T40();initConfig;handlers;constructor($){this.config=$;let{protocol:Z,protocolSettings:Q}=$;if(Q){if(typeof Z==="function")$.protocol=new Z(Q)}}send($,Z,Q){let Y=typeof Z!=="function"?Z:void 0,X=typeof Z==="function"?Z:Q,J=Y===void 0&&this.config.cacheMiddleware===!0,G;if(J){if(!this.handlers)this.handlers=new WeakMap;let W=this.handlers;if(W.has($.constructor))G=W.get($.constructor);else G=$.resolveMiddleware(this.middlewareStack,this.config,Y),W.set($.constructor,G)}else delete this.handlers,G=$.resolveMiddleware(this.middlewareStack,this.config,Y);if(X)G($).then((W)=>X(null,W.output),(W)=>X(W)).catch(()=>{});else return G($).then((W)=>W.output)}destroy(){this.config?.requestHandler?.destroy?.(),delete this.handlers}}var t31="***SensitiveInformation***";function eI0($,Z){if(Z==null)return Z;let Q=$G6.of($);if(Q.getMergedTraits().sensitive)return t31;if(Q.isListSchema()){if(!!Q.getValueSchema().getMergedTraits().sensitive)return t31}else if(Q.isMapSchema()){if(!!Q.getKeySchema().getMergedTraits().sensitive||!!Q.getValueSchema().getMergedTraits().sensitive)return t31}else if(Q.isStructSchema()&&typeof Z==="object"){let Y=Z,X={};for(let[J,G]of Q.structIterator())if(Y[J]!=null)X[J]=eI0(G,Y[J]);return X}return Z}class r31{middlewareStack=T40();schema;static classBuilder(){return new Um$}resolveMiddlewareWithContext($,Z,Q,{middlewareFn:Y,clientName:X,commandName:J,inputFilterSensitiveLog:G,outputFilterSensitiveLog:W,smithyContext:K,additionalContext:H,CommandCtor:F}){for(let w of Y.bind(this)(F,$,Z,Q))this.middlewareStack.use(w);let U=$.concat(this.middlewareStack),{logger:N}=Z,B={logger:N,clientName:X,commandName:J,inputFilterSensitiveLog:G,outputFilterSensitiveLog:W,[eJ6]:{commandInstance:this,...K},...H},{requestHandler:L}=Z,O=Q??{};if(K.eventStream)O={isEventStream:!0,...O};return U.resolve((w)=>L.handle(w.request,O),B)}}class Um${_init=()=>{};_ep={};_middlewareFn=()=>[];_commandName="";_clientName="";_additionalContext={};_smithyContext={};_inputFilterSensitiveLog=void 0;_outputFilterSensitiveLog=void 0;_serializer=null;_deserializer=null;_operationSchema;init($){this._init=$}ep($){return this._ep=$,this}m($){return this._middlewareFn=$,this}s($,Z,Q={}){return this._smithyContext={service:$,operation:Z,...Q},this}c($={}){return this._additionalContext=$,this}n($,Z){return this._clientName=$,this._commandName=Z,this}f($=(Q)=>Q,Z=(Q)=>Q){return this._inputFilterSensitiveLog=$,this._outputFilterSensitiveLog=Z,this}ser($){return this._serializer=$,this}de($){return this._deserializer=$,this}sc($){return this._operationSchema=$,this._smithyContext.operationSchema=$,this}build(){let $=this,Z;return Z=class extends r31{input;static getEndpointParameterInstructions(){return $._ep}constructor(...[Q]){super();this.input=Q??{},$._init(this),this.schema=$._operationSchema}resolveMiddleware(Q,Y,X){let J=$._operationSchema,G=J?.[4]??J?.input,W=J?.[5]??J?.output;return this.resolveMiddlewareWithContext(Q,Y,X,{CommandCtor:Z,middlewareFn:$._middlewareFn,clientName:$._clientName,commandName:$._commandName,inputFilterSensitiveLog:$._inputFilterSensitiveLog??(J?eI0.bind(null,G):(K)=>K),outputFilterSensitiveLog:$._outputFilterSensitiveLog??(J?eI0.bind(null,W):(K)=>K),smithyContext:$._smithyContext,additionalContext:$._additionalContext})}serialize=$._serializer;deserialize=$._deserializer}}}var NG6="***SensitiveInformation***",BG6=($,Z,Q)=>{for(let[J,G]of Object.entries($)){let W=async function(H,F,U){let N=new G(H);if(typeof F==="function")this.send(N,F);else if(typeof U==="function"){if(typeof F!=="object")throw Error(`Expected http options but got ${typeof F}`);this.send(N,F||{},U)}else return this.send(N,F)},K=(J[0].toLowerCase()+J.slice(1)).replace(/Command$/,"");Z.prototype[K]=W}let{paginators:Y={},waiters:X={}}=Q??{};for(let[J,G]of Object.entries(Y))if(Z.prototype[J]===void 0)Z.prototype[J]=function(W={},K,...H){return G({...K,client:this},W,...H)};for(let[J,G]of Object.entries(X))if(Z.prototype[J]===void 0)Z.prototype[J]=async function(W={},K,...H){let F=K;if(typeof K==="number")F={maxWaitTime:K};return G({...F,client:this},W,...H)}};class fi extends Error{$fault;$response;$retryable;$metadata;constructor($){super($.message);Object.setPrototypeOf(this,Object.getPrototypeOf(this).constructor.prototype),this.name=$.name,this.$fault=$.$fault,this.$metadata=$.$metadata}static isInstance($){if(!$)return!1;let Z=$;return fi.prototype.isPrototypeOf(Z)||Boolean(Z.$fault)&&Boolean(Z.$metadata)&&(Z.$fault==="client"||Z.$fault==="server")}static[Symbol.hasInstance]($){if(!$)return!1;let Z=$;if(this===fi)return fi.isInstance($);if(fi.isInstance($)){if(Z.name&&this.name)return this.prototype.isPrototypeOf($)||Z.name===this.name;return this.prototype.isPrototypeOf($)}return!1}}var Nm$=($,Z={})=>{Object.entries(Z).filter(([,Y])=>Y!==void 0).forEach(([Y,X])=>{if($[Y]==null||$[Y]==="")$[Y]=X});let Q=$.message||$.Message||"UnknownError";return $.message=Q,delete $.Message,$},Bm$=({output:$,parsedBody:Z,exceptionCtor:Q,errorCode:Y})=>{let X=LG6($),J=X.httpStatusCode?X.httpStatusCode+"":void 0,G=new Q({name:Z?.code||Z?.Code||Y||J||"UnknownError",$fault:"client",$metadata:X});throw Nm$(G,Z)},DG6=($)=>{return({output:Z,parsedBody:Q,errorCode:Y})=>{Bm$({output:Z,parsedBody:Q,exceptionCtor:$,errorCode:Y})}},LG6=($)=>({httpStatusCode:$.statusCode,requestId:$.headers["x-amzn-requestid"]??$.headers["x-amzn-request-id"]??$.headers["x-amz-request-id"],extendedRequestId:$.headers["x-amz-id-2"],cfId:$.headers["x-amz-cf-id"]}),OG6=($)=>{switch($){case"standard":return{retryMode:"standard",connectionTimeout:3100};case"in-region":return{retryMode:"standard",connectionTimeout:1100};case"cross-region":return{retryMode:"standard",connectionTimeout:3100};case"mobile":return{retryMode:"standard",connectionTimeout:30000};default:return{}}},Km$=!1,wG6=($)=>{if($&&!Km$&&parseInt($.substring(1,$.indexOf(".")))<16)Km$=!0},Dm$=Object.values(aI0),Lm$=($)=>{let Z=[];for(let Q in aI0){let Y=aI0[Q];if($[Y]===void 0)continue;Z.push({algorithmId:()=>Y,checksumConstructor:()=>$[Y]})}for(let[Q,Y]of Object.entries($.checksumAlgorithms??{}))Z.push({algorithmId:()=>Q,checksumConstructor:()=>Y});return{addChecksumAlgorithm(Q){$.checksumAlgorithms=$.checksumAlgorithms??{};let Y=Q.algorithmId(),X=Q.checksumConstructor();if(Dm$.includes(Y))$.checksumAlgorithms[Y.toUpperCase()]=X;else $.checksumAlgorithms[Y]=X;Z.push(Q)},checksumAlgorithms(){return Z}}},Om$=($)=>{let Z={};return $.checksumAlgorithms().forEach((Q)=>{let Y=Q.algorithmId();if(Dm$.includes(Y))Z[Y]=Q.checksumConstructor()}),Z},wm$=($)=>{return{setRetryStrategy(Z){$.retryStrategy=Z},retryStrategy(){return $.retryStrategy}}},jm$=($)=>{let Z={};return Z.retryStrategy=$.retryStrategy(),Z},Em$=($)=>{return Object.assign(Lm$($),wm$($))},jG6=Em$,EG6=($)=>{return Object.assign(Om$($),jm$($))},zG6=($)=>Array.isArray($)?$:[$],zm$=($)=>{for(let Q in $)if(Object.prototype.hasOwnProperty.call($,Q)&&$[Q]["#text"]!==void 0)$[Q]=$[Q]["#text"];else if(typeof $[Q]==="object"&&$[Q]!==null)$[Q]=zm$($[Q]);return $},PG6=($)=>{return $!=null};class Pm${trace(){}debug(){}info(){}warn(){}error(){}}function Am$($,Z,Q){let Y,X,J;if(typeof Z>"u"&&typeof Q>"u")Y={},J=$;else if(Y=$,typeof Z==="function")return X=Z,J=Q,RG6(Y,X,J);else J=Z;for(let G of Object.keys(J)){if(!Array.isArray(J[G])){Y[G]=J[G];continue}Tm$(Y,null,J,G)}return Y}var AG6=($)=>{let Z={};for(let[Q,Y]of Object.entries($||{}))Z[Q]=[,Y];return Z},TG6=($,Z)=>{let Q={};for(let Y in Z)Tm$(Q,$,Z,Y);return Q},RG6=($,Z,Q)=>{return Am$($,Object.entries(Q).reduce((Y,[X,J])=>{if(Array.isArray(J))Y[X]=J;else if(typeof J==="function")Y[X]=[Z,J()];else Y[X]=[Z,J];return Y},{}))},Tm$=($,Z,Q,Y)=>{if(Z!==null){let G=Q[Y];if(typeof G==="function")G=[,G];let[W=qG6,K=MG6,H=Y]=G;if(typeof W==="function"&&W(Z[H])||typeof W!=="function"&&!!W)$[Y]=K(Z[H]);return}let[X,J]=Q[Y];if(typeof J==="function"){let G,W=X===void 0&&(G=J())!=null,K=typeof X==="function"&&!!X(void 0)||typeof X!=="function"&&!!X;if(W)$[Y]=G;else if(K)$[Y]=J()}else{let G=X===void 0&&J!=null,W=typeof X==="function"&&!!X(J)||typeof X!=="function"&&!!X;if(G||W)$[Y]=J}},qG6=($)=>$!=null,MG6=($)=>$,IG6=($)=>{if($!==$)return"NaN";switch($){case 1/0:return"Infinity";case-1/0:return"-Infinity";default:return $}},VG6=($)=>$.toISOString().replace(".000Z","Z"),o31=($)=>{if($==null)return{};if(Array.isArray($))return $.filter((Z)=>Z!=null).map(o31);if(typeof $==="object"){let Z={};for(let Q of Object.keys($)){if($[Q]==null)continue;Z[Q]=o31($[Q])}return Z}return $};kG6.Client=Fm$;kG6.Command=r31;kG6.NoOpLogger=Pm$;kG6.SENSITIVE_STRING=NG6;kG6.ServiceException=fi;kG6.WaiterState=DN;kG6._json=o31;kG6.checkExceptions=XG6;kG6.constructStack=T40;kG6.convertMap=AG6;kG6.createAggregatedClient=BG6;kG6.createWaiter=UG6;kG6.decorateServiceException=Nm$;kG6.emitWarningIfUnsupportedVersion=wG6;kG6.getArrayIfSingleItem=zG6;kG6.getChecksumConfiguration=Lm$;kG6.getDefaultClientConfiguration=jG6;kG6.getDefaultExtensionConfiguration=Em$;kG6.getRetryConfiguration=wm$;kG6.getValueFromTextNode=zm$;kG6.invalidFunction=ZG6;kG6.invalidProvider=QG6;kG6.isSerializableHeaderValue=PG6;kG6.loadConfigsForDefaultMode=OG6;kG6.map=Am$;kG6.resolveChecksumRuntimeConfig=Om$;kG6.resolveDefaultRuntimeConfig=EG6;kG6.resolveRetryRuntimeConfig=jm$;kG6.schemaLogFilter=eI0;kG6.serializeDateTime=VG6;kG6.serializeFloat=IG6;kG6.take=TG6;kG6.throwDefaultError=Bm$;kG6.waiterServiceDefaults=Hm$;kG6.withBaseException=DG6});var h4=b((UW6)=>{var{homedir:D36}=M0("os"),{sep:L36,join:R40}=M0("path"),{createHash:O36}=M0("crypto"),{readFile:km$}=M0("fs/promises"),{IniSectionType:$V0}=qy(),{normalizeProvider:ZV0}=o5(),{isValidHostLabel:w36}=BN();class yi extends Error{name="ProviderError";tryNextLink;constructor($,Z=!0){let Q,Y=!0;if(typeof Z==="boolean")Q=void 0,Y=Z;else if(Z!=null&&typeof Z==="object")Q=Z.logger,Y=Z.tryNextLink??!0;super($);this.tryNextLink=Y,Object.setPrototypeOf(this,yi.prototype),Q?.debug?.(`@smithy/property-provider ${Y?"->":"(!)"} ${$}`)}static from($,Z=!0){return Object.assign(new this($.message,Z),$)}}class q40 extends yi{name="CredentialsProviderError";constructor($,Z=!0){super($,Z);Object.setPrototypeOf(this,q40.prototype)}}class ZW1 extends yi{name="TokenProviderError";constructor($,Z=!0){super($,Z);Object.setPrototypeOf(this,ZW1.prototype)}}var Sm$=(...$)=>async()=>{if($.length===0)throw new yi("No providers in chain");let Z;for(let Q of $)try{return await Q()}catch(Y){if(Z=Y,Y?.tryNextLink)continue;throw Y}throw Z},Cm$=($)=>()=>Promise.resolve($),QW1=($,Z,Q)=>{let Y,X,J,G=!1,W=async()=>{if(!X)X=$();try{Y=await X,J=!0,G=!1}finally{X=void 0}return Y};if(Z===void 0)return async(K)=>{if(!J||K?.forceRefresh)Y=await W();return Y};return async(K)=>{if(!J||K?.forceRefresh)Y=await W();if(G)return Y;if(Q&&!Q(Y))return G=!0,Y;if(Z(Y))return await W(),Y;return Y}},YL=($,Z,Q)=>{if(!(Z in $))return;if($[Z]==="true")return!0;if($[Z]==="false")return!1;throw Error(`Cannot load ${Q} "${Z}". Expected "true" or "false", got ${$[Z]}.`)},j36=($,Z,Q)=>{if(!(Z in $))return;let Y=parseInt($[Z],10);if(Number.isNaN(Y))throw TypeError(`Cannot load ${Q} '${Z}'. Expected number, got '${$[Z]}'.`);return Y},tH;(function($){$.ENV="env",$.CONFIG="shared config entry"})(tH||(tH={}));var s31={},E36=()=>{if(process&&process.geteuid)return`${process.geteuid()}`;return"DEFAULT"},M40=()=>{let{HOME:$,USERPROFILE:Z,HOMEPATH:Q,HOMEDRIVE:Y=`C:${L36}`}=process.env;if($)return $;if(Z)return Z;if(Q)return`${Y}${Q}`;let X=E36();if(!s31[X])s31[X]=D36();return s31[X]},_m$="AWS_PROFILE",vm$="default",bm$=($)=>$.profile||process.env[_m$]||vm$,xm$=($)=>{let Q=O36("sha1").update($).digest("hex");return R40(M40(),".aws","sso","cache",`${Q}.json`)},QV0={},z36=async($)=>{if(QV0[$])return QV0[$];let Z=xm$($),Q=await km$(Z,"utf8");return JSON.parse(Q)},Iy=".",P36=($)=>Object.entries($).filter(([Z])=>{let Q=Z.indexOf(Iy);if(Q===-1)return!1;return Object.values($V0).includes(Z.substring(0,Q))}).reduce((Z,[Q,Y])=>{let X=Q.indexOf(Iy),J=Q.substring(0,X)===$V0.PROFILE?Q.substring(X+1):Q;return Z[J]=Y,Z},{...$.default&&{default:$.default}}),A36="AWS_CONFIG_FILE",fm$=()=>process.env[A36]||R40(M40(),".aws","config"),T36="AWS_SHARED_CREDENTIALS_FILE",R36=()=>process.env[T36]||R40(M40(),".aws","credentials"),q36=/^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/,M36=["__proto__","profile __proto__"],e31=($)=>{let Z={},Q,Y;for(let X of $.split(/\r?\n/)){let J=X.split(/(^|\s)[;#]/)[0].trim();if(J[0]==="["&&J[J.length-1]==="]"){Q=void 0,Y=void 0;let W=J.substring(1,J.length-1),K=q36.exec(W);if(K){let[,H,,F]=K;if(Object.values($V0).includes(H))Q=[H,F].join(Iy)}else Q=W;if(M36.includes(W))throw Error(`Found invalid profile name "${W}"`)}else if(Q){let W=J.indexOf("=");if(![0,-1].includes(W)){let[K,H]=[J.substring(0,W).trim(),J.substring(W+1).trim()];if(H==="")Y=K;else{if(Y&&X.trimStart()===X)Y=void 0;Z[Q]=Z[Q]||{};let F=Y?[Y,K].join(Iy):K;Z[Q][F]=H}}}}return Z},a31={},YV0={},XV0=($,Z)=>{if(YV0[$]!==void 0)return YV0[$];if(!a31[$]||Z?.ignoreCache)a31[$]=km$($,"utf8");return a31[$]},Rm$=()=>({}),YW1=async($={})=>{let{filepath:Z=R36(),configFilepath:Q=fm$()}=$,Y=M40(),X="~/",J=Z;if(Z.startsWith("~/"))J=R40(Y,Z.slice(2));let G=Q;if(Q.startsWith("~/"))G=R40(Y,Q.slice(2));let W=await Promise.all([XV0(G,{ignoreCache:$.ignoreCache}).then(e31).then(P36).catch(Rm$),XV0(J,{ignoreCache:$.ignoreCache}).then(e31).catch(Rm$)]);return{configFile:W[0],credentialsFile:W[1]}},I36=($)=>Object.entries($).filter(([Z])=>Z.startsWith($V0.SSO_SESSION+Iy)).reduce((Z,[Q,Y])=>({...Z,[Q.substring(Q.indexOf(Iy)+1)]:Y}),{}),V36=()=>({}),k36=async($={})=>XV0($.configFilepath??fm$()).then(e31).then(I36).catch(V36),S36=(...$)=>{let Z={};for(let Q of $)for(let[Y,X]of Object.entries(Q))if(Z[Y]!==void 0)Object.assign(Z[Y],X);else Z[Y]=X;return Z},C36=async($)=>{let Z=await YW1($);return S36(Z.configFile,Z.credentialsFile)},_36={getFileRecord(){return YV0},interceptFile($,Z){YV0[$]=Promise.resolve(Z)},getTokenRecord(){return QV0},interceptToken($,Z){QV0[$]=Z}};function ym$($){try{let Z=new Set(Array.from($.match(/([A-Z_]){3,}/g)??[]));return Z.delete("CONFIG"),Z.delete("CONFIG_PREFIX_SEPARATOR"),Z.delete("ENV"),[...Z].join(", ")}catch(Z){return $}}var v36=($,Z)=>async()=>{try{let Q=$(process.env,Z);if(Q===void 0)throw Error();return Q}catch(Q){throw new q40(Q.message||`Not found in ENV: ${ym$($.toString())}`,{logger:Z?.logger})}},b36=($,{preferredFile:Z="config",...Q}={})=>async()=>{let Y=bm$(Q),{configFile:X,credentialsFile:J}=await YW1(Q),G=J[Y]||{},W=X[Y]||{},K=Z==="config"?{...G,...W}:{...W,...G};try{let F=$(K,Z==="config"?X:J);if(F===void 0)throw Error();return F}catch(H){throw new q40(H.message||`Not found in config files w/ profile [${Y}]: ${ym$($.toString())}`,{logger:Q.logger})}},x36=($)=>typeof $==="function",gm$=($)=>x36($)?async()=>await $():Cm$($),$W1=({environmentVariableSelector:$,configFileSelector:Z,default:Q},Y={})=>{let{signingName:X,logger:J}=Y;return QW1(Sm$(v36($,{signingName:X,logger:J}),b36(Z,Y),gm$(Q)))},XW1="AWS_USE_DUALSTACK_ENDPOINT",JW1="use_dualstack_endpoint",f36=!1,y36={environmentVariableSelector:($)=>YL($,XW1,tH.ENV),configFileSelector:($)=>YL($,JW1,tH.CONFIG),default:!1},g36={environmentVariableSelector:($)=>YL($,XW1,tH.ENV),configFileSelector:($)=>YL($,JW1,tH.CONFIG),default:void 0},GW1="AWS_USE_FIPS_ENDPOINT",WW1="use_fips_endpoint",h36=!1,u36={environmentVariableSelector:($)=>YL($,GW1,tH.ENV),configFileSelector:($)=>YL($,WW1,tH.CONFIG),default:!1},l36={environmentVariableSelector:($)=>YL($,GW1,tH.ENV),configFileSelector:($)=>YL($,WW1,tH.CONFIG),default:void 0},c36=($)=>{let{tls:Z,endpoint:Q,urlParser:Y,useDualstackEndpoint:X}=$;return Object.assign($,{tls:Z??!0,endpoint:ZV0(typeof Q==="string"?Y(Q):Q),isCustomEndpoint:!0,useDualstackEndpoint:ZV0(X??!1)})},m36=async($)=>{let{tls:Z=!0}=$,Q=await $.region();if(!new RegExp(/^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9])$/).test(Q))throw Error("Invalid region in client config");let X=await $.useDualstackEndpoint(),J=await $.useFipsEndpoint(),{hostname:G}=await $.regionInfoProvider(Q,{useDualstackEndpoint:X,useFipsEndpoint:J})??{};if(!G)throw Error("Cannot resolve hostname from client config");return $.urlParser(`${Z?"https:":"http:"}//${G}`)},d36=($)=>{let Z=ZV0($.useDualstackEndpoint??!1),{endpoint:Q,useFipsEndpoint:Y,urlParser:X,tls:J}=$;return Object.assign($,{tls:J??!0,endpoint:Q?ZV0(typeof Q==="string"?X(Q):Q):()=>m36({...$,useDualstackEndpoint:Z,useFipsEndpoint:Y}),isCustomEndpoint:!!Q,useDualstackEndpoint:Z})},hm$="AWS_REGION",um$="region",lm$={environmentVariableSelector:($)=>$[hm$],configFileSelector:($)=>$[um$],default:()=>{throw Error("Region is missing")}},i36={preferredFile:"credentials"},qm$=new Set,p36=($,Z=w36)=>{if(!qm$.has($)&&!Z($))if($==="*")console.warn('@smithy/config-resolver WARN - Please use the caller region instead of "*". See "sigv4a" in https://github.com/aws/aws-sdk-js-v3/blob/main/supplemental-docs/CLIENTS.md.');else throw Error(`Region not accepted: region="${$}" is not a valid hostname component.`);else qm$.add($)},cm$=($)=>typeof $==="string"&&($.startsWith("fips-")||$.endsWith("-fips")),n36=($)=>cm$($)?["fips-aws-global","aws-fips"].includes($)?"us-east-1":$.replace(/fips-(dkr-|prod-)?|-fips/,""):$,t36=($)=>{let{region:Z,useFipsEndpoint:Q}=$;if(!Z)throw Error("Region is missing");return Object.assign($,{region:async()=>{let Y=typeof Z==="function"?await Z():Z,X=n36(Y);return p36(X),X},useFipsEndpoint:async()=>{let Y=typeof Z==="string"?Z:await Z();if(cm$(Y))return!0;return typeof Q!=="function"?Promise.resolve(!!Q):Q()}})},Mm$=($=[],{useFipsEndpoint:Z,useDualstackEndpoint:Q})=>$.find(({tags:Y})=>Z===Y.includes("fips")&&Q===Y.includes("dualstack"))?.hostname,o36=($,{regionHostname:Z,partitionHostname:Q})=>Z?Z:Q?Q.replace("{region}",$):void 0,r36=($,{partitionHash:Z})=>Object.keys(Z||{}).find((Q)=>Z[Q].regions.includes($))??"aws",s36=($,{signingRegion:Z,regionRegex:Q,useFipsEndpoint:Y})=>{if(Z)return Z;else if(Y){let X=Q.replace("\\\\","\\").replace(/^\^/g,"\\.").replace(/\$$/g,"\\."),J=$.match(X);if(J)return J[0].slice(1,-1)}},a36=($,{useFipsEndpoint:Z=!1,useDualstackEndpoint:Q=!1,signingService:Y,regionHash:X,partitionHash:J})=>{let G=r36($,{partitionHash:J}),W=$ in X?$:J[G]?.endpoint??