decocms 4.498.1 → 4.498.2

package/dist/server/server.js

@@ -181,7 +181,7 @@ Keep both indexes concise \u2014 a curated list of durable facts and one-line po
     WHERE a.organization_id = ${Z}
       AND a.slug = ${Q} AND ${X}
     LIMIT 1
-  `.execute($),G=J[0];return G?{id:G.id,canonicalSlug:G.url_slug}:null}var h84="idx_connections_org_url_slug",u84,Uo0;var No0=L(()=>{zw();u84=os-16;Uo0=class Uo0 extends Error{constructor($){super(`The URL slug "${$}" is already in use in this organization`);this.name="UrlSlugTakenError"}}});import{sql as _8}from"kysely";function Be1($){if($.length===0)return null;let Z=$[0];if($.length===1&&m84.has(Z))return _8.ref(Z);if($.length===2&&Ne1.has(Z)){let Q=$[1];return _8`${_8.ref(Z)}->>${_8.lit(Q)}`}if($.length>2&&Ne1.has(Z)){let Q=`{${$.slice(1).join(",")}}`;return _8`${_8.ref(Z)}#>>${_8.lit(Q)}`}return null}function De1($){if("conditions"in $){let{operator:J,conditions:G}=$;if(G.length===0)return _8`true`;let W=G.map((K)=>De1(K));switch(J){case"and":return _8`(${_8.join(W,_8` AND `)})`;case"or":return _8`(${_8.join(W,_8` OR `)})`;case"not":return _8`NOT (${_8.join(W,_8` AND `)})`;default:return _8`true`}}let{field:Z,operator:Q,value:Y}=$,X=Be1(Z);if(!X)return _8`true`;switch(Q){case"eq":return Y===null?_8`${X} IS NULL`:_8`${X} = ${_8.val(Y)}`;case"gt":return _8`${X} > ${_8.val(Y)}`;case"gte":return _8`${X} >= ${_8.val(Y)}`;case"lt":return _8`${X} < ${_8.val(Y)}`;case"lte":return _8`${X} <= ${_8.val(Y)}`;case"in":if(!Array.isArray(Y)||Y.length===0)return _8`false`;return _8`${X} IN (${_8.join(Y.map((J)=>_8.val(J)))})`;case"like":return _8`${X} ILIKE ${_8.val(Y)}`;case"contains":{let J=String(Y).replace(/[%_\\]/g,"\\$&");return _8`${X} ILIKE ${_8.val(`%${J}%`)}`}default:return _8`true`}}class Dr{db;vault;constructor($,Z){this.db=$;this.vault=Z}async create($){let Z=$.id??l8("conn"),Q=new Date().toISOString(),Y=await this.db.selectFrom("connections").select("organization_id").where("id","=",Z).executeTakeFirst();if(Y){if(Y.organization_id!==$.organization_id)throw Error("Connection ID already exists");return this.update(Z,$)}return this.insertNew(Z,$,Q)}async createNew($){let Z=$.id??l8("conn");return this.insertNew(Z,$,new Date().toISOString())}async insertNew($,Z,Q){let{url_slug:Y,...X}=Z,J=g2(Z),G=await sJ0(this.db,Z.organization_id??"",rs(Z.title,rs(J,"app")),async(W)=>{let K=await this.serializeConnection({...X,id:$,slug:J,url_slug:W,status:"active",created_at:Q,updated_at:Q});try{return await this.db.insertInto("connections").values(K).returningAll().executeTakeFirst()}catch(H){if(H instanceof Error&&!oJ0(H)&&(H.message.includes("duplicate key")||H.message.includes("unique constraint")))throw Error("Connection ID already exists");throw H}});if(!G)throw Error(`Failed to create connection with id: ${$}`);return this.deserializeConnection(G)}async findById($,Z){let Q=HQ($);if(Q)return ma1(Z??Q);let Y=this.db.selectFrom("connections").selectAll().where("id","=",$);if(Z)Y=Y.where("organization_id","=",Z);let X=await Y.executeTakeFirst();return X?this.deserializeConnection(X):null}async findBySanitizedId($){let Z=$.replace(/-/g,"_"),Q=await this.db.selectFrom("connections").selectAll().where(_8`replace(id, '-', '_')`,"=",Z).where("id","!=",$).executeTakeFirst();return Q?this.deserializeConnection(Q):null}async list($,Z){let Q=this.db.selectFrom("connections").selectAll().where("organization_id","=",$);if(!Z?.includeVirtual)Q=Q.where("connection_type","!=","VIRTUAL");if(Z?.slug)Q=Q.where("slug","=",Z.slug);if(Z?.where)Q=Q.where(De1(Z.where));let Y=this.db.selectFrom(Q.as("filtered")).select(_8`count(*)::int`.as("count"));if(Z?.orderBy&&Z.orderBy.length>0)for(let K of Z.orderBy){let H=Be1(K.field);if(!H)continue;let F=K.direction==="desc"?_8`desc`:_8`asc`,U=K.nulls==="first"?_8`nulls first`:_8`nulls last`;Q=Q.orderBy(_8`${H} ${F} ${U}`)}if(Z?.limit!==void 0)Q=Q.limit(Z.limit);if(Z?.offset)Q=Q.offset(Z.offset);let[X,J]=await Promise.all([Y.executeTakeFirst(),Q.execute()]),G=X?.count??0;return{items:await Promise.all(J.map((K)=>this.deserializeConnection(K))),totalCount:G}}async searchByTitle($,Z,Q){let Y=this.db.selectFrom("connections").select(["id","title","icon","slug"]).where("organization_id","=",$).where("connection_type","!=","VIRTUAL");if(Z)Y=Y.where("title","ilike",`%${vl(Z)}%`);return(await Y.orderBy("updated_at","desc").limit(Q).execute()).map((J)=>({id:J.id,title:J.title??"",icon:J.icon??null,slug:J.slug??null}))}resolveUrlSlug($,Z,Q){return Ue1(this.db,$,Z,Q)}async update($,Z){let{id:Q,organization_id:Y,created_by:X,created_at:J,url_slug:G,...W}=Z;if(Z=W,G)await rJ0(this.db,$,G);if(Object.keys(Z).length===0){let N=await this.findById($);if(!N)throw Error("Connection not found");return N}let K={...Z},H=await this.db.selectFrom("connections").select(["app_name","connection_url","title","connection_type"]).where("id","=",$).executeTakeFirst();if(H){let N=(B)=>Z[B]===void 0?H[B]:Z[B];K.slug=g2({app_name:N("app_name"),connection_url:N("connection_url"),title:N("title"),id:$})}let F=await this.serializeConnection({...K,updated_at:new Date().toISOString()},Z.connection_type??H?.connection_type),U=await this.db.updateTable("connections").set(F).where("id","=",$).returningAll().executeTakeFirst();if(!U)throw Error("Connection not found after update");return this.deserializeConnection(U)}async isReferencedByThread($){return await this.db.selectFrom("threads").select("id").where(_8`metadata -> 'githubRepo' ->> 'connectionId' = ${$}`).limit(1).executeTakeFirst()!