$,K={useFipsEndpoint:Z,useDualstackEndpoint:Q},H=Mm$(X[W]?.variants,K),F=Mm$(J[G]?.variants,K),U=o36(W,{regionHostname:H,partitionHostname:F});if(U===void 0)throw Error(`Endpoint resolution failed for: ${{resolvedRegion:W,useFipsEndpoint:Z,useDualstackEndpoint:Q}}`);let N=s36(U,{signingRegion:X[W]?.signingRegion,regionRegex:J[G].regionRegex,useFipsEndpoint:Z});return{partition:G,signingService:Y,hostname:U,...N&&{signingRegion:N},...X[W]?.signingService&&{signingService:X[W].signingService}}},e36="AWS_EXECUTION_ENV",Im$="AWS_REGION",Vm$="AWS_DEFAULT_REGION",$W6="AWS_EC2_METADATA_DISABLED",ZW6=["in-region","cross-region","mobile","standard","legacy"],QW6="/latest/meta-data/placement/region",YW6="AWS_DEFAULTS_MODE",XW6="defaults_mode",JW6={environmentVariableSelector:($)=>{return $[YW6]},configFileSelector:($)=>{return $[XW6]},default:"legacy"},GW6=({region:$=$W1(lm$),defaultsMode:Z=$W1(JW6)}={})=>QW1(async()=>{let Q=typeof Z==="function"?await Z():Z;switch(Q?.toLowerCase()){case"auto":return WW6($);case"in-region":case"cross-region":case"mobile":case"standard":case"legacy":return Promise.resolve(Q?.toLocaleLowerCase());case void 0:return Promise.resolve("legacy");default:throw Error(`Invalid parameter for "defaultsMode", expect ${ZW6.join(", ")}, got ${Q}`)}}),WW6=async($)=>{if($){let Z=typeof $==="function"?await $():$,Q=await KW6();if(!Q)return"standard";if(Z===Q)return"in-region";else return"cross-region"}return"standard"},KW6=async()=>{if(process.env[e36]&&(process.env[Im$]||process.env[Vm$]))return process.env[Im$]??process.env[Vm$];if(!process.env[$W6])try{let $=await HW6();return(await FW6({hostname:$.hostname,path:QW6})).toString()}catch($){}},HW6=async()=>{let $=process.env.AWS_EC2_METADATA_SERVICE_ENDPOINT;if($){let Q=new URL($);return{hostname:Q.hostname,path:Q.pathname}}if(process.env.AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE==="IPv6")return{hostname:"fd00:ec2::254",path:"/"};return{hostname:"169.254.169.254",path:"/"}},FW6=async({hostname:$,path:Z})=>{let{request:Q}=M0("http");return new Promise((Y,X)=>{let J=Q({method:"GET",hostname:$.replace(/^\[(.+)]$/,"$1"),path:Z,timeout:1000,signal:AbortSignal.timeout(1000)});J.on("error",(G)=>{X(G),J.destroy()}),J.on("timeout",()=>{X(Error("TimeoutError from instance metadata service")),J.destroy()}),J.on("response",(G)=>{let{statusCode:W=400}=G;if(W<200||300<=W){X(Object.assign(Error("Error response received from instance metadata service"),{statusCode:W})),J.destroy();return}let K=[];G.on("data",(H)=>K.push(H)),G.on("end",()=>{Y(Buffer.concat(K)),J.destroy()})}),J.end()})};UW6.CONFIG_PREFIX_SEPARATOR=Iy;UW6.CONFIG_USE_DUALSTACK_ENDPOINT=JW1;UW6.CONFIG_USE_FIPS_ENDPOINT=WW1;UW6.CredentialsProviderError=q40;UW6.DEFAULT_PROFILE=vm$;UW6.DEFAULT_USE_DUALSTACK_ENDPOINT=f36;UW6.DEFAULT_USE_FIPS_ENDPOINT=h36;UW6.ENV_PROFILE=_m$;UW6.ENV_USE_DUALSTACK_ENDPOINT=XW1;UW6.ENV_USE_FIPS_ENDPOINT=GW1;UW6.NODE_REGION_CONFIG_FILE_OPTIONS=i36;UW6.NODE_REGION_CONFIG_OPTIONS=lm$;UW6.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS=y36;UW6.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS=u36;UW6.ProviderError=yi;UW6.REGION_ENV_NAME=hm$;UW6.REGION_INI_NAME=um$;UW6.SelectorType=tH;UW6.TokenProviderError=ZW1;UW6.booleanSelector=YL;UW6.chain=Sm$;UW6.externalDataInterceptor=_36;UW6.fromStatic=gm$;UW6.fromValue=Cm$;UW6.getHomeDir=M40;UW6.getProfileName=bm$;UW6.getRegionInfo=a36;UW6.getSSOTokenFilepath=xm$;UW6.getSSOTokenFromFile=z36;UW6.loadConfig=$W1;UW6.loadSharedConfigFiles=YW1;UW6.loadSsoSessionData=k36;UW6.memoize=QW1;UW6.nodeDualstackConfigSelectors=g36;UW6.nodeFipsConfigSelectors=l36;UW6.numberSelector=j36;UW6.parseKnownFiles=C36;UW6.readFile=XV0;UW6.resolveCustomEndpointsConfig=c36;UW6.resolveDefaultsModeConfig=GW6;UW6.resolveEndpointsConfig=d36;UW6.resolveRegionConfig=t36});var QZ=b((gK6)=>{var{CONFIG_PREFIX_SEPARATOR:mm$,loadConfig:$K6}=h4(),{toEndpointV1:JV0,getSmithyContext:ZK6,normalizeProvider:KW1,isValidHostLabel:pm$}=BN();gK6.isValidHostLabel=pm$;gK6.middlewareEndpointToEndpointV1=JV0;gK6.toEndpointV1=JV0;var{EndpointURLScheme:UW1}=qy(),dm$="AWS_ENDPOINT_URL",im$="endpoint_url",QK6=($)=>({environmentVariableSelector:(Z)=>{let Q=$.split(" ").map((J)=>J.toUpperCase()),Y=Z[[dm$,...Q].join("_")];if(Y)return Y;let X=Z[dm$];if(X)return X;return},configFileSelector:(Z,Q)=>{if(Q&&Z.services){let X=Q[["services",Z.services].join(mm$)];if(X){let J=$.split(" ").map((W)=>W.toLowerCase()),G=X[[J.join("_"),im$].join(mm$)];if(G)return G}}let Y=Z[im$];if(Y)return Y;return},default:void 0}),GV0=async($)=>$K6(QK6($??""))(),YK6=async($)=>{let Z=$?.Bucket||"";if(typeof $.Bucket==="string")$.Bucket=Z.replace(/#/g,encodeURIComponent("#")).replace(/\?/g,encodeURIComponent("?"));if(KK6(Z)){if($.ForcePathStyle===!0)throw Error("Path-style addressing cannot be used with ARN buckets")}else if(!WK6(Z)||Z.indexOf(".")!==-1&&!String($.Endpoint).startsWith("http:")||Z.toLowerCase()!==Z||Z.length<3)$.ForcePathStyle=!0;if($.DisableMultiRegionAccessPoints)$.disableMultiRegionAccessPoints=!0,$.DisableMRAP=!0;return $},XK6=/^[a-z0-9][a-z0-9\.\-]{1,61}[a-z0-9]$/,JK6=/(\d+\.){3}\d+/,GK6=/\.\./,WK6=($)=>XK6.test($)&&!JK6.test($)&&!GK6.test($),KK6=($)=>{let[Z,Q,Y,,,X]=$.split(":"),J=Z==="arn"&&$.split(":").length>=6,G=Boolean(J&&Q&&Y&&X);if(J&&!G)throw Error(`Invalid ARN: ${$} was an invalid ARN.`);return G},HK6=($,Z,Q,Y=!1)=>{let X=async()=>{let J;if(Y)J=Q.clientContextParams?.[$]??Q[$]??Q[Z];else J=Q[$]??Q[Z];if(typeof J==="function")return J();return J};if($==="credentialScope"||Z==="CredentialScope")return async()=>{let J=typeof Q.credentials==="function"?await Q.credentials():Q.credentials;return J?.credentialScope??J?.CredentialScope};if($==="accountId"||Z==="AccountId")return async()=>{let J=typeof Q.credentials==="function"?await Q.credentials():Q.credentials;return J?.accountId??J?.AccountId};if($==="endpoint"||Z==="endpoint")return async()=>{if(Q.isCustomEndpoint===!1)return;let J=await X();if(J&&typeof J==="object"){if("url"in J)return J.url.href;if("hostname"in J){let{protocol:G,hostname:W,port:K,path:H}=J;return`${G}//${W}${K?":"+K:""}${H}`}}return J};return X};function nm$($){return async(Z,Q,Y,X)=>{if(!Y.isCustomEndpoint){let W;if(Y.serviceConfiguredEndpoint)W=await Y.serviceConfiguredEndpoint();else W=await $(Y.serviceId);if(W)Y.endpoint=()=>Promise.resolve(JV0(W)),Y.isCustomEndpoint=!0}let J=await tm$(Z,Q,Y);if(typeof Y.endpointProvider!=="function")throw Error("config.endpointProvider is not set.");let G=Y.endpointProvider(J,X);if(Y.isCustomEndpoint&&Y.endpoint){let W=await Y.endpoint();if(W?.headers){G.headers??={};for(let[K,H]of Object.entries(W.headers))G.headers[K]=Array.isArray(H)?H:[H]}}return G}}var tm$=async($,Z,Q)=>{let Y={},X=Z?.getEndpointParameterInstructions?.()||{};for(let[J,G]of Object.entries(X))switch(G.type){case"staticContextParams":Y[J]=G.value;break;case"contextParams":Y[J]=$[G.name];break;case"clientContextParams":case"builtInParams":Y[J]=await HK6(G.name,J,Q,G.type!=="builtInParams")();break;case"operationContextParams":Y[J]=G.get($);break;default:throw Error("Unrecognized endpoint parameter instruction: "+JSON.stringify(G))}if(Object.keys(X).length===0)Object.assign(Y,Q);if(String(Q.serviceId).toLowerCase()==="s3")await YK6(Y);return Y};function FK6($,Z,Q){if(!$.__smithy_context)$.__smithy_context={features:{}};else if(!$.__smithy_context.features)$.__smithy_context.features={};$.__smithy_context.features[Z]=Q}function om$($){let Z=nm$($);return({config:Q,instructions:Y})=>{return(X,J)=>async(G)=>{if(Q.isCustomEndpoint)FK6(J,"ENDPOINT_OVERRIDE","N");let W=await Z(G.input,{getEndpointParameterInstructions(){return Y}},{...Q},J);J.endpointV2=W,J.authSchemes=W.properties?.authSchemes;let K=J.authSchemes?.[0];if(K){J.signing_region=K.signingRegion,J.signing_service=K.signingName;let F=ZK6(J)?.selectedHttpAuthScheme?.httpAuthOption;if(F)F.signingProperties=Object.assign(F.signingProperties||{},{signing_region:K.signingRegion,signingRegion:K.signingRegion,signing_service:K.signingName,signingName:K.signingName,signingRegionSet:K.signingRegionSet},K.properties)}return X({...G})}}}var UK6={name:"serializerMiddleware"},rm$={step:"serialize",tags:["ENDPOINT_PARAMETERS","ENDPOINT_V2","ENDPOINT"],name:"endpointV2Middleware",override:!0,relation:"before",toMiddleware:UK6.name};function NK6($){let Z=om$($);return(Q,Y)=>({applyToStack:(X)=>{X.addRelativeTo(Z({config:Q,instructions:Y}),rm$)}})}function BK6($){return(Z)=>{let Q=Z.tls??!0,{endpoint:Y,useDualstackEndpoint:X,useFipsEndpoint:J}=Z,G=Y!=null?async()=>JV0(await KW1(Y)()):void 0,K=Object.assign(Z,{endpoint:G,tls:Q,isCustomEndpoint:!!Y,useDualstackEndpoint:KW1(X??!1),useFipsEndpoint:KW1(J??!1)}),H=void 0;return K.serviceConfiguredEndpoint=async()=>{if(Z.serviceId&&!H)H=$(Z.serviceId);return H},K}}class NW1{nodes;root;conditions;results;constructor($,Z,Q,Y){this.nodes=$,this.root=Z,this.conditions=Q,this.results=Y}static from($,Z,Q,Y){return new NW1($,Z,Q,Y)}}class sm${capacity;data=new Map;parameters=[];constructor({size:$,params:Z}){if(this.capacity=$??50,Z)this.parameters=Z}get($,Z){let Q=this.hash($);if(Q===!1)return Z();if(!this.data.has(Q)){if(this.data.size>this.capacity+10){let Y=this.data.keys(),X=0;while(!0){let{value:J,done:G}=Y.next();if(this.data.delete(J),G||++X>10)break}}this.data.set(Q,Z())}return this.data.get(Q)}size(){return this.data.size}hash($){let Z="",{parameters:Q}=this;if(Q.length===0)return!1;for(let Y of Q){let X=String($[Y]??"");if(X.includes("|;"))return!1;Z+=X+"|;"}return Z}}class ZY extends Error{constructor($){super($);this.name="EndpointError"}}var I40="endpoints";function lE($){if(typeof $!=="object"||$==null)return $;if("ref"in $)return`$${lE($.ref)}`;if("fn"in $)return`${$.fn}(${($.argv||[]).map(lE).join(", ")})`;return JSON.stringify($,null,2)}var am$={},DK6=($,Z)=>$===Z;function LK6(...$){for(let Z of $)if(Z!=null)return Z;return}var OK6=($)=>{let Z=$.split("."),Q=[];for(let Y of Z){let X=Y.indexOf("[");if(X!==-1){if(Y.indexOf("]")!==Y.length-1)throw new ZY(`Path: '${$}' does not end with ']'`);let J=Y.slice(X+1,-1);if(Number.isNaN(parseInt(J)))throw new ZY(`Invalid array index: '${J}' in path: '${$}'`);if(X!==0)Q.push(Y.slice(0,X));Q.push(J)}else Q.push(Y)}return Q},em$=($,Z)=>OK6(Z).reduce((Q,Y)=>{if(typeof Q!=="object")throw new ZY(`Index '${Y}' in '${Z}' not found in '${JSON.stringify($)}'`);else if(Array.isArray(Q)){let X=parseInt(Y);return Q[X<0?Q.length+X:X]}return Q[Y]},$),wK6=($)=>$!=null;function jK6($,Z,Q){return $?Z:Q}var EK6=($)=>!$,zK6=new RegExp("^(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)){3}$"),$d$=($)=>zK6.test($)||$.startsWith("[")&&$.endsWith("]"),HW1={[UW1.HTTP]:80,[UW1.HTTPS]:443},PK6=($)=>{let Z=(()=>{try{if($ instanceof URL)return $;if(typeof $==="object"&&"hostname"in $){let{hostname:N,port:B,protocol:L="",path:O="",query:w={}}=$,j=new URL(`${L}//${N}${B?`:${B}`:""}${O}`);return j.search=Object.entries(w).map(([E,z])=>`${E}=${z}`).join("&"),j}return new URL($)}catch(N){return null}})();if(!Z)return console.error(`Unable to parse ${JSON.stringify($)} as a whatwg URL.`),null;let Q=Z.href,{host:Y,hostname:X,pathname:J,protocol:G,search:W}=Z;if(W)return null;let K=G.slice(0,-1);if(!Object.values(UW1).includes(K))return null;let H=$d$(X),F=Q.includes(`${Y}:${HW1[K]}`)||typeof $==="string"&&$.includes(`${Y}:${HW1[K]}`),U=`${Y}${F?`:${HW1[K]}`:""}`;return{scheme:K,authority:U,path:J,normalizedPath:J.endsWith("/")?J:`${J}/`,isIp:H}};function AK6($,Z,Q){if(Q===1)return[$];if($==="")return[""];let Y=$.split(Z);if(Q===0)return Y;return Y.slice(0,Q-1).concat(Y.slice(1).join(Z))}var TK6=($,Z)=>$===Z,RK6=($,Z,Q,Y)=>{if($==null||Z>=Q||$.length<Q||/[^\u0000-\u007f]/.test($))return null;if(!Y)return $.substring(Z,Q);return $.substring($.length-Q,$.length-Z)},qK6=($)=>encodeURIComponent($).replace(/[!*'()]/g,(Z)=>`%${Z.charCodeAt(0).toString(16).toUpperCase()}`),MK6={booleanEquals:DK6,coalesce:LK6,getAttr:em$,isSet:wK6,isValidHostLabel:pm$,ite:jK6,not:EK6,parseURL:PK6,split:AK6,stringEquals:TK6,substring:RK6,uriEncode:qK6},Zd$=($,Z)=>{let Q=[],{referenceRecord:Y,endpointParams:X}=Z,J=0;while(J<$.length){let G=$.indexOf("{",J);if(G===-1){Q.push($.slice(J));break}Q.push($.slice(J,G));let W=$.indexOf("}",G);if(W===-1){Q.push($.slice(G));break}if($[G+1]==="{"&&$[W+1]==="}")Q.push($.slice(G+1,W)),J=W+2;let K=$.substring(G+1,W);if(K.includes("#")){let[H,F]=K.split("#");Q.push(em$(Y[H]??X[H],F))}else Q.push(Y[K]??X[K]);J=W+1}return Q.join("")},IK6=({ref:$},Z)=>{return Z.referenceRecord[$]??Z.endpointParams[$]},V40=($,Z,Q)=>{if(typeof $==="string")return Zd$($,Q);else if($.fn)return Yd$.callFunction($,Q);else if($.ref)return IK6($,Q);throw new ZY(`'${Z}': ${String($)} is not a string, function or reference.`)},Qd$=({fn:$,argv:Z},Q)=>{let Y=Array(Z.length);for(let G=0;G<Y.length;++G){let W=Z[G];if(typeof W==="boolean"||typeof W==="number")Y[G]=W;else Y[G]=Yd$.evaluateExpression(W,"arg",Q)}let X=$.indexOf(".");if(X!==-1){let W=am$[$.slice(0,X)]?.[$.slice(X+1)];if(typeof W==="function")return W(...Y)}let J=MK6[$];if(typeof J==="function")return J(...Y);throw Error(`function ${$} not loaded in endpointFunctions.`)},Yd$={evaluateExpression:V40,callFunction:Qd$},Xd$=($,Z)=>{let{assign:Q}=$;if(Q&&Q in Z.referenceRecord)throw new ZY(`'${Q}' is already defined in Reference Record.`);let Y=Qd$($,Z);Z.logger?.debug?.(`${I40} evaluateCondition: ${lE($)} = ${lE(Y)}`);let X=Y===""?!0:!!Y;if(Q!=null)return{result:X,toAssign:{name:Q,value:Y}};return{result:X}},Jd$=($,Z)=>Object.entries($??{}).reduce((Q,[Y,X])=>{return Q[Y]=X.map((J)=>{let G=V40(J,"Header value entry",Z);if(typeof G!=="string")throw new ZY(`Header '${Y}' value '${G}' is not a string`);return G}),Q},{}),BW1=($,Z)=>Object.entries($).reduce((Q,[Y,X])=>{return Q[Y]=Wd$.getEndpointProperty(X,Z),Q},{}),Gd$=($,Z)=>{if(Array.isArray($))return $.map((Q)=>Gd$(Q,Z));switch(typeof $){case"string":return Zd$($,Z);case"object":if($===null)throw new ZY(`Unexpected endpoint property: ${$}`);return Wd$.getEndpointProperties($,Z);case"boolean":return $;default:throw new ZY(`Unexpected endpoint property type: ${typeof $}`)}},Wd$={getEndpointProperty:Gd$,getEndpointProperties:BW1},Kd$=($,Z)=>{let Q=V40($,"Endpoint URL",Z);if(typeof Q==="string")try{return new URL(Q)}catch(Y){throw console.error(`Failed to construct URL with ${Q}`,Y),Y}throw new ZY(`Endpoint URL must be a string, got ${typeof Q}`)},FW1=1e8,VK6=($,Z)=>{let{nodes:Q,root:Y,results:X,conditions:J}=$,G=Y,W={},K={referenceRecord:W,endpointParams:Z.endpointParams,logger:Z.logger};while(G!==1&&G!==-1&&G<FW1){let H=3*(Math.abs(G)-1),[F,U,N]=[Q[H],Q[H+1],Q[H+2]],[B,L,O]=J[F],w=Xd$({fn:B,assign:O,argv:L},K);if(w.toAssign){let{name:j,value:E}=w.toAssign;W[j]=E}G=G>=0===w.result?U:N}if(G>=FW1){let H=X[G-FW1];if(H[0]===-1){let[,B]=H;throw new ZY(V40(B,"Error",K))}let[F,U,N]=H;return{url:Kd$(F,K),properties:BW1(U,K),headers:Jd$(N??{},K)}}throw new ZY("No matching endpoint.")},DW1=($=[],Z)=>{let Q={},Y={...Z,referenceRecord:{...Z.referenceRecord}},X=!1;for(let J of $){let{result:G,toAssign:W}=Xd$(J,Y);if(!G)return{result:G};if(W)X=!0,Q[W.name]=W.value,Y.referenceRecord[W.name]=W.value,Z.logger?.debug?.(`${I40} assign: ${W.name} := ${lE(W.value)}`)}if(X)return{result:!0,referenceRecord:Q};return{result:!0}},kK6=($,Z)=>{let{conditions:Q,endpoint:Y}=$,{result:X,referenceRecord:J}=DW1(Q,Z);if(!X)return;let G=J?{...Z,referenceRecord:{...Z.referenceRecord,...J}}:Z,{url:W,properties:K,headers:H}=Y;Z.logger?.debug?.(`${I40} Resolving endpoint from template: ${lE(Y)}`);let F={url:Kd$(W,G)};if(H!=null)F.headers=Jd$(H,G);if(K!=null)F.properties=BW1(K,G);return F},SK6=($,Z)=>{let{conditions:Q,error:Y}=$,{result:X,referenceRecord:J}=DW1(Q,Z);if(!X)return;let G=J?{...Z,referenceRecord:{...Z.referenceRecord,...J}}:Z;throw new ZY(V40(Y,"Error",G))},Hd$=($,Z)=>{for(let Q of $)if(Q.type==="endpoint"){let Y=kK6(Q,Z);if(Y)return Y}else if(Q.type==="error")SK6(Q,Z);else if(Q.type==="tree"){let Y=Fd$.evaluateTreeRule(Q,Z);if(Y)return Y}else throw new ZY(`Unknown endpoint rule: ${Q}`);throw new ZY("Rules evaluation failed")},CK6=($,Z)=>{let{conditions:Q,rules:Y}=$,{result:X,referenceRecord:J}=DW1(Q,Z);if(!X)return;let G=J?{...Z,referenceRecord:{...Z.referenceRecord,...J}}:Z;return Fd$.evaluateRules(Y,G)},Fd$={evaluateRules:Hd$,evaluateTreeRule:CK6},_K6=($,Z)=>{let{endpointParams:Q,logger:Y}=Z,{parameters:X,rules:J}=$;Z.logger?.debug?.(`${I40} Initial EndpointParams: ${lE(Q)}`);for(let W in X){let K=X[W],H=Q[W];if(H==null&&K.default!=null){Q[W]=K.default;continue}if(K.required&&H==null)throw new ZY(`Missing required parameter: '${W}'`)}let G=Hd$(J,{endpointParams:Q,logger:Y,referenceRecord:{}});return Z.logger?.debug?.(`${I40} Resolved endpoint: ${lE(G)}`),G},vK6=($)=>{let{endpoint:Z}=$;if(Z===void 0)$.endpoint=async()=>{throw Error("@smithy/middleware-endpoint: (default endpointRuleSet) endpoint is not set - you must configure an endpoint.")};return $},bK6=nm$(GV0),xK6=BK6(GV0),fK6=om$(GV0),yK6=NK6(GV0);gK6.BinaryDecisionDiagram=NW1;gK6.EndpointCache=sm$;gK6.EndpointError=ZY;gK6.customEndpointFunctions=am$;gK6.decideEndpoint=VK6;gK6.endpointMiddleware=fK6;gK6.endpointMiddlewareOptions=rm$;gK6.getEndpointFromInstructions=bK6;gK6.getEndpointPlugin=yK6;gK6.isIpAddress=$d$;gK6.resolveEndpoint=_K6;gK6.resolveEndpointConfig=xK6;gK6.resolveEndpointRequiredConfig=vK6;gK6.resolveParams=tm$});var WJ=b((gF6)=>{var{createHmac:QH6,createHash:YH6,getRandomValues:XH6}=M0("crypto"),{ReadStream:JH6,lstatSync:GH6,fstatSync:WH6}=M0("fs"),{HttpResponse:KH6}=BN(),{toEndpointV1:HH6}=QZ(),{Duplex:FH6,Readable:k40,Writable:jd$,PassThrough:Ud$}=M0("stream"),Ed$=($)=>typeof ArrayBuffer==="function"&&$ instanceof ArrayBuffer||Object.prototype.toString.call($)==="[object ArrayBuffer]",ui=($,Z=0,Q=$.byteLength-Z)=>{if(!Ed$($))throw TypeError(`The "input" argument must be ArrayBuffer. Received type ${typeof $} (${$})`);return Buffer.from($,Z,Q)},FV0=($,Z)=>{if(typeof $!=="string")throw TypeError(`The "input" argument must be of type string. Received type ${typeof $} (${$})`);return Z?Buffer.from($,Z):Buffer.from($)},UH6=/^[A-Za-z0-9+/]*={0,2}$/,zd$=($)=>{if($.length*3%4!==0)throw TypeError("Incorrect padding on base64 string.");if(!UH6.exec($))throw TypeError("Invalid base64 string.");let Z=FV0($,"base64");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength)},UV0=($)=>{let Z=FV0($,"utf8");return new Uint8Array(Z.buffer,Z.byteOffset,Z.byteLength/Uint8Array.BYTES_PER_ELEMENT)},PW1=($)=>{let Z;if(typeof $==="string")Z=UV0($);else Z=$;if(typeof Z!=="object"||typeof Z.byteOffset!=="number"||typeof Z.byteLength!