==void 0}async delete($){await this.db.deleteFrom("connections").where("id","=",$).execute()}async testConnection($,Z){let Q=await this.findById($);if(!Q)throw Error("Connection not found");let Y=Date.now();if(Q.connection_type==="STDIO")return{healthy:!0,latencyMs:Date.now()-Y};if(!Q.connection_url)return{healthy:!1,latencyMs:Date.now()-Y};try{if(await HD(Q.connection_url))return{healthy:!1,latencyMs:Date.now()-Y};let J=Q.connection_headers,G=await FD()(Q.connection_url,{method:"POST",signal:AbortSignal.timeout(1e4),headers:{"Content-Type":"application/json",...Q.connection_token&&{Authorization:`Bearer ${Q.connection_token}`},...J?.headers,...Z},body:JSON.stringify({jsonrpc:"2.0",method:"ping",id:1})});return{healthy:G.ok||G.status===404,latencyMs:Date.now()-Y}}catch{return{healthy:!1,latencyMs:Date.now()-Y}}}async serializeConnection($,Z=$.connection_type){let Q={},Y=Z==="VIRTUAL"?KU($.metadata):$.metadata;for(let[X,J]of Object.entries($)){if(J===void 0)continue;if(X==="tools")continue;if(X==="connection_token"&&J)Q[X]=await this.vault.encrypt(J);else if(X==="configuration_state"&&J){let G=JSON.stringify(J);Q[X]=await this.vault.encrypt(G)}else if(X==="oauth_config"&&J)Q[X]=await this.vault.encrypt(JSON.stringify(J));else if(X==="connection_headers"&&J){let G=J;if(UU(G)&&G.envVars){let W={};for(let[K,H]of Object.entries(G.envVars))W[K]=await this.vault.encrypt(H);Q[X]=JSON.stringify({...G,envVars:W})}else Q[X]=JSON.stringify(G)}else if(c84.includes(X))Q[X]=J?JSON.stringify(X==="metadata"?Y:J):null;else Q[X]=J}if(Z==="VIRTUAL"&&$.metadata!==void 0){let X=MH(Y)?.repository;Q.repository_id=X?.repositoryId??null}return Q}async handleDecryptFailures($,Z){let Q=`connection ${$.id} (org: ${$.organization_id}, type: ${$.connection_type}, title: ${$.title})`;if(Qe1($.id))return;if($.status!=="active"){Qo0($.id);return}let{thresholdCrossed:Y}=Ze1($.id);if(!Y){for(let{label:X,error:J}of Z)console.error(`Failed to decrypt ${X} for ${Q}:`,J);return}try{await this.db.updateTable("connections").set({status:"error"}).where("id","=",$.id).execute(),Qo0($.id),console.error(`Disabled ${Q} after ${_l} consecutive decryption failures.`,Z[0]?.error)}catch(X){console.error(`Failed to disable ${Q} after decryption failures:`,X)}}async deserializeConnection($){let Z=[],Q=null;if($.connection_token)try{Q=await this.vault.decrypt($.connection_token)}catch(K){Z.push({label:"connection token",error:K})}let Y=null;if($.configuration_state)try{let K=await this.vault.decrypt($.configuration_state);Y=JSON.parse(K)}catch(K){Z.push({label:"configuration state",error:K})}let X=null;if(typeof $.oauth_config==="string")try{X=JSON.parse(await this.vault.decrypt($.oauth_config))}catch{try{X=JSON.parse($.oauth_config)}catch(K){Z.push({label:"oauth config",error:K})}}else X=$.oauth_config;let J=null,G=!1;if($.connection_headers)try{let K=JSON.parse($.connection_headers);if(UU(K)&&K.envVars){G=!0;let H={};for(let[F,U]of Object.entries(K.envVars))try{H[F]=await this.vault.decrypt(U)}catch(N){H[F]="",Z.push({label:`env var "${F}"`,error:N})}J={...K,envVars:H}}else J=K}catch(K){console.error(`Failed to parse connection_headers for connection ${$.id} (org: ${$.organization_id}, type: ${$.connection_type}, title: ${$.title}):`,K)}if(Z.length>0)await this.handleDecryptFailures($,Z);else if($.connection_token||$.configuration_state||$.oauth_config||G)Ye1($.id);let W=(K)=>{if(K===null)return null;if(typeof K==="string")try{return JSON.parse(K)}catch{return null}return K};return{id:$.id,organization_id:$.organization_id,created_by:$.created_by,updated_by:$.updated_by??void 0,title:$.title,description:$.description,icon:$.icon,app_name:$.app_name,app_id:$.app_id,slug:$.slug,url_slug:$.url_slug,connection_type:$.connection_type,connection_url:$.connection_url,connection_token:Q,connection_headers:J,oauth_config:X,configuration_state:Y,configuration_scopes:W($.configuration_scopes),metadata:$.connection_type==="VIRTUAL"?MH(W($.metadata)):W($.metadata),tools:null,bindings:W($.bindings),status:$.status,created_at:$.created_at,updated_at:$.updated_at}}}var c84,m84,Ne1;var Bo0=L(()=>{as();BU();Ml();oQ();R8();iJ0();zw();Xe1();Br();No0();c84=["connection_headers","configuration_scopes","metadata","bindings"],m84=new Set(["id","organization_id","created_by","updated_by","title","description","icon","app_name","app_id","slug","url_slug","connection_type","connection_url","status","created_at","updated_at"]),Ne1=new Set(["metadata","configuration_scopes","bindings"])});import{createHash as d84,randomBytes as i84,timingSafeEqual as tk5}from"crypto";function n84($){return $.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Lo0($){return d84("sha256").update($).digest("hex")}function we1($){let Z=Do0.length+1,Q=Z+Oe1;if(!$.startsWith(`${Do0}_`)||$.length<=Q+1||$[Q]!=="_")return null;let Y=$.slice(Z,Q),X=$.slice(Q+1);if(!Le1.test(Y)||!Le1.test(X))return null;return Y}function je1(){let $=n84(i84(p84)),Z=$.slice(0,Oe1),Q=`${Do0}_${Z}_${$}`;return{plaintext:Q,prefix:Z,hash:Lo0(Q)}}var Do0="stv",p84=32,Oe1=12,Le1;var Ee1=L(()=>{Le1=/^[A-Za-z0-9_-]+$/});function Pe1($){return{id:$.id,organizationId:$.organization_id,subjectConnectionId:$.subject_connection_id,tokenHash:$.token_hash,tokenPrefix:$.token_prefix,name:$.name,revokedAt:$.revoked_at,lastUsedAt:$.last_used_at,createdAt:$.created_at,updatedAt:$.updated_at}}class Oo0{db;constructor($){this.db=$}async createOrRotateWorkloadToken($){let Z=$.name??"default";return await this.db.transaction().execute(async(Y)=>{if(!await Y.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Subject connection not found in organization");let J=je1(),G=new Date().toISOString();await Y.updateTable("connection_workload_tokens").set({revoked_at:G,updated_at:G}).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",Z).where("revoked_at","is",null).execute();let W=await Y.insertInto("connection_workload_tokens").values({id:l8("cwt"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,token_hash:J.hash,token_prefix:J.prefix,name:Z,revoked_at:null,last_used_at:null,created_at:G,updated_at:G}).returningAll().executeTakeFirstOrThrow();return{plaintextToken:J.plaintext,record:Pe1(W)}})}async findActiveWorkloadToken($){let Z=await this.db.selectFrom("connection_workload_tokens").selectAll().where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",$.name??"default").where("revoked_at","is",null).executeTakeFirst();return Z?Pe1(Z):null}async revokeWorkloadToken($){let Z=new Date().toISOString();await this.db.updateTable("connection_workload_tokens").set({revoked_at:Z,updated_at:Z}).where("id","=",$.tokenId).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("revoked_at","is",null).execute()}async authenticateWorkloadToken($){let Z=we1($);if(!Z)return null;let Q=Lo0($),Y=await this.db.selectFrom("connection_workload_tokens").select(["id","organization_id","subject_connection_id","token_prefix"]).where("token_prefix","=",Z).where("token_hash","=",Q).where("revoked_at","is",null).executeTakeFirst();if(!Y)return null;let X=new Date().toISOString();return await this.db.updateTable("connection_workload_tokens").set({last_used_at:X,updated_at:X}).where("id","=",Y.id).execute(),{tokenId:Y.id,tokenPrefix:Y.token_prefix,organizationId:Y.organization_id,subjectConnectionId:Y.subject_connection_id}}async replaceGrantsForSubject($){await this.db.transaction().execute(async(Z)=>{if(!await Z.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Referenced connection not found in organization");let Y=[...new Set($.grants.map((G)=>G.targetConnectionId))];if(Y.length>0){if((await Z.selectFrom("connections").select("id").where("organization_id","=",$.organizationId).where("id","in",Y).execute()).length!==Y.length)throw Error("Referenced connection not found in organization")}if(await Z.deleteFrom("connection_credential_grants").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).execute(),$.grants.length===0)return;let X=new Date().toISOString(),J=$.grants.map((G)=>({id:l8("ccg"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,target_connection_id:G.targetConnectionId,scope:G.scope,created_by:$.createdBy,created_at:X,updated_at:X}));await Z.insertInto("connection_credential_grants").values(J).execute()})}async hasGrant($){return!!await this.db.selectFrom("connection_credential_grants").select("id").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("target_connection_id","=",$.targetConnectionId).where("scope","=",$.scope).executeTakeFirst()}}var aJ0="credential:access-token:read",eJ0="credential:configuration:read";var $G0=L(()=>{oQ();Ee1()});function ze1($,Z){let Q=!1,Y={...$},X=$.pinnedViews;if(Array.isArray(X)){let W=X.filter((K)=>K.connectionId!==Z);if(W.length!==X.length)Q=!0,Y.pinnedViews=W.length>0?W:null}let J=$.homeTile;if(J&&J.connectionId===Z)Q=!0,Y.homeTile=null;let G=$.homeTiles;if(Array.isArray(G)){let W=G.filter((K)=>K.connectionId!==Z);if(W.length!==G.length)Q=!0,Y.homeTiles=W.length>0?W:null}return{ui:Y,changed:Q}}function G9($){return wo0.test($)}function l2($){let Z=(Q)=>typeof Q==="string"?Q.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}function Ae1($){let Z=typeof $?.metadata?.analyticsSiteSlug==="string"?$.metadata.analyticsSiteSlug.trim().toLowerCase():"";if(Z&&G9(Z))return Z;return l2($)}var wo0;var pX=L(()=>{wo0=/^[a-z0-9][a-z0-9-]{0,59}$/});import{sql as t84}from"kysely";function jo0($){return $ instanceof Date?$.toISOString():String($)}function c2($){return{slug:$.slug,organizationId:$.organization_id,source:$.source,projectId:$.project_id,linkedAt:$.linked_at?jo0($.linked_at):null,createdBy:$.created_by,createdAt:jo0($.created_at),updatedBy:$.updated_by,updatedAt:jo0($.updated_at)}}class DD{db;constructor($){this.db=$}async claimSite($){if(!G9($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"deco-import",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((J)=>J.column("slug").doNothing()).returningAll().executeTakeFirst();if(Q)return c2(Q);let Y=await this.getBySlug($.slug);if(!Y)throw new Lr($.slug,"unknown");if(Y.organizationId===null)throw new zZ("reserved",$.slug);if(Y.organizationId!==$.organizationId)throw new Lr($.slug,Y.organizationId);let X=await this.db.updateTable("org_sites").set({source:$.source??Y.source,updated_by:$.by,updated_at:Z}).where("slug","=",$.slug).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return c2(X)}async reassignSite($){if(!G9($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"manual",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((X)=>X.column("slug").doUpdateSet({organization_id:$.organizationId,source:$.source??"manual",updated_by:$.by,updated_at:Z}).where("org_sites.organization_id","is not",null).where("org_sites.linked_at","is",null)).returningAll().executeTakeFirst();if(Q)return c2(Q);if((await this.getBySlug($.slug))?.organizationId===null)throw new zZ("reserved",$.slug);throw new zZ("in_use",$.slug)}async releaseSite($,Z){let Q=await this.db.deleteFrom("org_sites").where("slug","=",$).where("organization_id","=",Z).where("linked_at","is",null).executeTakeFirst();if(Number(Q.numDeletedRows??0n)>0)return!0;if(await this.isOwnedBy($,Z))throw new zZ("in_use",$);return!1}async getByProject($){let Z=await this.db.selectFrom("org_sites").selectAll().where("project_id","=",$).executeTakeFirst();return Z?c2(Z):null}async link($){let{slug:Z,organizationId:Q,projectId:Y,by:X}=$,J=await this.getBySlug(Z);if(!J)throw new zZ("not_found",Z);if(J.organizationId===null)throw new zZ("reserved",Z);if(J.organizationId!==Q)throw new zZ("not_owned",Z);if(J.projectId===Y)return J;if(J.projectId!==null)throw new zZ("linked_elsewhere",Z);if(!await this.db.selectFrom("connections").select("id").where("id","=",Y).where("organization_id","=",Q).where("connection_type","=","VIRTUAL").executeTakeFirst())throw new zZ("project_not_found",Z);let W=await this.getByProject(Y);if(W&&W.slug!==Z)throw new zZ("project_has_other_slug",Z);let K=new Date,H;try{H=await this.db.updateTable("org_sites").set({project_id:Y,linked_at:t84`coalesce(linked_at, now())`,updated_by:X,updated_at:K}).where("slug","=",Z).where("organization_id","=",Q).where("project_id","is",null).returningAll().executeTakeFirst()}catch(U){if(U.code==="23505")throw new zZ("project_has_other_slug",Z);throw U}if(H)return c2(H);let F=await this.getBySlug(Z);if(F?.projectId===Y)return F;if(!F)throw new zZ("not_found",Z);if(F.organizationId===null)throw new zZ("reserved",Z);if(F.organizationId!