=="number")throw Error("@smithy/util-base64: toBase64 encoder function only accepts string | Uint8Array.");return ui(Z.buffer,Z.byteOffset,Z.byteLength).toString("base64")};function NH6($,Z,Q,Y){return class X extends Uint8Array{static fromString(J,G="utf-8"){if(typeof J==="string"){if(G==="base64")return X.mutate(Y(J));return X.mutate(Z(J))}throw Error(`Unsupported conversion from ${typeof J} to Uint8ArrayBlobAdapter.`)}static mutate(J){return Object.setPrototypeOf(J,X.prototype),J}transformToString(J="utf-8"){if(J==="base64")return Q(this);return $(this)}}}var Pd$=($)=>{if(typeof $==="string")return $;if(typeof $!=="object"||typeof $.byteOffset!=="number"||typeof $.byteLength!=="number")throw Error("@smithy/util-utf8: toUtf8 encoder function only accepts string | Uint8Array.");return ui($.buffer,$.byteOffset,$.byteLength).toString("utf8")},XX=Array.from({length:256},($,Z)=>Z.toString(16).padStart(2,"0"));function BH6($){if(typeof crypto<"u"&&typeof crypto.randomUUID==="function")return()=>crypto.randomUUID();return()=>{let Z=new Uint8Array(16);return $(Z),Z[6]=Z[6]&15|64,Z[8]=Z[8]&63|128,XX[Z[0]]+XX[Z[1]]+XX[Z[2]]+XX[Z[3]]+"-"+XX[Z[4]]+XX[Z[5]]+"-"+XX[Z[6]]+XX[Z[7]]+"-"+XX[Z[8]]+XX[Z[9]]+"-"+XX[Z[10]]+XX[Z[11]]+XX[Z[12]]+XX[Z[13]]+XX[Z[14]]+XX[Z[15]]}}var DH6=($,Z,Q=(Y)=>Y)=>$,LH6=($)=>{switch($){case"true":return!0;case"false":return!1;default:throw Error(`Unable to parse boolean value "${$}"`)}},OH6=($)=>{if($===null||$===void 0)return;if(typeof $==="number"){if($===0||$===1)b40.warn(KV0(`Expected boolean, got ${typeof $}: ${$}`));if($===0)return!1;if($===1)return!0}if(typeof $==="string"){let Z=$.toLowerCase();if(Z==="false"||Z==="true")b40.warn(KV0(`Expected boolean, got ${typeof $}: ${$}`));if(Z==="false")return!1;if(Z==="true")return!0}if(typeof $==="boolean")return $;throw TypeError(`Expected boolean, got ${typeof $}: ${$}`)},_40=($)=>{if($===null||$===void 0)return;if(typeof $==="string"){let Z=parseFloat($);if(!Number.isNaN(Z)){if(String(Z)!==String($))b40.warn(KV0(`Expected number but observed string: ${$}`));return Z}}if(typeof $==="number")return $;throw TypeError(`Expected number, got ${typeof $}: ${$}`)},wH6=Math.ceil(340282346638528860000000000000000000000),WV0=($)=>{let Z=_40($);if(Z!==void 0&&!Number.isNaN(Z)&&Z!==1/0&&Z!==-1/0){if(Math.abs(Z)>wH6)throw TypeError(`Expected 32-bit float, got ${$}`)}return Z},v40=($)=>{if($===null||$===void 0)return;if(Number.isInteger($)&&!Number.isNaN($))return $;throw TypeError(`Expected integer, got ${typeof $}: ${$}`)},jH6=v40,wW1=($)=>AW1($,32),jW1=($)=>AW1($,16),EW1=($)=>AW1($,8),AW1=($,Z)=>{let Q=v40($);if(Q!==void 0&&EH6(Q,Z)!==Q)throw TypeError(`Expected ${Z}-bit integer, got ${$}`);return Q},EH6=($,Z)=>{switch(Z){case 32:return Int32Array.of($)[0];case 16:return Int16Array.of($)[0];case 8:return Int8Array.of($)[0]}},zH6=($,Z)=>{if($===null||$===void 0){if(Z)throw TypeError(`Expected a non-null value for ${Z}`);throw TypeError("Expected a non-null value")}return $},Ad$=($)=>{if($===null||$===void 0)return;if(typeof $==="object"&&!Array.isArray($))return $;let Z=Array.isArray($)?"array":typeof $;throw TypeError(`Expected object, got ${Z}: ${$}`)},PH6=($)=>{if($===null||$===void 0)return;if(typeof $==="string")return $;if(["boolean","number","bigint"].includes(typeof $))return b40.warn(KV0(`Expected string, got ${typeof $}: ${$}`)),String($);throw TypeError(`Expected string, got ${typeof $}: ${$}`)},AH6=($)=>{if($===null||$===void 0)return;let Z=Ad$($),Q=[];for(let Y in Z)if(Z[Y]!=null)Q.push(Y);if(Q.length===0)throw TypeError("Unions must have exactly one non-null member. None were found.");if(Q.length>1)throw TypeError(`Unions must have exactly one non-null member. Keys ${Q} were not null.`);return Z},TW1=($)=>{if(typeof $=="string")return _40(mi($));return _40($)},TH6=TW1,Td$=($)=>{if(typeof $=="string")return WV0(mi($));return WV0($)},RH6=/(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g,mi=($)=>{let Z=$.match(RH6);if(Z===null||Z[0].length!==$.length)throw TypeError("Expected real number, got implicit NaN");return parseFloat($)},RW1=($)=>{if(typeof $=="string")return Rd$($);return _40($)},qH6=RW1,MH6=RW1,IH6=($)=>{if(typeof $=="string")return Rd$($);return WV0($)},Rd$=($)=>{switch($){case"NaN":return NaN;case"Infinity":return 1/0;case"-Infinity":return-1/0;default:throw Error(`Unable to parse float value: ${$}`)}},qd$=($)=>{if(typeof $==="string")return v40(mi($));return v40($)},VH6=qd$,kH6=($)=>{if(typeof $==="string")return wW1(mi($));return wW1($)},li=($)=>{if(typeof $==="string")return jW1(mi($));return jW1($)},Md$=($)=>{if(typeof $==="string")return EW1(mi($));return EW1($)},KV0=($)=>{return String(TypeError($).stack||$).split(`
 `).slice(0,5).filter((Z)=>!Z.includes("stackTraceWarning")).join(`
 `)},b40={warn:console.warn},SH6=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],qW1=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function CH6($){let Z=$.getUTCFullYear(),Q=$.getUTCMonth(),Y=$.getUTCDay(),X=$.getUTCDate(),J=$.getUTCHours(),G=$.getUTCMinutes(),W=$.getUTCSeconds(),K=X<10?`0${X}`:`${X}`,H=J<10?`0${J}`:`${J}`,F=G<10?`0${G}`:`${G}`,U=W<10?`0${W}`:`${W}`;return`${SH6[Y]}, ${K} ${qW1[Q]} ${Z} ${H}:${F}:${U} GMT`}var _H6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?[zZ]$/),vH6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=_H6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H]=Z,F=li(ci(Y)),U=LN(X,"month",1,12),N=LN(J,"day",1,31);return S40(F,U,N,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})},bH6=new RegExp(/^(\d{4})-(\d{2})-(\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(([-+]\d{2}\:\d{2})|[zZ])$/),xH6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-3339 date-times must be expressed as strings");let Z=bH6.exec($);if(!Z)throw TypeError("Invalid RFC-3339 date-time value");let[Q,Y,X,J,G,W,K,H,F]=Z,U=li(ci(Y)),N=LN(X,"month",1,12),B=LN(J,"day",1,31),L=S40(U,N,B,{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H});if(F.toUpperCase()!="Z")L.setTime(L.getTime()-tH6(F));return L},fH6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),yH6=new RegExp(/^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? GMT$/),gH6=new RegExp(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( [1-9]|\d{2}) (\d{1,2}):(\d{2}):(\d{2})(?:\.(\d+))? (\d{4})$/),hH6=($)=>{if($===null||$===void 0)return;if(typeof $!=="string")throw TypeError("RFC-7231 date-times must be expressed as strings");let Z=fH6.exec($);if(Z){let[Q,Y,X,J,G,W,K,H]=Z;return S40(li(ci(J)),LW1(X),LN(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H})}if(Z=yH6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return mH6(S40(lH6(J),LW1(X),LN(Y,"day",1,31),{hours:G,minutes:W,seconds:K,fractionalMilliseconds:H}))}if(Z=gH6.exec($),Z){let[Q,Y,X,J,G,W,K,H]=Z;return S40(li(ci(H)),LW1(Y),LN(X.trimLeft(),"day",1,31),{hours:J,minutes:G,seconds:W,fractionalMilliseconds:K})}throw TypeError("Invalid RFC-7231 date-time value")},uH6=($)=>{if($===null||$===void 0)return;let Z;if(typeof $==="number")Z=$;else if(typeof $==="string")Z=TW1($);else if(typeof $==="object"&&$.tag===1)Z=$.value;else throw TypeError("Epoch timestamps must be expressed as floating point numbers or their string representation");if(Number.isNaN(Z)||Z===1/0||Z===-1/0)throw TypeError("Epoch timestamps must be valid, non-Infinite, non-NaN numerics");return new Date(Math.round(Z*1000))},S40=($,Z,Q,Y)=>{let X=Z-1;return iH6($,X,Q),new Date(Date.UTC($,X,Q,LN(Y.hours,"hour",0,23),LN(Y.minutes,"minute",0,59),LN(Y.seconds,"seconds",0,60),nH6(Y.fractionalMilliseconds)))},lH6=($)=>{let Z=new Date().getUTCFullYear(),Q=Math.floor(Z/100)*100+li(ci($));if(Q<Z)return Q+100;return Q},cH6=1576800000000,mH6=($)=>{if($.getTime()-new Date().getTime()>cH6)return new Date(Date.UTC($.getUTCFullYear()-100,$.getUTCMonth(),$.getUTCDate(),$.getUTCHours(),$.getUTCMinutes(),$.getUTCSeconds(),$.getUTCMilliseconds()));return $},LW1=($)=>{let Z=qW1.indexOf($);if(Z<0)throw TypeError(`Invalid month: ${$}`);return Z+1},dH6=[31,28,31,30,31,30,31,31,30,31,30,31],iH6=($,Z,Q)=>{let Y=dH6[Z];if(Z===1&&pH6($))Y=29;if(Q>Y)throw TypeError(`Invalid day for ${qW1[Z]} in ${$}: ${Q}`)},pH6=($)=>{return $%4===0&&($%100!==0||$%400===0)},LN=($,Z,Q,Y)=>{let X=Md$(ci($));if(X<Q||X>Y)throw TypeError(`${Z} must be between ${Q} and ${Y}, inclusive`);return X},nH6=($)=>{if($===null||$===void 0)return 0;return Td$("0."+$)*1000},tH6=($)=>{let Z=$[0],Q=1;if(Z=="+")Q=1;else if(Z=="-")Q=-1;else throw TypeError(`Offset direction, ${Z}, must be "+" or "-"`);let Y=Number($.substring(1,3)),X=Number($.substring(4,6));return Q*(Y*60+X)*60*1000},ci=($)=>{let Z=0;while(Z<$.length-1&&$.charAt(Z)==="0")Z++;if(Z===0)return $;return $.slice(Z)},Vy=function(Z){return Object.assign(new String(Z),{deserializeJSON(){return JSON.parse(String(Z))},toString(){return String(Z)},toJSON(){return String(Z)}})};Vy.from=($)=>{if($&&typeof $==="object"&&($ instanceof Vy||("deserializeJSON"in $)))return $;else if(typeof $==="string"||Object.getPrototypeOf($)===String.prototype)return Vy(String($));return Vy(JSON.stringify($))};Vy.fromObject=Vy.from;function oH6($){if($.includes(",")||$.includes('"'))$=`"${$.replace(/"/g,"\\\"")}"`;return $}var MW1="(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)(?:[ne|u?r]?s?day)?",IW1="(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)",VW1="(\\d?\\d):(\\d{2}):(\\d{2})(?:\\.(\\d+))?",Id$="(\\d?\\d)",Vd$="(\\d{4})",rH6=new RegExp(/^(\d{4})-(\d\d)-(\d\d)[tT](\d\d):(\d\d):(\d\d)(\.(\d+))?(([-+]\d\d:\d\d)|[zZ])$/),sH6=new RegExp(`^${MW1}, ${Id$} ${IW1} ${Vd$} ${VW1} GMT$`),aH6=new RegExp(`^${MW1}, ${Id$}-${IW1}-(\\d\\d) ${VW1} GMT$`),eH6=new RegExp(`^${MW1} ${IW1} ( [1-9]|\\d\\d) ${VW1} ${Vd$}$`),$F6=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],ZF6=($)=>{if($==null)return;let Z=NaN;if(typeof $==="number")Z=$;else if(typeof $==="string"){if(!/^-?\d*\.?\d+$/.test($))throw TypeError("parseEpochTimestamp - numeric string invalid.");Z=Number.parseFloat($)}else if(typeof $==="object"&&$.tag===1)Z=$.value;if(isNaN(Z)||Math.abs(Z)===1/0)throw TypeError("Epoch timestamps must be valid finite numbers.");return new Date(Math.round(Z*1000))},QF6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC3339 timestamps must be strings");let Z=rH6.exec($);if(!Z)throw TypeError(`Invalid RFC3339 timestamp format ${$}`);let[,Q,Y,X,J,G,W,,K,H]=Z;XL(Y,1,12),XL(X,1,31),XL(J,0,23),XL(G,0,59),XL(W,0,60);let F=new Date(Date.UTC(Number(Q),Number(Y)-1,Number(X),Number(J),Number(G),Number(W),Number(K)?Math.round(parseFloat(`0.${K}`)*1000):0));if(F.setUTCFullYear(Number(Q)),H.toUpperCase()!="Z"){let[,U,N,B]=/([+-])(\d\d):(\d\d)/.exec(H)||[void 0,"+",0,0],L=U==="-"?1:-1;F.setTime(F.getTime()+L*(Number(N)*60*60*1000+Number(B)*60*1000))}return F},YF6=($)=>{if($==null)return;if(typeof $!=="string")throw TypeError("RFC7231 timestamps must be strings.");let Z,Q,Y,X,J,G,W,K;if(K=sH6.exec($))[,Z,Q,Y,X,J,G,W]=K;else if(K=aH6.exec($))[,Z,Q,Y,X,J,G,W]=K,Y=(Number(Y)+1900).toString();else if(K=eH6.exec($))[,Q,Z,X,J,G,W,Y]=K;if(Y&&G){let H=Date.UTC(Number(Y),$F6.indexOf(Q),Number(Z),Number(X),Number(J),Number(G),W?Math.round(parseFloat(`0.${W}`)*1000):0);XL(Z,1,31),XL(X,0,23),XL(J,0,59),XL(G,0,60);let F=new Date(H);return F.setUTCFullYear(Number(Y)),F}throw TypeError(`Invalid RFC7231 date-time value ${$}.`)};function XL($,Z,Q){let Y=Number($);if(Y<Z||Y>Q)throw Error(`Value ${Y} out of range [${Z}, ${Q}]`)}function XF6($,Z,Q){if(Q<=0||!Number.isInteger(Q))throw Error("Invalid number of delimiters ("+Q+") for splitEvery.");let Y=$.split(Z);if(Q===1)return Y;let X=[],J="";for(let G=0;G<Y.length;G++){if(J==="")J=Y[G];else J+=Z+Y[G];if((G+1)%Q===0)X.push(J),J=""}if(J!=="")X.push(J);return X}var JF6=($)=>{let Z=$.length,Q=[],Y=!1,X=void 0,J=0;for(let G=0;G<Z;++G){let W=$[G];switch(W){case'"':if(X!=="\\")Y=!Y;break;case",":if(!Y)Q.push($.slice(J,G)),J=G+1;break}X=W}return Q.push($.slice(J)),Q.map((G)=>{G=G.trim();let W=G.length;if(W<2)return G;if(G[0]==='"'&&G[W-1]==='"')G=G.slice(1,W-1);return G.replace(/\\"/g,'"')})},Nd$=/^-?\d*(\.\d+)?$/;class NV0{string;type;constructor($,Z){if(this.string=$,this.type=Z,!Nd$.test($))throw Error('@smithy/core/serde - NumericValue must only contain [0-9], at most one decimal point ".", and an optional negation prefix "-".')}toString(){return this.string}static[Symbol.hasInstance]($){if(!$||typeof $!=="object")return!1;let Z=$;return NV0.prototype.isPrototypeOf($)||Z.type==="bigDecimal"&&Nd$.test(Z.string)}}function GF6($){return new NV0(String($),"bigDecimal")}var kd$={},zW1={};for(let $=0;$<256;$++){let Z=$.toString(16).toLowerCase();if(Z.length===1)Z=`0${Z}`;kd$[$]=Z,zW1[Z]=$}function WF6($){if($.length%2!==0)throw Error("Hex encoded strings must have an even number length");let Z=new Uint8Array($.length/2);for(let Q=0;Q<$.length;Q+=2){let Y=$.slice(Q,Q+2).toLowerCase();if(Y in zW1)Z[Q/2]=zW1[Y];else throw Error(`Cannot decode unrecognized sequence ${Y} as hexadecimal`)}return Z}function Sd$($){let Z="";for(let Q=0;Q<$.byteLength;Q++)Z+=kd$[$[Q]];return Z}var KF6=($)=>{if(!$)return 0;if(typeof $==="string")return Buffer.byteLength($);else if(typeof $.byteLength==="number")return $.byteLength;else if(typeof $.size==="number")return $.size;else if(typeof $.start==="number"&&typeof $.end==="number")return $.end+1-$.start;else if($ instanceof JH6){if($.path!=null)return GH6($.path).size;else if(typeof $.fd==="number")return WH6($.fd).size}throw Error(`Body Length computation failed for ${$}`)},Cd$=($)=>{if(typeof $==="string")return UV0($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength/Uint8Array.BYTES_PER_ELEMENT);return new Uint8Array($)},_d$=($,Z)=>(Q,Y)=>async(X)=>{let{response:J}=await Q(X);try{let G=await Z(J,$);return{response:J,output:G}}catch(G){if(Object.defineProperty(G,"$response",{value:J,enumerable:!1,writable:!1,configurable:!1}),!("$metadata"in G)){try{G.message+=`
@@ -3648,7 +3648,7 @@ ${J.join(`
 `)}`:X}function Ss6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var wJ8=200,zs6=12,As6,Rs6=300,y_0=3;var ZO1=D(()=>{J7();o$();f_0();As6={aheadBy:0,behindBy:0,files:[]}});function _s6($){if(!$||$.includes(".."))return!1;return Cs6.test($)}function EJ8($){return vs6.includes($)}function QO1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!_s6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function YO1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Cs6,vs6;var zJ8=D(()=>{Cs6=/^[\w./@-]+$/;vs6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function I50($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function AJ8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new wz(b7);let J=await dj($.storage,X,Y);if(J&&await qD($.storage,J)){let F=await hU($,J,{forceRefresh:!0}).catch((U)=>{throw new wz(U instanceof Error?U.message:b7)});await PJ8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new wz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await ym({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:b7;throw new wz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await lU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=dw$(F instanceof Error?F.message:String(F));throw U?new wz(N):F});await PJ8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function PJ8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Yn($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await GE(K,bs6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var bs6=10485760,wz;var XO1=D(()=>{xW();I_0();j$0();JF0();z10();J7();wz=class wz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function fs6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!xs6.test(Z))throw Error(`Invalid branch name: ${$}`)}function Og($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(gs6)])}async function us6($,Z){let Q=$.var.studioContext,Y=rY(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Cf(G?.metadata?.runtime);if(W)return W;let K=KR0(Z.virtualMcpMetadata),H=K==="cms"?await yL1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)E$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function ls6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await f7($.var.studioContext)}catch{return null}}function Kn($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function k50($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=I50(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=X0(Y);return bm(Y,J.id,X)}function GO1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=JO$(Z);if(Y!