==Q)throw new zZ("not_owned",Z);throw new zZ("linked_elsewhere",Z)}async getBySlug($){let Z=await this.db.selectFrom("org_sites").selectAll().where("slug","=",$).executeTakeFirst();return Z?c2(Z):null}async listByOrg($){return(await this.db.selectFrom("org_sites").selectAll().where("organization_id","=",$).orderBy("slug","asc").execute()).map((Q)=>c2(Q))}async isOwnedBy($,Z){return!!await this.db.selectFrom("org_sites").select("slug").where("slug","=",$).where("organization_id","=",Z).executeTakeFirst()}}var Eo0="The site id can't change: CDN paths, tokens and asset URLs use it.",m2,o84,zZ,Lr;var xl=L(()=>{pX();m2=class m2 extends Error{code="SITE_SLUG_IMMUTABLE";constructor(){super(Eo0);this.name="SiteSlugImmutableError"}};o84={not_found:"This site id isn't registered for the organization.",reserved:"This site id belonged to a deleted organization and stays reserved.",not_owned:"This site id belongs to another organization.",linked_elsewhere:"This site id is already the site of another project.",project_has_other_slug:`This project already has a site id. ${Eo0}`,project_not_found:"Project not found in this organization.",in_use:`This site id has been used by a project, so it can't be released or moved. ${Eo0}`};zZ=class zZ extends Error{code;slug;constructor($,Z){super(o84[$]);this.code=$;this.slug=Z;this.name="OrgSiteLinkError"}};Lr=class Lr extends Error{slug;ownerOrganizationId;constructor($,Z){super(`Site slug "${$}" is already owned by another organization`);this.slug=$;this.ownerOrganizationId=Z;this.name="OrgSiteConflictError"}}});import{sql as Or}from"kysely";function s84($){return $.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function Po0($){let Z=$?.repository?.repositoryId;return typeof Z==="string"&&Z.length>0?Z:null}function r84($,Z){let Q=$?.siteSlug;if(typeof Q==="string"&&Q.trim()&&Q.trim().toLowerCase()!==Z)throw new m2;return{...$,siteSlug:Z}}class OU{db;constructor($){this.db=$}async create($,Z,Q,Y){let X=Y?.id??l8("vir"),J=new Date().toISOString(),G=rs(Q.title,"project");await sJ0(this.db,$,G,(K)=>this.db.transaction().execute(async(H)=>{if(await H.insertInto("connections").values({id:X,organization_id:$,url_slug:K,created_by:Z,updated_by:Z,title:Q.title,description:Q.description??null,icon:Q.icon??null,app_name:null,app_id:null,connection_type:"VIRTUAL",pinned:Q.pinned??!1,connection_url:`virtual://${X}`,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:Q.metadata?JSON.stringify(KU(Q.metadata)):null,repository_id:Po0(Q.metadata),bindings:null,status:Q.status??"active",created_at:J,updated_at:J}).execute(),Q.connections.length>0)await H.insertInto("connection_aggregations").values(Q.connections.map((F)=>({id:l8("agg"),parent_connection_id:X,child_connection_id:F.connection_id,selected_tools:F.selected_tools?JSON.stringify(F.selected_tools):null,selected_resources:F.selected_resources?JSON.stringify(F.selected_resources):null,selected_prompts:F.selected_prompts?JSON.stringify(F.selected_prompts):null,dependency_mode:"direct",created_at:J}))).execute()}));let W=await this.findById(X);if(!W)throw Error(`Failed to create virtual MCP with id: ${X}`);return W}async findById($,Z){let Q=HQ($);if(Q)return{...st0(Z??Q),pinned:!1,connections:[]};return this.findByIdInternal(this.db,$)}async findByIdInternal($,Z){let Q=await $.selectFrom("connections").selectAll().where("id","=",Z).where("connection_type","=","VIRTUAL").executeTakeFirst();if(!Q)return null;let Y=await $.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","=",Z).where("dependency_mode","=","direct").execute(),[X]=await this.withLinkedSiteSlugs($,[this.deserializeVirtualMCPEntity(Q,Y)]);return X??null}async withLinkedSiteSlugs($,Z){let Q=Z.flatMap((J)=>J.id?[J.id]:[]);if(Q.length===0)return Z;let Y=await $.selectFrom("org_sites").select(["slug","project_id"]).where("project_id","in",Q).execute();if(Y.length===0)return Z;let X=new Map(Y.map((J)=>[J.project_id,J.slug]));return Z.map((J)=>{let G=J.id?X.get(J.id):void 0;return G?{...J,metadata:{...J.metadata,siteSlug:G}}:J})}async currentSiteSlug($,Z){let Q=await $.selectFrom("org_sites").select("slug").where("project_id","=",Z).executeTakeFirst();if(Q)return Q.slug;let Y=await $.selectFrom("connections").select("metadata").where("id","=",Z).where("connection_type","=","VIRTUAL").executeTakeFirst(),X=this.parseJson(Y?.metadata??null)?.siteSlug;return typeof X==="string"&&X.trim()?X.trim().toLowerCase():null}async searchAcrossMemberships($){let{userId:Z,term:Q,limit:Y,offset:X=0,organizationId:J}=$,G=`%${s84(Q)}%`,W=this.db.selectFrom("connections").innerJoin("member",(H)=>H.onRef("member.organizationId","=","connections.organization_id").on("member.userId","=",Z)).innerJoin("organization","organization.id","connections.organization_id").where("connections.connection_type","=","VIRTUAL").where((H)=>H.or([H("connections.title","ilike",G),H("connections.description","ilike",G)]));if(J)W=W.where("connections.organization_id","=",J);return(await W.select(["connections.id as id","connections.title as title","connections.icon as icon","connections.metadata as metadata","connections.organization_id as organization_id","organization.name as organization_name","organization.slug as organization_slug","organization.metadata as organization_metadata"]).orderBy("connections.updated_at","desc").orderBy("connections.id","asc").limit(Y).offset(X).execute()).map((H)=>({id:H.id,title:H.title,icon:H.icon,metadata:MH(this.parseJson(H.metadata)),organization_id:H.organization_id,organization_name:H.organization_name,organization_slug:H.organization_slug,organization_metadata:H.organization_metadata}))}async list($,Z){let Q=this.db.selectFrom("connections").selectAll().where("organization_id","=",$).where("connection_type","=","VIRTUAL");if(Z?.pinnedOnly)Q=Q.where("pinned","=",!0);let Y=await Q.orderBy("created_at","asc").orderBy("id","asc").execute(),X=Y.map((W)=>W.id);if(X.length===0)return[];let J=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",X).where("dependency_mode","=","direct").execute(),G=new Map;for(let W of J){let K=G.get(W.parent_connection_id)??[];K.push(W),G.set(W.parent_connection_id,K)}return this.withLinkedSiteSlugs(this.db,Y.map((W)=>this.deserializeVirtualMCPEntity(W,G.get(W.id)??[])))}async listByIds($,Z){if(Z.length===0)return[];let Q=await this.db.selectFrom("connections").selectAll().where("id","in",Z).where("organization_id","=",$).where("connection_type","=","VIRTUAL").execute();if(Q.length===0)return[];let Y=Q.map((G)=>G.id),X=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",Y).where("dependency_mode","=","direct").execute(),J=new Map;for(let G of X){let W=J.get(G.parent_connection_id)??[];W.push(G),J.set(G.parent_connection_id,W)}return this.withLinkedSiteSlugs(this.db,Q.map((G)=>this.deserializeVirtualMCPEntity(G,J.get(G.id)??[])))}async listByConnectionId($,Z){let Y=(await this.db.selectFrom("connection_aggregations").select("parent_connection_id").where("child_connection_id","=",Z).execute()).map((K)=>K.parent_connection_id);if(Y.length===0)return[];let X=await this.db.selectFrom("connections").selectAll().where("id","in",Y).where("organization_id","=",$).where("connection_type","=","VIRTUAL").execute();if(X.length===0)return[];let J=X.map((K)=>K.id),G=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",J).where("dependency_mode","=","direct").execute(),W=new Map;for(let K of G){let H=W.get(K.parent_connection_id)??[];H.push(K),W.set(K.parent_connection_id,H)}return this.withLinkedSiteSlugs(this.db,X.map((K)=>this.deserializeVirtualMCPEntity(K,W.get(K.id)??[])))}async update($,Z,Q){let Y=new Date().toISOString(),X={updated_at:Y,updated_by:Z};if(Q.title!==void 0)X.title=Q.title;if(Q.description!==void 0)X.description=Q.description;if(Q.icon!==void 0)X.icon=Q.icon;if(Q.status!==void 0)X.status=Q.status;if(Q.pinned!==void 0)X.pinned=Q.pinned;if(Q.metadata!==void 0){let W=await this.currentSiteSlug(this.db,$),K=W?r84(Q.metadata,W):Q.metadata;X.repository_id=Po0(K),X.metadata=K?JSON.stringify(KU(K)):null}if(Q.url_slug)await rJ0(this.db,$,Q.url_slug);let J=[];await this.db.transaction().execute(async(W)=>{if(await W.updateTable("connections").set(X).where("id","=",$).where("connection_type","=","VIRTUAL").execute(),Q.connections!==void 0){let K=await W.selectFrom("connection_aggregations").select("child_connection_id").where("parent_connection_id","=",$).where("dependency_mode","=","direct").execute(),H=new Set(K.map((U)=>U.child_connection_id));if(await W.deleteFrom("connection_aggregations").where("parent_connection_id","=",$).where("dependency_mode","=","direct").execute(),Q.connections.length>0)await W.insertInto("connection_aggregations").values(Q.connections.map((U)=>({id:l8("agg"),parent_connection_id:$,child_connection_id:U.connection_id,selected_tools:U.selected_tools?JSON.stringify(U.selected_tools):null,selected_resources:U.selected_resources?JSON.stringify(U.selected_resources):null,selected_prompts:U.selected_prompts?JSON.stringify(U.selected_prompts):null,dependency_mode:"direct",created_at:Y}))).execute();let F=new Set(Q.connections.map((U)=>U.connection_id));for(let U of H)if(!F.has(U))J.push(U)}});for(let W of J)await this.cleanOrphanedPinnedViews([$],W);let G=await this.findById($);if(!G)throw Error("Virtual MCP not found after update");return G}async patchMetadata($){if(Object.hasOwn($.set,"siteSlug")||$.unset.includes("siteSlug"))throw new m2;let Z=[...new Set([...$.unset,...Object.keys($.set)].flatMap((X)=>[X,Qa1(X)]))],Q=Or`(coalesce(metadata::jsonb, '{}'::jsonb) - ${Z}::text[]) || ${JSON.stringify(KU($.set))}::jsonb`,Y=await this.db.updateTable("connections").set({metadata:Or`(${Q})::text`,...Object.hasOwn($.set,"repository")||$.unset.includes("repository")?{repository_id:Po0($.set)}:{},updated_at:new Date().toISOString(),updated_by:$.by}).where("id","=",$.id).where("organization_id","=",$.organizationId).where("connection_type","=","VIRTUAL").where((X)=>X.or([X("metadata","is",null),Or`jsonb_typeof(metadata::jsonb) = 'object'`])).executeTakeFirst();return Number(Y.numUpdatedRows)>0}async clearAnalyticsSiteSlugReferences($,Z){let Q=await this.db.updateTable("connections").set({metadata:Or`(metadata::jsonb - 'analyticsSiteSlug')::text`,updated_at:new Date().toISOString()}).where("organization_id","=",$).where("connection_type","=","VIRTUAL").where(Or`metadata::jsonb ->> 'analyticsSiteSlug' = ${Z}`).executeTakeFirst();return Number(Q.numUpdatedRows)}async delete($){await this.db.transaction().execute(async(Z)=>{await Z.deleteFrom("threads").where("virtual_mcp_id","=",$).execute(),await Z.deleteFrom("connection_aggregations").where("parent_connection_id","=",$).execute(),await Z.deleteFrom("connections").where("id","=",$).where("connection_type","=","VIRTUAL").execute()})}async removeConnectionReferences($){let Z=await this.db.selectFrom("connection_aggregations").select("parent_connection_id").where("child_connection_id","=",$).execute();await this.db.deleteFrom("connection_aggregations").where("child_connection_id","=",$).execute(),await this.cleanOrphanedPinnedViews(Z.map((Q)=>Q.parent_connection_id),$)}async cleanOrphanedPinnedViews($,Z){for(let Q of $){let Y=await this.db.selectFrom("connections").select("metadata").where("id","=",Q).executeTakeFirst();if(!Y?.metadata)continue;let X;try{X=typeof Y.metadata==="string"?JSON.parse(Y.metadata):Y.metadata}catch{continue}let J=X.ui??null;if(!J)continue;let{ui:G,changed:W}=ze1(J,Z);if(!W)continue;let K={...X,ui:G};await this.db.updateTable("connections").set({metadata:JSON.stringify(K)}).where("id","=",Q).execute()}}deserializeVirtualMCPEntity($,Z){let Q=$.created_at instanceof Date?