==void 0)return $.json({error:Q},429,{...kZ,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof e6)return $.json({error:Q},409,kZ);let X=lW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,kZ)}return $.json({error:Q},502,kZ)}async function JO1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function qJ8($){try{let Z=await k50($),Q=await eL1(Z,$.get("vmClaim").branch);return $.json(Q,200,kZ)}catch(Z){return GO1($,Z)}}function V50($,Z){let Y=(h_0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return h_0.set($,X),X.finally(()=>{if(h_0.get($)===X)h_0.delete($)}),Y}async function EQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,kZ);let Y=Q?.runner??Kn($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...kZ}})}}let L=await B.text(),O=Q?.redactRepoDir?cs6(L):L,w=B.headers.get("content-type")??"application/json";return new Response(O,{status:B.status,headers:{"content-type":w,...kZ}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((O,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let L=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${L}`},502)}}function cs6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function MJ8($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function ms6($){return IJ8.includes($)}var xs6,ys6=524288,TJ8=65536,gs6=1e4,RJ8=2000,hs6,h_0,kZ,IJ8,VJ8=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",hs6),$.post("/:virtualMcpId/:branch/write",(Q)=>EQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>EQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>EQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>EQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>EQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>EQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>EQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:Og(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return EQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return EQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>EQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>EQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!ms6(Y))return Q.json({error:`step must be one of: ${IJ8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await yL1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await ls6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,kZ);if(Y==="start"){let G=X0(Q.var.studioContext),W=Ld(X.virtualMcpMetadata);try{await XR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return EQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return RL(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return MX8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return qJ8(Q);return Z(Q)});let Z=(Q)=>EQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(RJ8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return qJ8(Q);return EQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(RJ8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await k50(Q),G=await $O1(J,Y.branch,X.base);return Q.json(G,200,kZ)}catch(X){return GO1(Q,X)}return EQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,kZ);let Y=Kn(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return V50(X,async()=>{try{await gL1(W,Y,X);let K=I50(J,G);if(K)await AJ8(W,Y,X,K)}catch(K){if(K instanceof wz)return Q.json({error:K.message},403,kZ);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,kZ)}return EQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return V50(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,kZ);try{let G=await k50(Q);return await jJ8(G,Y.branch,J),Q.json({ok:!0},200,kZ)}catch(G){let W=lW(G)===409||G instanceof e6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,kZ)}});return V50(Y.claimName,()=>EQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return V50(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await k50(Q),H=W.base??await K.getDefaultBranch();return await g_0(K,Y.branch,H),Q.json({ok:!0},200,kZ)}catch(W){return GO1(Q,W)}});let X=Kn(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return V50(J,async()=>{try{await gL1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,kZ)}return EQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/judge-review",s5({maxSize:ys6,onError:(Q)=>Q.json({error:"Payload too large"},413,kZ)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Kn(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,L]=kX8(F)&&N?[F,U]:X?await Promise.all([MJ8(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),MJ8(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await k50(Q);return Promise.all([eL1(w,Y.branch),$O1(w,Y.branch)])})();await kW(K,X0(K).id,"judging whether a change needs review");let O=await _X8(K,B,L,typeof H.language==="string"?H.language:void 0);return Q.json(O,200,kZ)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,kZ);return Q.json({error:F},502,kZ)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=Kn(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return JO1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",s5({maxSize:TJ8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=Kn(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=QO1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=YO1(J,W.resolveType);return JO1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",s5({maxSize:TJ8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):Od(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=QO1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!EJ8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=YO1(G,K.resolveType);return JO1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var kJ8=D(()=>{J8();NK();Qn();fL1();Dd();TX8();oY();wd();RX8();JG();jH();qX8();IX8();xZ1();w$0();vX8();J7();R5();ZO1();zJ8();WR0();XO1();xs6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;hs6=M_0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=g0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=X0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{fs6(G)}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=o10({orgId:X.id,virtualMcpId:J,branch:G}),H=await lZ1(Q,G),F=cZ1(H,Y),U=AX8({userId:F,projectRef:K}),N=W.metadata??null,B=await us6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z();let L;try{L=await f7(Q)}catch{L=null}if(!L)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:L,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z()});h_0=new Map;kZ={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};IJ8=["clone","install","start"]});function SJ8($,Z,Q){let Y=WO1.get($);if(!Y)Y={pending:null,running:!1},WO1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)is6($,Y);return J}async function is6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await ps6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)WO1.delete($)}}async function ps6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await Wn(Z,Q),W=await Z.listDecofileEntries(G,Y),K=rL1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let L=sL1(K,N),O=`${JSON.stringify(B,null,2)}
 `;await BJ8(Z.repo,O);let w=L[0]??`${x_0(Y)}/${mL1(N)}.json`;H.push({path:w,content:O});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:O});for(let E of L.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of sL1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await DJ8(Z,F.values(),X),{decofile:B,skipped:L}=z50(N);if(L.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:EH(Z.repo),branch:Q,packagePath:Y,blocks:L.map((O)=>O.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:ns6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof e6)||J>=ds6-1)throw N;await F$(L7(2000,200,J,2,0.5))}}}function ns6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return F91(Y,$.deps.coAuthor)}var ds6=3,WO1;var CJ8=D(()=>{MT0();k_0();i4();o$();J7();f_0();WO1=new Map});import{createHmac as _J8,randomBytes as ts6,timingSafeEqual as os6}from"crypto";function vJ8(){if(u_0)return u_0;let $;try{let Z=j0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return u_0=$?Buffer.from($):ts6(32),u_0}function KO1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+rs6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=_J8("sha256",vJ8()).update(Y).digest("base64url");return`${Y}.${X}`}function bJ8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(_J8("sha256",vJ8()).update(Y).digest("base64url"));if(X.length!==J.length||!os6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var rs6=21600000,u_0=null;var xJ8=D(()=>{s1()});function l_0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function ss6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=l_0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function fJ8($){let Z;try{Z=l_0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=ss6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=l_0(G),K=W&&l_0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as Hn}from"zod";function es6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&as6.test($)}function lJ8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function S50($){let Z=$.get("decofileScope");return bm($.var.studioContext,Z.organizationId,Z.repository)}function C50($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof e6)return $.json({error:Q},409);let Y=lW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function cJ8(){let $=new Z1;return $.use("/:virtualMcpId/:branch",uJ8),$.use("/:virtualMcpId/:branch/*",uJ8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await S50(Z),X=await LJ8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(fJ8(X.decofile),200,{...J,"content-type":"application/json"});let G=KO1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(lJ8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return C50(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await S50(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return C50(Z,X)}}),$.patch("/:virtualMcpId/:branch",Za6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=Qa6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=P50(X.data)}catch(G){if(G instanceof A50)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{V_0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(cL1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await S50(Z),W=await SJ8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Yn(Y)},J),K=KO1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:lJ8(Z)})}catch(G){return C50(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await S50(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(lW(W)!==409)throw W;await g_0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(lW(G)===409)return Z.json({error:"merge-conflict"},409);if(lW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return C50(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await S50(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(lW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return C50(Z,Y)}}),$}var as6,yJ8=500,gJ8=1048576,hJ8=1024,$a6=8388608,Za6,Qa6,uJ8;var mJ8=D(()=>{WR0();k_0();J8();NK();fL1();I_0();XO1();J7();CJ8();xJ8();ZO1();f_0();jH();as6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Za6=s5({maxSize:$a6,onError:($)=>$.json({error:"Payload too large"},413)}),Qa6=Hn.object({set:Hn.record(Hn.string(),Hn.unknown()).optional(),delete:Hn.array(Hn.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=yJ8,{message:`Patch cannot touch more than ${yJ8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=gJ8),{message:`Each block must be at most ${gJ8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=hJ8),{message:`Each block key must be at most ${hJ8} characters`}),uJ8=M_0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!es6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!bJ8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await iJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Od(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=I50(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var dJ8=($)=>{let Z=new Z1;if(Z.use("*",vp),Z.use("*",OZ8),Z.route("/",DZ8($.voiceSessions)),Z.route("/",xC0()),Z.route("/",aZ8()),Z.route("/",gZ8()),Z.route("/",WX8()),Z.route("/",HX8()),Z.route("/",eY8()),Z.route("/",JX8()),Z.route("/",ZX8()),Z.route("/",T_0()),Z.route("/tools",OX8()),Z.route("/",BX8()),Z.route("/",CY8({kvStorage:$.kvStorage})),Z.route("/",kY8()),Z.route("/fs",dY8({getConnection:$.getNatsConnection})),Z.route("/sandbox",VJ8()),Z.route("/decofile",cJ8()),Z.route("/",rY8()),Z.route("/",pY8()),Z.route("/deco-sites",yC0()),Z.route("/hosting",IZ8()),Z.route("/monitor",bZ8()),Z.route("/sso",kC0()),Z.route("/",R_0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",AZ8()),$.mountDevAssets)Z.route("/dev-assets",lC0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of IL1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",J68()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of IL1)Z.route(Q,tY8());return Z.route("/mcp",VI0()),Z.route("/mcp/self",E_0()),Z.route("/mcp",CI0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var iJ8=D(()=>{J8();LZ8();wZ8();jC0();TZ8();ZD1();VZ8();xZ8();cC0();Fz();rB1();GD1();SY8();_Y8();iY8();nY8();H40();lB1();_I0();ML1();oY8();sY8();$X8();QX8();SL1();KX8();FX8();DX8();CL1();wX8();_L1();kI0();kJ8();mJ8()});import{z as wg}from"zod";class HO1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new tJ8.Kvm(c_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:c_0.StorageType.Memory,ttl:oJ8.nanos(gD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?nJ8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await F$(200);continue}let G=pJ8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await F$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,pJ8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new R1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?nJ8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var c_0,tJ8,oJ8,pJ8,nJ8;var rJ8=D(()=>{vJ();sU();o$();c_0=C(MK(),1),tJ8=C(EA(),1),oJ8=C(yz(),1),pJ8=new TextEncoder,nJ8=wg.discriminatedUnion("state",[wg.object({state:wg.literal("ready"),agentId:wg.string()}),wg.object({state:wg.literal("creating"),expiresAt:wg.number()})])});import{z as Fn}from"zod";function Ya6($){return{model:$.model,instructions:`${YI$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class FO1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ya6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Fn.object({session:Fn.object({id:Fn.string().min(1)}),transport:Fn.object({type:Fn.literal("webrtc"),sdp:Fn.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var sJ8=D(()=>{sU()});var aJ8;var eJ8=D(()=>{aJ8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function UO1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:ZI$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:aJ8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:gD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var $G8=D(()=>{sU();eJ8()});import{z as UJ}from"zod";import{createHash as Xa6,createHmac as Ja6}from"crypto";class m_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Xa6("sha256").update(JSON.stringify(UO1($))).digest("hex"),this.conversationKey=Ja6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new m_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=UJ.object({agents:UJ.array(UJ.object({agent_id:UJ.string(),name:UJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return UJ.object({platform_settings:UJ.object({auth:UJ.object({enable_auth:UJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...UO1(this.config)},AbortSignal.timeout(15000));return UJ.object({agent_id:UJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return UJ.object({token:UJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return UJ.object({token:UJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var ZG8=D(()=>{$G8()});import{createHmac as Ga6,timingSafeEqual as Wa6}from"crypto";import{z as Un}from"zod";function YG8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Ga6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function XG8($,Z){let Q=Buffer.from(JSON.stringify(QG8.parse($))).toString("base64url");return`${Q}.${YG8(Q,Z)}`}function JG8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(YG8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Wa6(W,G))return null;try{let K=QG8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+gD)return null;return K.data}catch{return null}}var QG8;var GG8=D(()=>{sU();QG8=Un.object({sessionId:Un.string().uuid(),organizationId:Un.string().min(1).max(256),userId:Un.string().min(1).max(256),threadId:Un.string().min(1).max(256),expiresAt:Un.number().int().positive()})});import{z as NO1}from"zod";function WG8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return BO1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var BO1;var KG8=D(()=>{BO1=NO1.object({provider:NO1.enum(["elevenlabs","openai"]),model:NO1.string().trim().min(1).max(128)})});import{createHash as Ka6}from"crypto";import{z as Nn}from"zod";function Bn($){return`user.${Ka6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class LO1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new HG8.Kvm(i_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:i_0.StorageType.Memory,ttl:FG8.nanos(gD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=WG8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+gD},W=XG8(G,this.deps.secret),K=await this.kv(),H=Bn(G),F=await K.get(H),U=F?.operation==="PUT"?d_0.parse(F.json()):null,N=DO1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let L=await J.createSession({language:Q,model:X.model,safetyIdentifier:Bn($)});return{token:W,...L,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=JG8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Bn(Q),J=await Y.get(X),G=J?.operation==="PUT"?d_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,DO1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Bn(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?d_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,DO1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Bn($));if(Q?.operation==="PUT"&&d_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Bn($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var i_0,HG8,FG8,d_0,DO1;var UG8=D(()=>{vJ();sU();GG8();KG8();i_0=C(MK(),1),HG8=C(EA(),1),FG8=C(yz(),1),d_0=Nn.object({sessionId:Nn.string().uuid(),expiresAt:Nn.number(),connected:Nn.boolean().optional(),conversation:BO1.optional(),characters:Nn.number().int().nonnegative(),requests:Nn.number().int().nonnegative()}),DO1=new TextEncoder});function Ha6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Fa6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},NG8=()=>{let $=new Z1;return $.use("*",Fa6),$.get("/",async(Z)=>{let Q=j0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await wG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Ha6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var BG8=D(()=>{J8();s1();AS0()});import{z as y1}from"zod";function _N($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function za6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Pa6($,Z,Q){try{return JSON.parse($)}catch{throw new OG8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Aa6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Pa6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ta6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?HU(Q.function.parameters):HU({type:"object",properties:{}});return[Q.function.name,i$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Ra6($){if(!$)return;return{openai:{response_format:$}}}function qa6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function DG8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function LG8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Ua6=256,Na6,Ba6,Da6,La6,Oa6,wa6,ja6,Ea6,OG8,wG8,jG8;var EG8=D(()=>{n4();J8();Qn();dH();Na6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Ba6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Da6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Ba6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),La6=y1.object({type:y1.literal("text")}),Oa6=y1.object({type:y1.literal("json_object")}),wa6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),ja6=y1.union([La6,Oa6,wa6]),Ea6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Da6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Na6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:ja6.optional(),user:y1.string().optional()});OG8=class OG8 extends Error{constructor($){super($);this.name="MessageConversionError"}};wG8=new Z1;wG8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(_N("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(_N("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(_N("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Ea6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(_N(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=za6(J.model);if(!G)return $.json(_N("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>CP(E.providerId));if(!j)return $.json(_N("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(_N(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Aa6(J.messages),N=J.tools?Ta6(J.tools):void 0,B=Ra6(J.response_format),L=qa6(),O=Math.floor(Date.now()/1000);if(J.stream)return RL($,async(w)=>{let j=DG8(F,U,N,J,B,$.req.raw.signal);try{let E=fd(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Ua6)await A()}else if(q.type==="tool-call"){await A();let f=T++;await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:LG8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=DG8(F,U,N,J,B,$.req.raw.signal),j=await OE(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:L,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:LG8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(_N("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(_N(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(_N(X.message,"server_error"),500)}});jG8=wG8});function Ma6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function zG8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=g0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!PZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||C9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(bA(U)!==J)continue;if(!Ma6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var PG8=D(()=>{J8();H3()});var p_0;var OO1=D(()=>{p_0={name:"decocms",version:"4.463.4",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function ka6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Va6}}var AG8,Va6="https://ph.studio.decocms.com",TG8;var RG8=D(()=>{J8();Za();Hy();k9();s1();MB1();OO1();AG8=new Z1;AG8.get("/",($)=>{let Z={version:p_0.version,theme:g9$(),...QH().logo&&{logo:QH().logo},...oD()&&{internalUrl:Xt1()},...j0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!j0().controlplaneRestUrl&&!!j0().controlplaneServiceToken,hostingControlPlaneGa:j0().hostingControlPlaneGa,monitorEnabled:!!j0().clickhouseAnalyticsUrl&&!!j0().clickhouseAnalyticsPassword,monitorGa:j0().monitorGa,plansEnabled:j0().plansEnabled,auth:$98(),posthog:ka6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:WF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});TG8=AG8});function jg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function wO1($){return(jg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function qG8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(jg($))}&sz=${Z}`}function Sa6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function MG8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Sa6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as P$}from"zod";var Ca6,IG8;var VG8=D(()=>{Ca6=P$.object({check_id:P$.string(),title:P$.string(),description:P$.string().optional(),impact:P$.string().optional(),why:P$.string().optional(),category:P$.string(),severity:P$.string(),value_band:P$.string().optional(),value_driver:P$.string().optional(),controllability:P$.string().optional(),pages:P$.array(P$.string()),tasks:P$.array(P$.string()),evidence:P$.string(),sample_scope:P$.string().optional(),sources:P$.array(P$.string())}),IG8=P$.object({domain:P$.string(),brand:P$.string(),favicon:P$.string().optional(),scanned_at:P$.string().nullable(),lang:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),totals:P$.object({measured:P$.number(),registry_total:P$.number(),passed:P$.number(),failed:P$.number(),blocked:P$.number()}),buckets:P$.array(P$.object({id:P$.enum(["critical","important","worth"]),label:P$.string(),items:P$.array(Ca6)})),passing:P$.object({count:P$.number(),items:P$.array(P$.object({check_id:P$.string(),title:P$.string()}))}),not_measured:P$.object({count:P$.number(),groups:P$.array(P$.object({reason:P$.string(),label:P$.string(),count:P$.number(),checks:P$.array(P$.string())}))}),categories:P$.array(P$.object({key:P$.string(),label:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),pass:P$.number(),fail:P$.number()})),screenshots:P$.array(P$.object({url:P$.string(),page_type:P$.string().optional(),viewport:P$.enum(["desktop","mobile"]),image_url:P$.string()}))})});function kG8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${SW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function n_0($,Z={}){let Q=await fetch(kG8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return IG8.parse(await Q.json())}async function SG8($,Z={}){let Q=await fetch(kG8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var jO1=D(()=>{VG8();XD()});import{join as CG8}from"path";async function va6($){try{let Z=await n_0($,{signal:AbortSignal.timeout(_a6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||wO1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function PG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function ba6($,Z){let Q=jg($),Y=Z?.brand?.trim()||wO1(Q),X=qG8(Q,128),G=`${(j0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=MG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${PG(W)}</title>`,`<meta name="description" content="${PG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${PG(W)}" />`,`<meta property="og:description" content="${PG(K)}" />`,`<meta property="og:url" content="${PG(G)}" />`,`<meta property="og:image" content="${PG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${PG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${PG(W)}" />`,`<meta name="twitter:description" content="${PG(K)}" />`,`<meta name="twitter:image" content="${PG(H)}" />`,`<meta name="twitter:image:alt" content="${PG(F)}" />`,`<link rel="canonical" href="${PG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${PG(G)}.md" />`,`<link rel="icon" href="${PG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class FO1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ya6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Fn.object({session:Fn.object({id:Fn.string().min(1)}),transport:Fn.object({type:Fn.literal("webrtc"),sdp:Fn.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var sJ8=D(()=>{sU()});var aJ8;var eJ8=D(()=>{aJ8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function UO1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:ZI$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:aJ8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:gD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var $G8=D(()=>{sU();eJ8()});import{z as UJ}from"zod";import{createHash as Xa6,createHmac as Ja6}from"crypto";class m_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Xa6("sha256").update(JSON.stringify(UO1($))).digest("hex"),this.conversationKey=Ja6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new m_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=UJ.object({agents:UJ.array(UJ.object({agent_id:UJ.string(),name:UJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return UJ.object({platform_settings:UJ.object({auth:UJ.object({enable_auth:UJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...UO1(this.config)},AbortSignal.timeout(15000));return UJ.object({agent_id:UJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return UJ.object({token:UJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return UJ.object({token:UJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var ZG8=D(()=>{$G8()});import{createHmac as Ga6,timingSafeEqual as Wa6}from"crypto";import{z as Un}from"zod";function YG8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Ga6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function XG8($,Z){let Q=Buffer.from(JSON.stringify(QG8.parse($))).toString("base64url");return`${Q}.${YG8(Q,Z)}`}function JG8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(YG8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Wa6(W,G))return null;try{let K=QG8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+gD)return null;return K.data}catch{return null}}var QG8;var GG8=D(()=>{sU();QG8=Un.object({sessionId:Un.string().uuid(),organizationId:Un.string().min(1).max(256),userId:Un.string().min(1).max(256),threadId:Un.string().min(1).max(256),expiresAt:Un.number().int().positive()})});import{z as NO1}from"zod";function WG8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return BO1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var BO1;var KG8=D(()=>{BO1=NO1.object({provider:NO1.enum(["elevenlabs","openai"]),model:NO1.string().trim().min(1).max(128)})});import{createHash as Ka6}from"crypto";import{z as Nn}from"zod";function Bn($){return`user.${Ka6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class LO1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new HG8.Kvm(i_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:i_0.StorageType.Memory,ttl:FG8.nanos(gD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=WG8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+gD},W=XG8(G,this.deps.secret),K=await this.kv(),H=Bn(G),F=await K.get(H),U=F?.operation==="PUT"?d_0.parse(F.json()):null,N=DO1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let L=await J.createSession({language:Q,model:X.model,safetyIdentifier:Bn($)});return{token:W,...L,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=JG8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Bn(Q),J=await Y.get(X),G=J?.operation==="PUT"?d_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,DO1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Bn(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?d_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,DO1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Bn($));if(Q?.operation==="PUT"&&d_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Bn($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var i_0,HG8,FG8,d_0,DO1;var UG8=D(()=>{vJ();sU();GG8();KG8();i_0=C(MK(),1),HG8=C(EA(),1),FG8=C(yz(),1),d_0=Nn.object({sessionId:Nn.string().uuid(),expiresAt:Nn.number(),connected:Nn.boolean().optional(),conversation:BO1.optional(),characters:Nn.number().int().nonnegative(),requests:Nn.number().int().nonnegative()}),DO1=new TextEncoder});function Ha6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Fa6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},NG8=()=>{let $=new Z1;return $.use("*",Fa6),$.get("/",async(Z)=>{let Q=j0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await wG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Ha6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var BG8=D(()=>{J8();s1();AS0()});import{z as y1}from"zod";function _N($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function za6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Pa6($,Z,Q){try{return JSON.parse($)}catch{throw new OG8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Aa6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Pa6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Ta6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?HU(Q.function.parameters):HU({type:"object",properties:{}});return[Q.function.name,i$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Ra6($){if(!$)return;return{openai:{response_format:$}}}function qa6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function DG8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function LG8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Ua6=256,Na6,Ba6,Da6,La6,Oa6,wa6,ja6,Ea6,OG8,wG8,jG8;var EG8=D(()=>{n4();J8();Qn();dH();Na6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Ba6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Da6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Ba6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),La6=y1.object({type:y1.literal("text")}),Oa6=y1.object({type:y1.literal("json_object")}),wa6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),ja6=y1.union([La6,Oa6,wa6]),Ea6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Da6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Na6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:ja6.optional(),user:y1.string().optional()});OG8=class OG8 extends Error{constructor($){super($);this.name="MessageConversionError"}};wG8=new Z1;wG8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(_N("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(_N("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(_N("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Ea6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(_N(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=za6(J.model);if(!G)return $.json(_N("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>CP(E.providerId));if(!j)return $.json(_N("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(_N(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Aa6(J.messages),N=J.tools?Ta6(J.tools):void 0,B=Ra6(J.response_format),L=qa6(),O=Math.floor(Date.now()/1000);if(J.stream)return RL($,async(w)=>{let j=DG8(F,U,N,J,B,$.req.raw.signal);try{let E=fd(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Ua6)await A()}else if(q.type==="tool-call"){await A();let f=T++;await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:L,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:LG8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=DG8(F,U,N,J,B,$.req.raw.signal),j=await OE(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:L,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:LG8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(_N("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(_N(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(_N(X.message,"server_error"),500)}});jG8=wG8});function Ma6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function zG8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=g0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!PZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||C9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(bA(U)!==J)continue;if(!Ma6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var PG8=D(()=>{J8();H3()});var p_0;var OO1=D(()=>{p_0={name:"decocms",version:"4.464.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function ka6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Va6}}var AG8,Va6="https://ph.studio.decocms.com",TG8;var RG8=D(()=>{J8();Za();Hy();k9();s1();MB1();OO1();AG8=new Z1;AG8.get("/",($)=>{let Z={version:p_0.version,theme:g9$(),...QH().logo&&{logo:QH().logo},...oD()&&{internalUrl:Xt1()},...j0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!j0().controlplaneRestUrl&&!!j0().controlplaneServiceToken,hostingControlPlaneGa:j0().hostingControlPlaneGa,monitorEnabled:!!j0().clickhouseAnalyticsUrl&&!!j0().clickhouseAnalyticsPassword,monitorGa:j0().monitorGa,plansEnabled:j0().plansEnabled,auth:$98(),posthog:ka6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:WF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});TG8=AG8});function jg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function wO1($){return(jg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function qG8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(jg($))}&sz=${Z}`}function Sa6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function MG8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Sa6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as P$}from"zod";var Ca6,IG8;var VG8=D(()=>{Ca6=P$.object({check_id:P$.string(),title:P$.string(),description:P$.string().optional(),impact:P$.string().optional(),why:P$.string().optional(),category:P$.string(),severity:P$.string(),value_band:P$.string().optional(),value_driver:P$.string().optional(),controllability:P$.string().optional(),pages:P$.array(P$.string()),tasks:P$.array(P$.string()),evidence:P$.string(),sample_scope:P$.string().optional(),sources:P$.array(P$.string())}),IG8=P$.object({domain:P$.string(),brand:P$.string(),favicon:P$.string().optional(),scanned_at:P$.string().nullable(),lang:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),totals:P$.object({measured:P$.number(),registry_total:P$.number(),passed:P$.number(),failed:P$.number(),blocked:P$.number()}),buckets:P$.array(P$.object({id:P$.enum(["critical","important","worth"]),label:P$.string(),items:P$.array(Ca6)})),passing:P$.object({count:P$.number(),items:P$.array(P$.object({check_id:P$.string(),title:P$.string()}))}),not_measured:P$.object({count:P$.number(),groups:P$.array(P$.object({reason:P$.string(),label:P$.string(),count:P$.number(),checks:P$.array(P$.string())}))}),categories:P$.array(P$.object({key:P$.string(),label:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),pass:P$.number(),fail:P$.number()})),screenshots:P$.array(P$.object({url:P$.string(),page_type:P$.string().optional(),viewport:P$.enum(["desktop","mobile"]),image_url:P$.string()}))})});function kG8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${SW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function n_0($,Z={}){let Q=await fetch(kG8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return IG8.parse(await Q.json())}async function SG8($,Z={}){let Q=await fetch(kG8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var jO1=D(()=>{VG8();XD()});import{join as CG8}from"path";async function va6($){try{let Z=await n_0($,{signal:AbortSignal.timeout(_a6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||wO1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function PG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function ba6($,Z){let Q=jg($),Y=Z?.brand?.trim()||wO1(Q),X=qG8(Q,128),G=`${(j0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=MG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${PG(W)}</title>`,`<meta name="description" content="${PG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${PG(W)}" />`,`<meta property="og:description" content="${PG(K)}" />`,`<meta property="og:url" content="${PG(G)}" />`,`<meta property="og:image" content="${PG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${PG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${PG(W)}" />`,`<meta name="twitter:description" content="${PG(K)}" />`,`<meta name="twitter:image" content="${PG(H)}" />`,`<meta name="twitter:image:alt" content="${PG(F)}" />`,`<link rel="canonical" href="${PG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${PG(G)}.md" />`,`<link rel="icon" href="${PG(X)}" sizes="any" />`].join(`