$.created_at.toISOString():$.created_at,Y=$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at,X=$.status==="active"?"active":"inactive",J=this.parseJson($.metadata),{sandboxMap:G,...W}=MH(J)??{},K=G!==void 0?Dt0(G):void 0;return{id:$.id,organization_id:$.organization_id,title:$.title,url_slug:$.url_slug,description:$.description,icon:$.icon,status:X,pinned:$.pinned,created_at:Q,updated_at:Y,created_by:$.created_by,updated_by:$.updated_by??void 0,metadata:{...W,instructions:J?.instructions??null,...K!==void 0?{sandboxMap:K}:{}},connections:Z.map((H)=>({connection_id:H.child_connection_id,selected_tools:this.parseJson(H.selected_tools),selected_resources:this.parseJson(H.selected_resources),selected_prompts:this.parseJson(H.selected_prompts)}))}}parseJson($){if($===null)return null;if(typeof $==="string")try{return JSON.parse($)}catch{return null}return $}}function Te1($){let Z=new Map,Q=(Y,X)=>{let J=Z.get(Y);if(J)return J;let G=X();return Z.set(Y,G),G};return new Proxy($,{get(Y,X,J){if(X==="list")return(G,W)=>Q(`list:${G}:${W?.pinnedOnly?1:0}`,()=>Y.list(G,W));if(X==="create"||X==="update"||X==="delete"||X==="removeConnectionReferences")return(...G)=>{return Z.clear(),Y[X](...G)};return Reflect.get(Y,X,J)}})}var ZG0=L(()=>{zw();No0();as();oQ();R8();xl()});function d2($){let Z=String($??"");if(Z&&!Z.includes("T"))return Z.replace(" ","T")+"Z";return Z}function e$($){return $.replace(/\0/g,"").replace(/\\/g,"\\\\").replace(/'/g,"''")}function I4($){let Z=Number($??0);return Number.isFinite(Z)?Z:0}function e84($){if(!a84.has($))throw Error(`Invalid groupByColumn: ${$}`);return $}function zo0($){if(!$44.test($))throw Error(`Invalid JSONPath: ${$}`);if($.startsWith("$."))return $;if($.startsWith("."))return`$${$}`;return`$.${$}`}function qo0($){return $.replace(/^\$\./,"").split(".").map((Q)=>`'${e$(Q)}'`).join(", ")}function Y44($){let Z=Z44.exec($);if(!Z||!Z[1]||!Z[2])throw Error(`Invalid interval: ${$}`);let Q=parseInt(Z[1],10),Y=Z[2],X=Q44[Y];if(Q<1||Q>X)throw Error(`Invalid interval amount: ${Q}${Y} (max ${X}${Y})`);return{amount:Q,unit:Y}}function xw($,Z,Q="timestamp"){let{amount:Y,unit:X}=Y44($),G={m:"MINUTE",h:"HOUR",d:"DAY"}[X];if(Z==="duckdb")return`time_bucket(INTERVAL '${Y} ${G}', CAST(${Q} AS TIMESTAMP))`;return`toStartOfInterval(${Q}, INTERVAL ${Y} ${G})`}function wr($,Z,Q){if(Q==="duckdb")return`json_extract_string(${$}, '${Z}')`;let Y=qo0(Z);return`JSONExtractString(${$}, ${Y})`}function X44($,Z,Q){if(Q==="duckdb")return`CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let Y=qo0(Z);return`JSONExtractFloat(${$}, ${Y})`}function Re1($,Z,Q){if(Q==="duckdb")return`TRY_CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let Y=qo0(Z);return`toFloat64OrZero(JSONExtractString(${$}, ${Y}))`}function Ao0($){if($===null||$===void 0)return{};if(typeof $==="object")return $;let Z=String($);try{return JSON.parse(Z)}catch{return{_decocms_truncated:Z}}}function To0($){return{id:String($.id??""),organizationId:String($.organization_id??""),connectionId:String($.connection_id??""),toolName:String($.tool_name??""),input:Ao0($.input),output:Ao0($.output),isError:$.is_error===1||$.is_error===!0||$.is_error==="1"||typeof $.is_error==="bigint"&&$.is_error===1n,errorMessage:$.error_message!=null?String($.error_message):null,durationMs:Number($.duration_ms??0),timestamp:(()=>{if($.timestamp instanceof Date)return $.timestamp.toISOString();let Z=String($.timestamp??""),Q=new Date(Z.includes("T")?Z:Z.replace(" ","T")+"Z");return Number.isNaN(Q.getTime())?Z:Q.toISOString()})(),userId:$.user_id!=null?String($.user_id):null,requestId:String($.request_id??""),userAgent:$.user_agent!=null?String($.user_agent):null,virtualMcpId:$.virtual_mcp_id!=null?String($.virtual_mcp_id):null,properties:$.properties?Ao0($.properties):null}}function Ve1($,Z){let Q=[];if($.properties)for(let[Y,X]of Object.entries($.properties)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${J}') = '${G}'`);else Q.push(`JSONExtractString(properties, '${J}') = '${G}'`)}if($.propertyKeys)for(let Y of $.propertyKeys){let X=e$(Y);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${X}') IS NOT NULL AND json_extract_string(properties, '$.${X}') != ''`);else Q.push(`JSONExtractString(properties, '${X}') IS NOT NULL AND JSONExtractString(properties, '${X}') != ''`)}if($.propertyPatterns)for(let[Y,X]of Object.entries($.propertyPatterns)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${J}') ILIKE '${G}'`);else Q.push(`JSONExtractString(properties, '${J}') ILIKE '${G}'`)}if($.propertyInValues)for(let[Y,X]of Object.entries($.propertyInValues)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`list_contains(string_split(json_extract_string(properties, '$.${J}'), ','), '${G}')`);else Q.push(`has(splitByChar(',', JSONExtractString(properties, '${J}')), '${G}')`)}return Q}function Me1($,Z){let Q=[];if(uW(Q,Z?.startDate,$),!Z)return Q;if(Z.connectionIds?.length){let Y=Z.connectionIds.map((X)=>`'${e$(X)}'`).join(",");Q.push(`connection_id IN (${Y})`)}if(Z.toolNames?.length){let Y=Z.toolNames.map((X)=>`'${e$(X)}'`).join(",");Q.push(`tool_name IN (${Y})`)}if(Z.virtualMcpIds?.length){let Y=Z.virtualMcpIds.map((X)=>`'${e$(X)}'`).join(",");Q.push(`virtual_mcp_id IN (${Y})`)}if(Z.endDate)Q.push(hW(Z.endDate,$));if(Z.propertyFilters)Q.push(...Ve1(Z.propertyFilters,$));return Q}function Ie1($,Z,Q="timestamp"){if(Z==="duckdb")return`CAST(${Q} AS TIMESTAMP) >= TIMESTAMP '${$.toISOString()}'`;if(Q==="bucket")return`${Q} >= parseDateTimeBestEffort('${$.toISOString()}')`;return`${Q} >= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function hW($,Z,Q="timestamp"){if(Z==="duckdb")return`CAST(${Q} AS TIMESTAMP) <= TIMESTAMP '${$.toISOString()}'`;if(Q==="bucket")return`${Q} <= parseDateTimeBestEffort('${$.toISOString()}')`;return`${Q} <= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function uW($,Z,Q,Y="timestamp"){if(Z)$.push(Ie1(Z,Q,Y));else if(Q==="clickhouse")$.push(Ie1(new Date(Date.now()-J44),Q,Y))}class Mo0{engine;sourceFactory;metricEngine;metricSourceFactory;dialect;metricsFromLogs;constructor($,Z,Q,Y,X="clickhouse",J=!1){this.engine=$;this.sourceFactory=Z;this.metricEngine=Q;this.metricSourceFactory=Y;this.dialect=X;this.metricsFromLogs=J}async query($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`];if($.connectionId)Q.push(`connection_id = '${e$($.connectionId)}'`);if($.excludeConnectionIds?.length){let N=$.excludeConnectionIds.map((B)=>`'${e$(B)}'`).join(",");Q.push(`connection_id NOT IN (${N})`)}if($.virtualMcpId)Q.push(`virtual_mcp_id = '${e$($.virtualMcpId)}'`);if($.toolName)Q.push(`tool_name = '${e$($.toolName)}'`);if($.isError!