     `)}function xa6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function _G8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=jg(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(CG8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${SW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(fa6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=jg(Q.req.param("file").replace(/\.md$/,""));try{let X=await SG8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(ya6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?CG8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await va6(jg(Y)),K=ba6(Y,W);return Q.html(xa6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var _a6=2500,fa6=1e4,ya6=1e4;var vG8=D(()=>{J8();XD();jO1();s1()});function t_0($,Z){return fetch(`${SW({})}${$}`,Z)}async function ga6($,Z){let Q=await n_0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function ua6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var ha6,ML,bG8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},xG8;var fG8=D(()=>{J8();U3();XD();jO1();ha6=new Set(["complete","errored","terminated","unknown"]);ML=new Z1;ML.use("*",async($,Z)=>{let Q=await b8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});ML.use("/link-token/*",bG8);ML.use("/suggest",bG8);ML.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await ga6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});ML.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=ua6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await t_0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Hj({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});ML.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await t_0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${Hj({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:ha6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});ML.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await t_0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});ML.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await t_0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});xG8=ML});var la6=1048576,EO1;var yG8=D(()=>{J8();NK();s1();UB1();EO1=new Z1;EO1.post("/webhook",s5({maxSize:la6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=j0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!B58(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=D58(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await L58(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as ca6}from"crypto";function ia6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return ca6(Buffer.from(X),Buffer.from(Y))}function pa6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function gG8($){let Z=new Z1;return Z.post("/webhook",s5({maxSize:ma6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!ia6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!da6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return U$0().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=pa6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await na6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function na6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await Mf$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var ma6=5242880,da6;var hG8=D(()=>{J8();NK();JG();g7();da6=new Set(["check_suite","issue_comment"])});import{DBOS as PO1,SchedulerMode as ta6}from"@dbos-inc/dbos-sdk";async function ra6(){try{return await sa6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function sa6(){if(!F$0())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (TZ1(),AZ1)),Promise.resolve().then(() => (PZ1(),zZ1))]),Q=await U$0(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=j8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=dR$({sandboxes:J,pools:G,records:await iR$(X,J,G),legacyPools:hT0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await pR$(K,GF0(X,new MX(j0().encryptionKey)),{now:W,orgFsLifetimeMs:cT0}),U=0,N=0,B=0;for(let L of H)try{let O=await Y.pushCredentials(L);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function aa6($,Z){let Q=await PO1.runStep(ra6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function uG8(){if(zO1)return;if(!j0().agentSandboxEnabled||!F$0())return;zO1=PO1.registerWorkflow(aa6,{name:"sandboxCredentialPushWorkflow"}),PO1.registerScheduled(zO1,{name:"sandboxCredentialPushWorkflow",crontab:oa6,mode:ta6.ExactlyOncePerIntervalWhenActive})}var oa6="1-59/10 * * * *",zO1=null;var lG8=D(()=>{dG();TO();H61();mT0();uT0();JG();s1()});function cG8($){let Z=new BL($.db,new MX($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=bb$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new rQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var mG8=D(()=>{J8();TO();cQ1();AE();v60()});import{DBOS as jz,SchedulerMode as ea6}from"@dbos-inc/dbos-sdk";function dG8($){TO1=$}function qO1(){if(!TO1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return TO1}function MO1(){let $=qO1();return new BL($.db,new MX($.encryptionKey))}async function Xe6($){try{let Z=await MO1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await hH(qO1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new rQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${Ze6}m"`,W=0,K;for(let H=0;H<Qe6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await LU1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function Je6($,Z){let Q=await jz.runStep(()=>MO1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>jz.runStep(()=>Xe6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function Ge6($,Z){try{let Q=await MO1().getById($);if(!Q?.enabled)return"disabled";let Y=await hH(qO1().db,Q.organizationId);if(!Y)return"disabled";let X=await LU1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function We6($,Z){await jz.sleep(qS0()+Ye6),await jz.runStep(()=>Ge6($,Z),{name:"settleJiraMove"})}async function iG8($,Z){if(!RO1)throw Error("[jira-trigger] settle workflow is not registered");await jz.startWorkflow(RO1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function pG8(){if(AO1)return;RO1=jz.registerWorkflow(We6,{name:"jiraSettleWorkflow"}),AO1=jz.registerWorkflow(Je6,{name:"jiraTriggerSweepWorkflow"}),jz.registerScheduled(AO1,{name:"jiraTriggerSweepWorkflow",crontab:$e6,mode:ea6.ExactlyOncePerIntervalWhenActive})}var $e6="*/5 * * * *",Ze6=20,Qe6=5,Ye6=5000,TO1=null,RO1=null,AO1=null;var IO1=D(()=>{TO();v60();sd();AE();BU1();MS0()});function nG8($){let Z=new BL($.db,new MX($.encryptionKey));async function Q(X,J){let G=I18(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await iG8(W.id,G)}let Y=new Z1;return Y.post("/webhook/:secret",s5({maxSize:Ke6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var Ke6=1048576;var tG8=D(()=>{J8();NK();TO();IO1();MS0();v60()});function oG8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var rG8,He6,Fe6,sG8;var aG8=D(()=>{J8();vJ();Gi();Bm();rG8=new Z1,He6=["range","if-none-match","if-modified-since"],Fe6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];rG8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(_p($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new R1(401,{message:"Authentication required"})}if(!Q)throw new R1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new R1(400,{message:"Missing file key"});let X=await l80(Y,Z);if(!X)throw new R1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&vW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new R1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return oG8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of He6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new R1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new R1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of Fe6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),oG8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});sG8=rG8});var _50=b((Eg)=>{var Ue6=Eg&&Eg.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Ne6=Eg&&Eg.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Ue6(Z,$,Q)};Object.defineProperty(Eg,"__esModule",{value:!0});Ne6(kG(),Eg)});var Z38=b((eG8)=>{Object.defineProperty(eG8,"__esModule",{value:!0});eG8.version=void 0;eG8.version="3.4.0"});var X38=b((vN)=>{var Be6=vN&&vN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(vN,"__esModule",{value:!0});vN.NodeTransport=vN.VERSION=void 0;vN.nodeResolveHost=Ee6;var a5=_50(),De6=M0("net"),VO1=M0("tls"),Le6=M0("path"),Q38=M0("fs"),Oe6=Be6(M0("dns")),we6=Z38();vN.VERSION=we6.version;var je6="nats.js";class Y38{socket;version;lang;yields=[];signal=(0,a5.deferred)();closedNotification=(0,a5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=je6,this.version=vN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,a5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw a5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new a5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new a5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,a5.deferred)(),Q,Y=(0,De6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,a5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=a5.DataBuffer.concat(...this.yields),X=(0,a5.extractProtocolMessage)(Y);if(X!=="")try{let J=a5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,a5.deferred)();try{if($=(0,Le6.resolve)($),!(0,Q38.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Q38.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,a5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new a5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,a5.deferred)();try{let X=(0,VO1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new a5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,a5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new a5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,a5.deferred)();try{let Y=(0,VO1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new a5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,a5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,a5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof VO1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,a5.render)($)}`);let Z=(0,a5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,a5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,a5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}vN.NodeTransport=Y38;function Ee6($){let Z=(0,a5.deferred)();return Oe6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var H38=b((K38)=>{Object.defineProperty(K38,"__esModule",{value:!0});K38.connect=ze6;var J38=X38(),G38=_50(),W38=_50();function ze6($={}){if((0,W38.hasWsProtocol)($))return Promise.reject(W38.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,G38.setTransportFactory)({factory:()=>{return new J38.NodeTransport},dnsResolveFn:J38.nodeResolveHost}),G38.NatsConnectionImpl.connect($)}});var F38=b((IL)=>{var Ae6=IL&&IL.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Te6=IL&&IL.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Ae6(Z,$,Q)};Object.defineProperty(IL,"__esModule",{value:!0});IL.connect=void 0;var Re6=H38();Object.defineProperty(IL,"connect",{enumerable:!0,get:function(){return Re6.connect}});Te6(_50(),IL)});function D38($){let Z=$?.connectFn??Ve6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let L=0;while(!J)try{Q=await Z({servers:N,timeout:Ie6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${L} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{L++;let O=L7(Me6,qe6,L-1,2,0.5);await F$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let L=B?.creds?U38.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,L).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=B38.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function Ve6($){return N38.connect($)}var U38,N38,B38,qe6=100,Me6=3000,Ie6=3000;var L38=D(()=>{o$();U38=C(yz(),1),N38=C(F38(),1),B38=C(MK(),1)});function o_0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function r_0($,Z){return`${$}.${Z}`}class kO1{cache;constructor($){this.cache=o_0({ttlMs:$?.ttlMs??ke6,maxSize:$?.maxSize??Se6})}async get($,Z){return this.cache.get(r_0($,Z))??null}async set($,Z,Q){this.cache.set(r_0($,Z),Q)}async invalidate($,Z){this.cache.delete(r_0($,Z)),this.cache.delete(r_0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var ke6=600000,Se6=5000;var O38=()=>{};function s_0($,Z){return`${$}:${Z}`}function SO1($){let Z=o_0({ttlMs:$?.ttlMs??Ce6,maxSize:$?.maxSize??_e6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(w38,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(s_0(K,H))},set(K,H,F){Z.set(s_0(K,H),F)},invalidate(K,H){Z.delete(s_0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(w38),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(s_0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var w38="studio.ai-provider-keys.invalidate",Ce6=30000,_e6=5000;var j38=()=>{};class CO1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var E38=($)=>{let Z;return()=>Z??=$()},_O1,vO1;var z38=D(()=>{S6();_O1=E38(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),vO1=E38(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function he6($=T38){return{name:WN,subjects:[`${EJ1}.>`],storage:XF.StorageType.File,max_age:xe6,max_bytes:ye6,max_msgs_per_subject:ge6,discard:XF.DiscardPolicy.Old,retention:XF.RetentionPolicy.Limits,duplicate_window:fe6,num_replicas:$}}class R38{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function P38($){let Z=A38.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function me6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,be6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function de6($,Z){return $.info?.cluster?Z:1}function ie6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class bO1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=he6(X);try{await Y.streams.info(WN),await Y.streams.update(WN,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(WN,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(WN),await Y.streams.add(J);else throw G}},Q=await w8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await XF.jetstreamManager($),X=de6($,T38);try{await Z(Y,X)}catch(J){if(X<=1||!ie6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:wi});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=me6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=Ih$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=PJ1(H,{runId:Z}),N=performance.now()-F;_O1().record(N),vO1().add(1,{"org.id":Y??"unknown"}),ce6?.record(N,U.reduce((B,L)=>B+L.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?P38(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:L}=await H.read();if(B)break;if(K(L),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),le6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await w8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:P38(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:wi}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=PJ1(Z,{runId:$,dedup:Q});_O1().record(performance.now()-X),vO1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Mh$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?XF.DeliverPolicy.New:XF.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=CE($),W;try{W=await w8(async()=>{return(await Y.consumers.get(WN,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:wi})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=rM0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(pM0()).pipeThrough(nM0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,L=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",L,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:w,value:j}=await F.read();if(w){L(),O.close();return}let E=j;if(E.kind==="done"){if(J){L(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){L()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(WN,{filter:CE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var XF,A38,ve6=($)=>{let Z;return()=>Z??=$()},be6,xe6=86400000000000,fe6=120000000000,ye6=4294967296,T38,ge6=500000,ue6,le6,ce6;var q38=D(()=>{o$();AJ1();sM0();tM0();S6();z38();XF=C(MK(),1),A38=C(yz(),1),be6=ve6(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),T38=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);ue6=process.env.STREAM_ENCODE_TRACE==="1",le6=process.env.DECOPILOT_STREAM_TRACE==="1";ce6=ue6?new R38:null});function a_0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,kF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var M38=D(()=>{n8()});class xO1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function pe6($,Z,Q={}){let Y=$.startsWith("thread:")?vH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function fO1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await rU($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await KE($,{threadId:X,runBranch:G?.branch}),K=await O10($,Q,J61(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=pe6(W,await HR0($,X),{flat:_f(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await q3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var I38=D(()=>{J7();oY();g7()});async function V38($,Z,Q){let Y=Z.organizationId;if(!JJ(Z))return!1;if(!Xy(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=xU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await Q5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),L8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var k38=D(()=>{z4();aQ();ed();uH();A9()});function ee6($){return $ instanceof pX}function S38($,Z){return Z-$>=se6}class yO1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??ne6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??oe6,Q=this.options.itemIntervalMs??te6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-fQ1),GX1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-ae6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await YX1(this.taskBoard,X,Y),await XX1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==$$.progress||JJ(W)||W.assigneeId!==T8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await fO1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!S38(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:$$.progress,to:$$.review,reason:H}}).catch(()=>{}),L8(J,F),await lH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==$$.progress||G.assigneeId!==T8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await cH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),ee6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+re6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==$$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),L8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!S38(jD(Q,Z.reviewCycleStartedAt),Date.now()))return;await lH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!JJ(Y))return!1;let X=Y.assigneeId===T8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await fO1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Qi(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await V38(G,Y,W))return!0;if(await Lu$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!eY1(W))return!1;return await $i(G,Y,{previewMatchesHead:$X1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await IE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var ne6=60000,te6=300000,oe6=50,re6=60000,se6=900000,ae6=120000;var C38=D(()=>{z4();$M0();I38();JN();e80();uH();k38();A9();uW();WX1();g7();O80();Zi()});import{readdir as $05,rm as e_0}from"fs/promises";import{join as $v0}from"path";async function Zv0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-Z05),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await zg($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await _38($,X,Z);else if(!X.startsWith(".")){let J=$v0($,X),G=await zg(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await _38(J,K,Z)}if((await zg(J)).length===0)await e_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function _38($,Z,Q){let Y=0,X=$v0($,Z),J=await zg(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=$v0(X,W),H=await zg(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=$v0(K,U);await e_0(B,{recursive:!0,force:!0}),Y++}}if((await zg(K)).length===0)await e_0(K,{recursive:!0,force:!0})}if((await zg(X)).length===0)await e_0(X,{recursive:!0,force:!0});return Y}async function zg($){try{return(await $05($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var Z05=30;var gO1=()=>{};import{DBOS as hO1,SchedulerMode as Q05}from"@dbos-inc/dbos-sdk";async function X05(){let $=[jK(),kg(),uN()],Z=0;for(let Q of $)try{Z+=await Zv0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function J05($,Z){await hO1.runStep(()=>X05(),{name:"monitoringRetention"})}function b38(){if(v38)return;v38=!0;let $=hO1.registerWorkflow(J05,{name:"monitoringRetentionWorkflow"});hO1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Y05,mode:Q05.ExactlyOncePerIntervalWhenActive})}var Y05="23 4 * * *",v38=!1;var x38=D(()=>{d3();gO1()});function f38($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await sQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await SA($.db,Z,Y.role);return X.boundAuth=YB1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new U2(Q,void 0,X.boundAuth,Y.role,"self"),ME(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var y38=D(()=>{UW();vU()});function G05(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function W05(){return{services:G05(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function H05(){for(let $ of K05)$()}function g38($){let Z=[...uO1.logs,$];uO1={...uO1,logs:Z.length>500?Z.slice(-500):Z},H05()}function lO1(){return F05}var uO1,K05,F05=!1;var cO1=D(()=>{uO1=W05(),K05=new Set});import{EventEmitter as U05}from"events";var mO1;var h38=D(()=>{cO1();mO1=new U05;mO1.on("request",($)=>{g38($)})});function u38(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Dn(N.params.name),L=N.params.arguments||{},O=Object.keys(L).map((j)=>Dn(j)),w=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${Dn(N.method)}${W9.reset}`}}catch{}}let W=Dn(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${Dn(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=B05(Y),H=G?"\u25C0":"\u2190";if(!lO1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=N05(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,L=G?"\u25B6":"\u2192";if(!lO1())console.log(`${W9.dim}${L}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);mO1.emit("request",{method:Y,path:Dn(X),status:U,duration:F,timestamp:new Date})}}}var W9,N05=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},B05=($)=>{return W9[$]||W9.reset},Dn=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var l38=D(()=>{cO1();h38();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as i38}from"crypto";import{mkdir as D05,readdir as L05,rm as c38,stat as p38}from"fs/promises";import{join as iO1,relative as O05}from"path";import{z as Q8}from"zod";function t38($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return iO1(w05,Z)}function o38($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function dO1($,Z){let Q=t38($),Y=o38(Z);return iO1(Q,Y)}function j05($,Z,Q,Y){let X=j0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return i38("sha256",X).update(J).digest("hex")}function d38($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=j05(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${o38(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function r38($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${i38("md5","etag").update(Y).digest("hex")}"`}async function s38($,Z,Q,Y,X){try{let J=await L05($,{withFileTypes:!0});for(let G of J){let W=iO1($,G.name),H=O05(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await s38(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await p38(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:r38(W,F.mtime,F.size)})}catch{}}}}catch{}}function a38($,Z){let Y=X0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Q8.object({prefix:Q8.string().optional(),maxKeys:Q8.number().optional().default(1000),continuationToken:Q8.string().optional(),delimiter:Q8.string().optional()}),outputSchema:Q8.object({objects:Q8.array(Q8.object({key:Q8.string(),size:Q8.number(),lastModified:Q8.string(),etag:Q8.string()})),nextContinuationToken:Q8.string().optional(),isTruncated:Q8.boolean(),commonPrefixes:Q8.array(Q8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=t38(Y);await D05(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await s38(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),L=N+W<U.objects.length,O=L?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:L,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({contentType:Q8.string().optional(),contentLength:Q8.number(),lastModified:Q8.string(),etag:Q8.string(),metadata:Q8.record(Q8.string(),Q8.string()).optional()}),handler:async(X)=>{let J=X,G=dO1(Y,J.key),W=await p38(G);return{contentType:XD1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:r38(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=KL(J.expiresIn,m38);return{url:d38(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional(),contentType:Q8.string().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=KL(J.expiresIn,m38);return{url:d38(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({success:Q8.boolean(),key:Q8.string()}),handler:async(X)=>{let J=X,G=dO1(Y,J.key);try{return await c38(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Q8.object({keys:Q8.array(Q8.string()).max(1000)}),outputSchema:Q8.object({deleted:Q8.array(Q8.string()),errors:Q8.array(Q8.object({key:Q8.string(),message:Q8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=dO1(Y,K);try{await c38(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function pO1($,Z,Q){let Y=a38(Z,Q),X=new zw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:fZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Q8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Q8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new S3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),QK(X,J,$,"mcp:dev-assets")}async function e38($,Z,Q,Y){let J=a38(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var w05="./data/assets",m38=3600,n38,$W8;var ZW8=D(()=>{s1();qi();J8();wG0();Ri();SJ();HL();cC0();n38=new Z1;n38.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return pO1($.req.raw,Z,Y)});$W8=n38});var QW8={};Q6(QW8,{mountDevRoutes:()=>E05});function E05($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return pO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await e38(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",$W8);let Q=new Z1;Q.use("*",QF({mountPath:"/api/dev-assets"})),Q.route("/",lC0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var YW8=D(()=>{J8();sB1();cC0();ZW8()});var BW8={};Q6(BW8,{watchHandler:()=>NW8,resolveCorsOrigin:()=>FW8,isSsoExemptPath:()=>KW8,isAllowedOAuthRedirectUri:()=>UW8,createApp:()=>k05});import{readFileSync as z05}from"fs";import{PrometheusSerializer as P05}from"@opentelemetry/exporter-prometheus";import{DBOS as VL}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as R05,oAuthProtectedResourceMetadata as q05}from"better-auth/plugins";async function A05($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,JW8(XW8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),JW8(XW8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function JW8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function KW8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${MC0}/`)||$.startsWith(`${zC0}/`)}function HW8($){return $==="local.studio.decocms.com"}function FW8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(HW8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function UW8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||HW8($.hostname)}async function k05($={}){let Z=$.database??j8(),Q=!1;x6.stop().catch((J0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",J0)});let Y,X,J,G,W=new kO1,K,H,F,U=null;if($.disableNats)K=SO1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new K40,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(J0)=>{return(async()=>{let K0=J0.getReader();try{while(!0){let{done:A0}=await K0.read();if(A0)break}}catch{}finally{K0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=D38();let J0=j0().natsCredsPath,K0;if(J0)try{K0=z05(J0,"utf8")}catch(K8){console.error(`[app] failed to read NATS_CREDS at ${J0}; connecting anonymously`,K8)}U.init(j0().natsUrls,K0?{creds:K0}:void 0);let A0=d$1()?new V$1({getJetStream:()=>U.getJetStream(),selfListVersion:p_0.version}):null;A0?.init().catch(()=>{}),Y=A0;let T0=new K81({getJetStream:()=>U.getJetStream()});T0.init().catch(()=>{}),X=T0;let H1=new Gy(nY1,{getJetStream:()=>U.getJetStream()}),l$=new Gy(w80,{getJetStream:()=>U.getJetStream()});H1.init().catch(()=>{}),l$.init().catch(()=>{}),J={reads:H1,cards:l$};let n$=new rG1({getJetStream:()=>U.getJetStream()});n$.init().catch(()=>{}),G=n$,K=SO1({getConnection:()=>U.getConnection()}),H=new CO1({getConnection:()=>U.getConnection()}),F=new bO1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),x58(U),U.onReady(()=>{A0?.init().catch((K8)=>{console.error("[McpListCache] Deferred init failed:",K8)}),T0.init().catch((K8)=>{console.error("[SkillCatalogCache] Deferred init failed:",K8)}),H1.init().catch((K8)=>{console.error("[PrReadCache] Deferred init failed:",K8)}),l$.init().catch((K8)=>{console.error("[PrCardCache] Deferred init failed:",K8)}),n$.init().catch((K8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",K8)}),K.start(),WD$(()=>U.getConnection()),F.init().catch((K8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",K8)})})}if(Ez)await Ez();k$1(Y),F81(X),N81(()=>U?.getConnection()??null),tY1(J),sG1(G);let B={storage:new Ou(Z.db),sseHub:x6,onThreadFinished:async(J0,K0)=>Xi(new R3(Z.db),J0,K0,new mG(Z.db))},L=new mX1(B),O=new S60(Z.db),w=new xO1(O);w.start(),Bu$(H),H.start((J0)=>{fM0(J0),L.execute({type:"CANCEL",taskId:J0}).catch((K0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",K0)})}).catch((J0)=>{console.error("[Decopilot] CancelBroadcast start failed:",J0)}),U?.onReady(()=>{H.start().catch((J0)=>{console.error("[CancelBroadcast] Deferred start failed:",J0)})});let j=()=>U?.getConnection()??null;iB1(j),U?.onReady(()=>iB1(j)),C31(j),U?.onReady(()=>C31(j)),F.init().catch((J0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",J0)}),Ez=async()=>{await L.stopAll(),L.dispose(),w.dispose(),H.stop().catch(()=>{}),YZ8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),KD$(),G.teardown(),k$1(null),F81(null),N81(null),tY1(null),sG1(null)};let E=new Z1;if(E.use("*",nG1({enabled:(J0)=>Cp(J0,"debug")==="1"})),E.use("*",Tv0),E.use("/*",S58({origin:(J0,K0)=>FW8(J0,{baseUrl:j0().baseUrl,requestOrigin:new URL(K0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(J0,K0)=>{if(await K0(),J0.req.path.includes("/files/"))return;if(J0.req.path.includes("/fs/")&&J0.req.path.endsWith("/read"))return;J0.header("X-Frame-Options","DENY"),J0.header("Content-Security-Policy","frame-ancestors 'none'")}),!j0().noTui)E.use("*",u38());E.use("*",async(J0,K0)=>{if(await K0(),Rn(J0.req.path))return;if(J0.res.status>=500){let T0=await J0.res.clone().text();console.error(`[5xx Response] ${J0.req.method} ${J0.req.path} - ${J0.res.status}:`,T0)}}),E.get(BX.HEALTH,(J0)=>{if(Q)return J0.json({status:"shutting_down"},503);return J0.json({status:"ok"})}),E.get(BX.HEALTH_LIVE,(J0)=>{return J0.json({status:"ok"})}),E.get(BX.HEALTH_READY,async(J0)=>{if(Q)return J0.json({status:"shutting_down"},503);let K0={};if(K0.postgres={status:await A05(Z.pool)?"up":"down"},U)K0.nats=U.isConnected()?{status:"up"}:{status:"down"};else K0.nats={status:"down"};let A0=K0.postgres.status==="up",T0=A0?200:503;return J0.json({status:A0?"ready":"not_ready",services:K0},T0)}),E.get(BX.METRICS,async(J0)=>{try{let K0=await Iv0.collect(),A0=T05.serialize(K0.resourceMetrics);return J0.text(A0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(K0){return console.error("Failed to collect metrics:",K0),J0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${BX.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(J0)=>{let K0=J0.req.param("queueName");if(!M05.has(K0))return J0.json({error:`Unknown queue: ${K0}`},404);let[A0,T0]=await Promise.all([VL.listQueuedWorkflows({queueName:K0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),VL.listQueuedWorkflows({queueName:K0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return J0.json({queue_length:A0.length,in_flight:T0.length})}),E.route("/api/config",TG8),E.route("/api/_reports",xG8),E.route("/api/_stripe",EO1),E.route("/api/_github",gG8({taskBoard:()=>i,contextFactory:()=>y})),E.route("/api/_git",hp);let T={db:Z.db,encryptionKey:j0().encryptionKey};E.route("/api/_jira",nG8(T)),E.route("/api/_jira",cG8(T)),E.route("/report",_G8($.clientDir)),E.route("/api/auth/custom",Z98),E.route("/api/auth/desktop",J98),E.all("/api/auth/admin/*",d98),E.all("/api/auth/*",async(J0)=>{return await b8.handler(J0.req.raw)});let P=X68();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",d60),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",d60),E.route("/",P),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",V60),E.route("/",H68()),E.use("/oauth-proxy/:connectionId/*",d60),E.all("/oauth-proxy/:connectionId/*",GW8);let A=async(J0)=>{let A0=await I05()(J0.req.raw),T0=await A0.json();return Response.json(T0,A0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",d60),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(J0)=>{let A0=await V05()(J0.req.raw),T0=await A0.json();return Response.json(T0,A0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let f=_58({ttlMs:120000}),_=await Y58({db:Z.db,auth:b8,encryption:{key:j0().encryptionKey},observability:{tracer:fL,meter:Z$},modelListCache:W,providerKeyCache:K,memberRoleCache:f});sQ.set(_),nn1({db:Z.db,baseUrl:c5()}),X58({db:Z.db}),K58({db:Z.db}),O58({db:Z.db}),dG8({db:Z.db,encryptionKey:j0().encryptionKey}),yx$({db:Z.db}),A58({db:Z.db}),Nf$({db:Z.db});let V=GJ0(Z.db),g=new Xs(Z.db),y=f38({db:Z.db});mG1({storage:V,studioContextFactory:y}),xJ1({systemDatabaseUrl:rs0(j0().databaseUrl,j0().databasePgSsl),studioContextFactory:y,deps:{runRegistry:L,cancelBroadcast:H,streamBuffer:F,sseHub:x6}}),VJ1({dispatchRunFn:Eh$,studioContextFactory:y,deps:{runRegistry:L,cancelBroadcast:H,streamBuffer:F,sseHub:x6}});let h=new Ou(Z.db),i=new R3(Z.db),p=new mG(Z.db),U0=new yO1(i,y,p);if(j0().taskBoardReviewSweeperEnabled){U0.start();let J0=Ez;Ez=async()=>{await J0?.(),U0.dispose()}}uh$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let J0=U?.getConnection();return J0?await WW8.jetstreamManager(J0):null},messageParts:h.messageParts(),resolveRun:async(J0)=>{let K0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",J0).executeTakeFirst();return K0?{orgId:K0.organization_id,createdBy:K0.created_by,version:K0.message_storage_version??1,status:K0.status,runFenceToken:K0.run_fence_token,title:K0.title??null}:null},completeRunIfNotCompleted:async(J0,K0)=>{let A0=await h.completeRunIfNotCompleted(J0,K0);if(a_0(x6,K0,J0,A0),A0)await Xi(i,J0,K0,p);return A0},markRunRequiresAction:async(J0,K0)=>{let A0=await h.requiresActionIfInProgress(J0,K0);return a_0(x6,K0,J0,A0),A0},markRunFailed:async(J0,K0,A0,T0)=>{let H1=await h.markRunFailed(J0,K0,A0,T0);if(a_0(x6,K0,J0,H1),H1)await Xi(i,J0,K0,p);return H1},clearSynthesizedError:async(J0,K0)=>{await h.messageParts().replaceMessageParts(J0,SE(J0,K0),[])},persistTitle:(J0,K0,A0)=>h.update(J0,K0,{title:A0}),onTitleUpdated:async({runId:J0,orgId:K0,title:A0})=>{let T0=await h.get(J0,K0).catch(()=>null);x6.emit(K0,kF(J0,T0?.status??"in_progress",{title:A0,virtualMcpId:T0?.virtual_mcp_id??void 0,createdBy:T0?.created_by,triggerId:T0?.trigger_id,branch:T0?.branch??null,harnessId:T0?.harness_id??void 0,createdAt:T0?.created_at,updatedAt:T0?.updated_at}))},bumpProgress:async({runId:J0,orgId:K0})=>{await h.bumpProgress(J0,K0)},recordCompleted:async({runId:J0,orgId:K0,distinctId:A0,usage:T0})=>{f1.capture({distinctId:A0,event:"chat_message_completed",groups:{organization:K0},properties:{organization_id:K0,thread_id:J0,transport:"projector",input_tokens:T0.inputTokens,output_tokens:T0.outputTokens,total_tokens:T0.totalTokens}})},recordFailed:async({runId:J0,orgId:K0,distinctId:A0,reason:T0,kind:H1})=>{f1.capture({distinctId:A0,event:"chat_message_failed",groups:{organization:K0},properties:{organization_id:K0,thread_id:J0,transport:"projector",error_category:H1,error_message:T0}})},purgeRun:async(J0)=>{F.purge(J0)}}),ig$({studioContextFactory:y,systemDatabaseUrl:rs0(j0().databaseUrl,j0().databasePgSsl),streamBuffer:F}),b38(),tn1(),G58(),F58(),j58(),pG8(),cx$(),R58(),Bf$(),uG8();let v0=async(J0,K0,A0)=>{let T0=await V.findById(J0,K0);if(!T0)throw Error("Automation not found");return pG1({automationId:T0.id,organizationId:T0.organization_id,triggerId:null})},G0=new yp(V,({automation:J0,trigger:K0,contextMessages:A0,idempotencyKey:T0})=>W40({automationId:J0.id,organizationId:J0.organization_id,triggerId:K0.id,contextMessages:A0},{idempotencyKey:T0})),N0=[jK(),kg(),uN()];for(let J0 of N0)Zv0(J0).then(()=>{}).catch((K0)=>console.error("[monitoring] Retention cleanup failed:",K0));let o=()=>b8.api.deleteAllExpiredApiKeys().catch((J0)=>console.error("[auth] Expired API key cleanup failed:",J0));o(),setInterval(o,86400000).unref(),E.use("*",async(J0,K0)=>{if(Pv0(J0.req.path))return K0();let A0={measure:async(H1,l$)=>{ZK(J0,H1);try{return await l$()}finally{C3(J0,H1)}}},T0=await sQ.create(J0.req.raw,{timings:A0});T0.automationRunner=v0,J0.set("studioContext",T0);try{await K0()}finally{let H1=T0.pendingRevalidations;if(H1.length>0)Promise.race([Promise.allSettled(H1),F$(30000)]).catch((n$)=>console.error("[studio] revalidation cleanup error:",n$))}}),E.use("/api/:org/decopilot/*",vp),E.use("/api/:org/v1/*",vp),E.use("/api/:org/files/*",vp),E.use("*",async(J0,K0)=>{if(KW8(J0.req.path))return K0();let A0=J0.get("studioContext");if(!A0?.organization?.id||!A0?.auth?.user?.id)return K0();if(!