==void 0)Q.push(`is_error = ${$.isError?1:0}`);if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));if($.propertyFilters)Q.push(...Ve1($.propertyFilters,this.dialect));let Y=1000,X=Math.min(Math.max(1,Math.floor($.limit??50)),Y),J=Math.max(0,Math.floor($.offset??0)),G=Q.join(" AND ");if(this.dialect==="duckdb"){let N=`SELECT ${qe1}, count(*) OVER () AS _total FROM ${Z} WHERE ${G} ORDER BY timestamp DESC LIMIT ${X} OFFSET ${J}`,B=await this.engine.query(N);if(B.length===0)return{logs:[],total:0};let D=Number(B[0]._total??0);return{logs:B.map(To0),total:D}}let W=`SELECT count(*) AS total FROM ${Z} WHERE ${G}`,K=`SELECT ${qe1} FROM ${Z} WHERE ${G} ORDER BY timestamp DESC LIMIT ${X} OFFSET ${J}`,[H,F]=await Promise.all([this.engine.query(W),this.engine.query(K)]),U=Number(H[0]?.total??0);return{logs:F.map(To0),total:U}}async getById($,Z){if(!$||!Z)return null;let Y=`SELECT * FROM ${this.sourceFactory($)} WHERE organization_id = '${e$($)}' AND id = '${e$(Z)}' LIMIT 1`,X=await this.engine.query(Y);if(X.length===0)return null;return To0(X[0])}async getStats($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`];if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));let Y=`SELECT count(*) AS total_calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1.0 ELSE 0.0 END) / NULLIF(count(*), 0), 0) AS error_rate, coalesce(avg(duration_ms), 0) AS avg_duration_ms FROM ${Z} WHERE ${Q.join(" AND ")}`,J=(await this.engine.query(Y))[0]??{};return{totalCalls:Number(J.total_calls??0),errorRate:Number(J.error_rate??0),avgDurationMs:Number(J.avg_duration_ms??0)}}async queryToolCallHeatmap($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`,"type = 'tool_call'"];if($.filters?.virtualMcpIds?.length){let G=$.filters.virtualMcpIds.map((W)=>`'${e$(W)}'`).join(",");Q.push(`virtual_mcp_id IN (${G})`)}if($.filters?.excludeConnectionIds?.length){let G=$.filters.excludeConnectionIds.map((W)=>`'${e$(W)}'`).join(",");Q.push(`connection_id NOT IN (${G})`)}if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));let Y=Math.min(Math.max(1,Math.floor($.limit??500)),1000),X=`SELECT virtual_mcp_id, tool_name, count(*) AS calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1 ELSE 0 END), 0) AS errors, coalesce(sum(length(output)), 0) AS output_size FROM ${Z} WHERE ${Q.join(" AND ")} GROUP BY virtual_mcp_id, tool_name ORDER BY calls DESC LIMIT ${Y}`;return{cells:(await this.engine.query(X)).map((G)=>({virtualMcpId:G.virtual_mcp_id?String(G.virtual_mcp_id):null,toolName:String(G.tool_name??""),calls:Number(G.calls??0),errors:Number(G.errors??0),outputSize:Number(G.output_size??0)}))}}async queryLlmUsageStats($){let Z={totalCalls:0,totalErrors:0,avgDurationMs:0,p50DurationMs:0,p95DurationMs:0,totalInputTokens:0,totalOutputTokens:0,totalTokens:0,totalCostUsd:0,topTools:[],timeseries:[]};if(!$.organizationId||!$.connectionId)return Z;let Q=this.dialect,Y=Q==="clickhouse",X=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),J=xw($.interval,Q,"timestamp"),G=(j)=>`coalesce(${Re1("properties",`$.${j}`,Q)}, 0)`,W=Y?"count()":"count(*)",K=Y?"countIf(is_error = 1)":"count(*) FILTER (WHERE is_error = 1)",H=(j)=>Y?`quantile(${j})(duration_ms)`:`quantile_cont(duration_ms, ${j})`,F=[`organization_id = '${e$($.organizationId)}'`,`connection_id = '${e$($.connectionId)}'`];if(uW(F,$.startDate,Q),$.endDate)F.push(hW($.endDate,Q));if($.userIds?.length){let j=$.userIds.slice(0,100).map((E)=>`'${e$(E)}'`).join(",");F.push(`user_id IN (${j})`)}let U=F.join(" AND "),N=Math.min(Math.max(1,Math.floor($.topN??5)),20),B=`${W} AS calls,
+  `.execute($),G=J[0];return G?{id:G.id,canonicalSlug:G.url_slug}:null}var h84="idx_connections_org_url_slug",u84,Uo0;var No0=L(()=>{zw();u84=os-16;Uo0=class Uo0 extends Error{constructor($){super(`The URL slug "${$}" is already in use in this organization`);this.name="UrlSlugTakenError"}}});import{sql as _8}from"kysely";function Be1($){if($.length===0)return null;let Z=$[0];if($.length===1&&m84.has(Z))return _8.ref(Z);if($.length===2&&Ne1.has(Z)){let Q=$[1];return _8`${_8.ref(Z)}->>${_8.lit(Q)}`}if($.length>2&&Ne1.has(Z)){let Q=`{${$.slice(1).join(",")}}`;return _8`${_8.ref(Z)}#>>${_8.lit(Q)}`}return null}function De1($){if("conditions"in $){let{operator:J,conditions:G}=$;if(G.length===0)return _8`true`;let W=G.map((K)=>De1(K));switch(J){case"and":return _8`(${_8.join(W,_8` AND `)})`;case"or":return _8`(${_8.join(W,_8` OR `)})`;case"not":return _8`NOT (${_8.join(W,_8` AND `)})`;default:return _8`true`}}let{field:Z,operator:Q,value:Y}=$,X=Be1(Z);if(!X)return _8`true`;switch(Q){case"eq":return Y===null?_8`${X} IS NULL`:_8`${X} = ${_8.val(Y)}`;case"gt":return _8`${X} > ${_8.val(Y)}`;case"gte":return _8`${X} >= ${_8.val(Y)}`;case"lt":return _8`${X} < ${_8.val(Y)}`;case"lte":return _8`${X} <= ${_8.val(Y)}`;case"in":if(!Array.isArray(Y)||Y.length===0)return _8`false`;return _8`${X} IN (${_8.join(Y.map((J)=>_8.val(J)))})`;case"like":return _8`${X} ILIKE ${_8.val(Y)}`;case"contains":{let J=String(Y).replace(/[%_\\]/g,"\\$&");return _8`${X} ILIKE ${_8.val(`%${J}%`)}`}default:return _8`true`}}class Dr{db;vault;constructor($,Z){this.db=$;this.vault=Z}async create($){let Z=$.id??l8("conn"),Q=new Date().toISOString(),Y=await this.db.selectFrom("connections").select("organization_id").where("id","=",Z).executeTakeFirst();if(Y){if(Y.organization_id!