(await A0.storage.orgSsoConfig.getByOrgId(A0.organization.id))?.enforced)return K0();if(!await A0.storage.orgSsoSessions.isValid(A0.auth.user.id,A0.organization.id))return J0.json({error:"SSO authentication required for this organization"},403);return K0()});let e=new Z1;e.use("*",QF({mountPath:"/api/org-sso"})),e.route("/",kC0()),E.route("/api/org-sso",e),E.get("/api/tools/management",(J0)=>{return J0.json({tools:Hs,grouped:F2()})}),E.use("/mcp/*",async(J0,K0)=>{ZK(J0,"mcp");try{return await K0()}finally{C3(J0,"mcp")}});let Q0=async(J0,K0)=>{let A0=J0.var.studioContext;if(!A0.auth.user?.id&&!A0.auth.apiKey?.id){let T0=new URL(J0.req.url),H1=J0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),l$=H1?`${H1}://${T0.host}`:T0.origin;return J0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${l$}${T0.pathname}/.well-known/oauth-protected-resource"`}})}return await K0()};if(E.use("/mcp/:connectionId?",Q0),E.use("/mcp/gateway/:virtualMcpId?",Q0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Q0),E.use("/mcp/self",Q0),vW()){let{mountDevRoutes:J0}=(YW8(),Hv0(QW8));J0(E,Q0)}let $0=new Z1;$0.use("*",QF({mountPath:"/mcp"})),$0.route("/",VI0()),E.route("/mcp",$0);let Y0=new Z1;Y0.use("*",QF({mountPath:"/mcp/self"})),Y0.route("/",E_0()),E.route("/mcp/self",Y0);let h0=new Z1;h0.use("*",QF({mountPath:"/mcp"})),h0.route("/",CI0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(J0,K0)=>{ZK(J0,"llm_models");try{return await K0()}finally{C3(J0,"llm_models")}});let V0=FZ8({cancelBroadcast:H,streamBuffer:F,runRegistry:L});E.route("/api",V0),E.route("/api",sG8);let G1=new Z1;G1.use("*",QF({mountPath:"/api"})),G1.route("/",T_0()),E.route("/api",G1),E.route("/api",jG8);let c0=new Z1;c0.use("*",QF({mountPath:"/api"})),c0.route("/",R_0({tokenStorage:g,automationEventDispatcher:G0})),E.route("/api",c0);let O0=new Js(Z.db),E0=new Z1;E0.use("*",QF({mountPath:"/api"})),E0.route("/",xC0()),E.route("/api",E0),E.route("/api/deco-sites",qZ8()),E.route("/api/deco-apps",NG8());let n0=new Z1;n0.use("*",QF({mountPath:"/api/deco-sites"})),n0.route("/",yC0()),E.route("/api/deco-sites",n0),E.route(MC0,i98()),E.route(YX8,GX8()),E.route("/api/_editor-resolve",zG8()),E.route(H98,F98()),E.route(zC0,q98());let N1=j0(),o0=N1.elevenlabsApiKey?new m_0({apiKey:N1.elevenlabsApiKey,model:N1.elevenlabsVoiceModel,conversationModel:N1.elevenlabsConversationModel,voiceId:N1.elevenlabsVoiceId}):null,_0={openai:N1.openaiLiveApiKey?new FO1({apiKey:N1.openaiLiveApiKey,voice:N1.openaiLiveVoice}):null,elevenlabs:o0?new HO1(o0,()=>U?.getConnection()??null):null},d0=new LO1({adapter:o0,conversationAdapters:_0,defaults:N1,secret:N1.studioJwtSecret??N1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),i0=dJ8({voiceSessions:d0,kvStorage:O0,runRegistry:L,streamBuffer:F,sseHub:x6,cancelBroadcast:H,tokenStorage:g,automationEventDispatcher:G0,mountDevAssets:vW(),mcpAuth:Q0,oauthProxyHandler:GW8,watchHandler:NW8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((J0)=>{return J0.json({error:"Not Found",path:J0.req.path},404)}),E.onError(NZ8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([x6.stop(),Ez?Promise.resolve(Ez()).finally(()=>{Ez=null}):Promise.resolve()]),U)await U.drain().catch((J0)=>console.error("[shutdown] NATS drain error:",J0));console.log("[shutdown] Flushing telemetry..."),await BJ().catch((J0)=>console.error("[shutdown] Telemetry flush error:",J0)),console.log("[shutdown] Closing database..."),await $Q$(Z).catch((J0)=>console.error("[shutdown] Database close error:",J0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await VL.registerQueue(m3,{partitionQueue:!0,concurrency:uG1,minPollingIntervalMs:lG1}),await VL.registerQueue(c3,{partitionQueue:!0,concurrency:vJ1,priorityEnabled:!0}),await VL.registerQueue(gN,{workerConcurrency:j0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await VL.registerQueue(hN,{workerConcurrency:j0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await VL.registerQueue(xL,{partitionQueue:!0,concurrency:dg$}),await VL.registerQueue(Rz,Uf$),await aB1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((J0)=>VL.deleteQueue(J0))),await cG1(Z.pool),OJ$().catch((J0)=>{console.error("[studio-pack-backfill] failed:",J0)}),on1().catch((J0)=>{console.error("[org-fs] public-sets boot sync kick failed:",J0)})}})}var WW8,XW8=5000,Ez=null,GW8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await sQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let g=await $.req.json().catch(()=>({}));return $.json({...typeof g==="object"&&g!==null?g:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Ip(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await k60(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),L;if(Y==="authorize")L=B.authorization_endpoint;else if(Y==="token")L=B.token_endpoint;else if(Y==="register")L=B.registration_endpoint;if(!L)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=K68(L);if(O)return O;let w=new URL(L),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let g=w.searchParams.get("redirect_uri");if(g){let y=j0().baseUrl??j.origin;try{if(!UW8(new URL(g),y))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",g)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(M58(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let P,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),U0=p.indexOf(":");if(U0!==-1){let v0=decodeURIComponent(p.slice(0,U0)),G0=decodeURIComponent(p.slice(U0+1));A=v0||null,q=G0||null}}catch{}let g=await $.req.formData();if(g.has("resource"))g.set("resource",U);let y=g.get("client_id"),h=g.get("client_secret");if(typeof y==="string"&&y)A=y;if(typeof h==="string"&&h)q=h;let i=new URLSearchParams;for(let[p,U0]of g.entries())i.append(p,U0.toString());P=i.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let g=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),y=await $.req.text(),h={};try{h=y?JSON.parse(y):{}}catch{P=y}let i=typeof h==="object"&&h!==null&&!Array.isArray(h);if(P===void 0&&!i)P=y;if(P===void 0){let p=h,U0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...U0,organization_id:G.organization_id,...g?.slug?{organization_slug:g.slug}:{},...g?.name?{organization_name:g.name}:{}},P=JSON.stringify(p),E["Content-Type"]="application/json"}}else P=$.req.raw.body??void 0;let f=await fetch(w.toString(),{method:$.req.method,headers:E,body:P,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[g,y]of f.headers.entries())if(!V.includes(g.toLowerCase()))_.set(g,y);if(Y==="token"&&f.ok){let g=await f.text();try{let y=JSON.parse(g);if(typeof y.access_token==="string"&&y.access_token){let h=typeof y.expires_in==="number"?new Date(Date.now()+y.expires_in*1000):null,i=null;try{i=await Vp(G.connection_url)??L}catch{i=L}let p={connectionId:Z,accessToken:y.access_token,refreshToken:typeof y.refresh_token==="string"?y.refresh_token:null,scope:typeof y.scope==="string"?y.scope:null,expiresAt:h,clientId:A,clientSecret:q,tokenEndpoint:i};await new w9(X.db,X.vault).upsert(p)}}catch(y){console.error("[oauth-proxy] failed to persist downstream token:",y)}return new Response(g,{status:f.status,statusText:f.statusText,headers:_})}return new Response(f.body,{status:f.status,statusText:f.statusText,headers:_})},NW8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!YN(Y)||!await XN(Z)))return $.json({error:"forbidden"},403);let W=G?gq0:Y;if(G)pD({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return RL($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!x6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{x6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),x6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),x6.remove(W,K),N()})})})},T05,M05,I05=()=>q05(b8),V05=()=>R05(b8);var DW8=D(()=>{o$();s1();rn1();W58();U58();E58();L40();SY1();q58();O80();k9();Bm();n8();J8();OC0();C58();tG1();U3();vU();EB1();dG();S6();$6();MB1();G98();U98();M98();_B1();p98();lB1();oB1();rB1();AH();aS0();sB1();BZ8();jC0();iJ8();rJ8();sJ8();ZG8();UG8();ZD1();BG8();kI0();H40();EG8();_I0();_L1();PG8();SL1();RG8();vG8();fG8();yG8();hG8();lG8();mG8();tG8();IO1();GD1();aG8();CL1();ML1();t50();L38();OO1();mX();LH0();OH0();rY1();I00();k00();eG1();O38();j38();pB1();q38();MM0();M38();uo();Ks();iD();A9();hN1();C38();x38();c30();gO1();d3();eB1();dD();MJ1();c30();iM0();jt0();Et0();y38();Hw();l38();Qn();EB1();rd();Li();yM0();WW8=C(MK(),1);T05=new P05,M05=new Set([m3,c3,gN,hN,xL,Rz])});var jW8={};Q6(jW8,{resolveClientDir:()=>f05,resolveAssetPathWithTraversalCheck:()=>wW8,isPathWithinDirectory:()=>OW8,createAssetHandler:()=>y05});import{resolve as v50,dirname as S05,join as C05,extname as _05,basename as v05,sep as LW8}from"path";function b05($,Z){if($===Z||v05($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${LW8}assets${LW8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function OW8($,Z){let Q=v50(Z),Y=v50($);return Y===Q||Y.startsWith(Q+"/")}function wW8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=v50(Z,Q);if(!OW8(Y,Z))return null;return Y}function f05($,Z="../client"){let Q=new URL($),Y=S05(Q.pathname);return v50(Y,Z)}function y05($={}){let{env:Z="production",clientDir:Q=x05,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=wW8({requestPath:W,clientDir:Q});if(!K)return null;let H=C05(K,"index.html"),F=v50(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(_05(K))?[H,F]:[];for(let L of[K,...B])try{let O=Bun.file(L);if(await O.exists())return new Response(O,{headers:b05(L,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var x05="./dist/client";var EW8=()=>{};var zW8={};Q6(zW8,{tryUpgradePreviewWs:()=>d05,tryHandlePreviewHttp:()=>m05,previewWebSocketHandler:()=>i05,parsePreviewBaseDomain:()=>c05,isPreviewWsData:()=>Qv0,extractHandleFromHost:()=>nO1});function u05($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function l05(){return new Response(h05,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function c05($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function nO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function m05($,Z){let Q=nO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return x50(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Jd)&&u05($))return l05();return X.headers.delete(Jd),X}function x50($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Qv0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function d05($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=nO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return x50(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return x50(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return x50(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return x50(426,"upgrade failed");return}function b50($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var g05=256,h05='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',i05;var PW8=D(()=>{$$0();i05={open($){let Z=$.data;if(!Qv0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),b50($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{b50($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{b50($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!Qv0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=g05){b50($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!Qv0(Z))return;b50($,Z,1000,"")}}});var qW8={};Q6(qW8,{printBanner:()=>n05,bannerLines:()=>RW8,BANNER_LINES:()=>AW8,BANNER_GRADIENT:()=>TW8});function p05($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function RW8($){let Z=AW8.map((Q,Y)=>{let[X,J,G]=p05(TW8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function n05($){console.log("");for(let Z of RW8($))console.log(Z);console.log("")}var AW8,TW8;var MW8=D(()=>{AW8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],TW8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});o$();var Gw1="13";function Ww1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Gw1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}o$();import dW8 from"pg";var Kw1=8314027461559302n,iW8=600000,pW8=500;async function Hw1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=iW8}=$,X=$.log??((K)=>console.log(K)),J=new dW8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[Kw1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await F$(pW8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[Kw1.toString()])}catch{}await J.end().catch(()=>{})}}s1();Bv0();S6();function dK8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Sv0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function pw1(){let $=dK8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Sv0($,"--cpu-prof-dir")??process.cwd(),name:Sv0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Sv0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}vv0();var s50;function Zj1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Iz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),s50=setInterval(()=>void Z().catch(()=>{}),$),s50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(s50)clearInterval(s50)}}import*as nK8 from"bun:jsc";var{startSamplingProfiler:tK8,samplingProfilerStackTraces:oK8}=nK8;function Qj1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{tK8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=oK8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((L)=>L.sourceURL&&!/Unknown Executable/.test(L.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function Yj1(){pw1();let $=[Zj1(),$j1(),Qj1()];return()=>{for(let Z of $)Z()}}import{existsSync as Z15}from"fs";var AG=j0();mw1();var{DBOS:f50,DBOSClient:t05}=await import("@dbos-inc/dbos-sdk");function eO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var o05=[m3,c3,gN,hN,xL,Rz],r05=AG.dispatchRole==="worker"?o05:AG.dispatchRole==="api"?[]:void 0;f50.setConfig(Ww1({systemDatabaseUrl:eO1(AG.databaseUrl,AG.databasePgSsl),poolSize:AG.dbosPoolSize,executorID:AG.podName,listenQueues:r05}));var{createApp:s05}=await Promise.resolve().then(() => (DW8(),BW8)),{isServerPath:a05}=await Promise.resolve().then(() => (t50(),Mw1)),{createAssetHandler:e05,resolveClientDir:CW8}=await Promise.resolve().then(() => (EW8(),jW8)),$15=AG.port,IW8=CW8(import.meta.url,"../client"),_W8=Z15(IW8)?IW8:CW8(import.meta.url,"../dist/client"),Q15=e05({clientDir:_W8,isServerPath:a05}),Y15={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function X15($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(Y15))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:J15,tryHandlePreviewHttp:G15,tryUpgradePreviewWs:W15,previewWebSocketHandler:tO1,isPreviewWsData:oO1}=await Promise.resolve().then(() => (PW8(),zW8)),{getOrInitSharedRunner:vW8}=await Promise.resolve().then(() => (JG(),YM$)),bW8=J15(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),VW8={baseDomain:bW8??"",getRunner:vW8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())vW8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var Yv0=await s05({clientDir:_W8}),rO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),kW8=process.env.DBOS_CONDUCTOR_URL?.trim();await Hw1({databaseUrl:eO1(AG.databaseUrl,AG.databasePgSsl)},()=>f50.launch({...rO1?{conductorKey:rO1}:{},...rO1&&kW8?{conductorURL:kW8}:{}}));console.log(`[dbos] application version: ${f50.applicationVersion}`);var sO1=5,aO1=0;await w8(async()=>{aO1++;try{return await Yv0.initDbos()}catch($){let Z=aO1>=sO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${aO1}/${sO1} failed, ${Z}`,$),$}},{maxAttempts:sO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!AG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (MW8(),qW8));console.log("");for(let Z of $())console.log(Z)}var K15=Bun.serve({idleTimeout:0,port:$15,hostname:"0.0.0.0",fetch:async($,Z)=>{if(bW8){let Y=await W15($,Z,VW8);if(Y===void 0)return;if(Y)return Y;let X=await G15($,VW8);if(X)return X}let Q=await Q15($);if(Q)return X15(Q);return Yv0.fetch($,{server:Z})},websocket:{open($){if(oO1($.data))tO1.open($)},message($,Z){if(oO1($.data))tO1.message($,Z)},close($){if(oO1($.data))tO1.close($)}},development:!1}),H15=Yj1();if(AG.localMode)Promise.resolve().then(() => (Hy(),zM0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (Hy(),zM0));Z()}catch{}});var SW8=!1;async function F15($){let Z;try{Z=await t05.create({systemDatabaseUrl:eO1(AG.databaseUrl,AG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:c3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:c3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function Xv0($){if(SW8)return;SW8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{H15(),Yv0.markShuttingDown();let J=Uw1(AG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await F$(J),await K15.stop(!0);let G=f50.executorID;await f50.shutdown(),await F15(G),await Yv0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>Xv0("SIGTERM"));process.on("SIGINT",()=>Xv0("SIGINT"));process.on("SIGHUP",()=>Xv0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),Xv0("uncaughtException")});