==$.organization_id)throw Error("Connection ID already exists");return this.update(Z,$)}return this.insertNew(Z,$,Q)}async createNew($){let Z=$.id??l8("conn");return this.insertNew(Z,$,new Date().toISOString())}async insertNew($,Z,Q){let{url_slug:Y,...X}=Z,J=g2(Z),G=await sJ0(this.db,Z.organization_id??"",rs(Z.title,rs(J,"app")),async(W)=>{let K=await this.serializeConnection({...X,id:$,slug:J,url_slug:W,status:"active",created_at:Q,updated_at:Q});try{return await this.db.insertInto("connections").values(K).returningAll().executeTakeFirst()}catch(H){if(H instanceof Error&&!oJ0(H)&&(H.message.includes("duplicate key")||H.message.includes("unique constraint")))throw Error("Connection ID already exists");throw H}});if(!G)throw Error(`Failed to create connection with id: ${$}`);return this.deserializeConnection(G)}async findById($,Z){let Q=HQ($);if(Q)return ma1(Z??Q);let Y=this.db.selectFrom("connections").selectAll().where("id","=",$);if(Z)Y=Y.where("organization_id","=",Z);let X=await Y.executeTakeFirst();return X?this.deserializeConnection(X):null}async findBySanitizedId($){let Z=$.replace(/-/g,"_"),Q=await this.db.selectFrom("connections").selectAll().where(_8`replace(id, '-', '_')`,"=",Z).where("id","!=",$).executeTakeFirst();return Q?this.deserializeConnection(Q):null}async list($,Z){let Q=this.db.selectFrom("connections").selectAll().where("organization_id","=",$);if(!Z?.includeVirtual)Q=Q.where("connection_type","!=","VIRTUAL");if(Z?.slug)Q=Q.where("slug","=",Z.slug);if(Z?.where)Q=Q.where(De1(Z.where));let Y=this.db.selectFrom(Q.as("filtered")).select(_8`count(*)::int`.as("count"));if(Z?.orderBy&&Z.orderBy.length>0)for(let K of Z.orderBy){let H=Be1(K.field);if(!H)continue;let F=K.direction==="desc"?_8`desc`:_8`asc`,U=K.nulls==="first"?_8`nulls first`:_8`nulls last`;Q=Q.orderBy(_8`${H} ${F} ${U}`)}if(Z?.limit!==void 0)Q=Q.limit(Z.limit);if(Z?.offset)Q=Q.offset(Z.offset);let[X,J]=await Promise.all([Y.executeTakeFirst(),Q.execute()]),G=X?.count??0;return{items:await Promise.all(J.map((K)=>this.deserializeConnection(K))),totalCount:G}}async searchByTitle($,Z,Q){let Y=this.db.selectFrom("connections").select(["id","title","icon","slug"]).where("organization_id","=",$).where("connection_type","!=","VIRTUAL");if(Z)Y=Y.where("title","ilike",`%${vl(Z)}%`);return(await Y.orderBy("updated_at","desc").limit(Q).execute()).map((J)=>({id:J.id,title:J.title??"",icon:J.icon??null,slug:J.slug??null}))}resolveUrlSlug($,Z,Q){return Ue1(this.db,$,Z,Q)}async update($,Z){let{id:Q,organization_id:Y,created_by:X,created_at:J,url_slug:G,...W}=Z;if(Z=W,G)await rJ0(this.db,$,G);if(Object.keys(Z).length===0){let N=await this.findById($);if(!N)throw Error("Connection not found");return N}let K={...Z},H=await this.db.selectFrom("connections").select(["app_name","connection_url","title","connection_type"]).where("id","=",$).executeTakeFirst();if(H){let N=(B)=>Z[B]===void 0?H[B]:Z[B];K.slug=g2({app_name:N("app_name"),connection_url:N("connection_url"),title:N("title"),id:$})}let F=await this.serializeConnection({...K,updated_at:new Date().toISOString()},Z.connection_type??H?.connection_type),U=await this.db.updateTable("connections").set(F).where("id","=",$).returningAll().executeTakeFirst();if(!U)throw Error("Connection not found after update");return this.deserializeConnection(U)}async isReferencedByThread($){return await this.db.selectFrom("threads").select("id").where(_8`metadata -> 'githubRepo' ->> 'connectionId' = ${$}`).limit(1).executeTakeFirst()!==void 0}async delete($){await this.db.deleteFrom("connections").where("id","=",$).execute()}async testConnection($,Z){let Q=await this.findById($);if(!Q)throw Error("Connection not found");let Y=Date.now();if(Q.connection_type==="STDIO")return{healthy:!0,latencyMs:Date.now()-Y};if(!Q.connection_url)return{healthy:!1,latencyMs:Date.now()-Y};try{if(await HD(Q.connection_url))return{healthy:!1,latencyMs:Date.now()-Y};let J=Q.connection_headers,G=await FD()(Q.connection_url,{method:"POST",signal:AbortSignal.timeout(1e4),headers:{"Content-Type":"application/json",...Q.connection_token&&{Authorization:`Bearer ${Q.connection_token}`},...J?.headers,...Z},body:JSON.stringify({jsonrpc:"2.0",method:"ping",id:1})});return{healthy:G.ok||G.status===404,latencyMs:Date.now()-Y}}catch{return{healthy:!1,latencyMs:Date.now()-Y}}}async serializeConnection($,Z=$.connection_type){let Q={},Y=Z==="VIRTUAL"?KU($.metadata):$.metadata;for(let[X,J]of Object.entries($)){if(J===void 0)continue;if(X==="tools")continue;if(X==="connection_token"&&J)Q[X]=await this.vault.encrypt(J);else if(X==="configuration_state"&&J){let G=JSON.stringify(J);Q[X]=await this.vault.encrypt(G)}else if(X==="oauth_config"&&J)Q[X]=await this.vault.encrypt(JSON.stringify(J));else if(X==="connection_headers"&&J){let G=J;if(UU(G)&&G.envVars){let W={};for(let[K,H]of Object.entries(G.envVars))W[K]=await this.vault.encrypt(H);Q[X]=JSON.stringify({...G,envVars:W})}else Q[X]=JSON.stringify(G)}else if(c84.includes(X))Q[X]=J?JSON.stringify(X==="metadata"?Y:J):null;else Q[X]=J}if(Z==="VIRTUAL"&&$.metadata!==void 0){let X=MH(Y)?.repository;Q.repository_id=X?.repositoryId??null}return Q}async handleDecryptFailures($,Z){let Q=`connection ${$.id} (org: ${$.organization_id}, type: ${$.connection_type}, title: ${$.title})`;if(Qe1($.id))return;if($.status!=="active"){Qo0($.id);return}let{thresholdCrossed:Y}=Ze1($.id);if(!Y){for(let{label:X,error:J}of Z)console.error(`Failed to decrypt ${X} for ${Q}:`,J);return}try{await this.db.updateTable("connections").set({status:"error"}).where("id","=",$.id).execute(),Qo0($.id),console.error(`Disabled ${Q} after ${_l} consecutive decryption failures.`,Z[0]?.error)}catch(X){console.error(`Failed to disable ${Q} after decryption failures:`,X)}}async deserializeConnection($){let Z=[],Q=null;if($.connection_token)try{Q=await this.vault.decrypt($.connection_token)}catch(K){Z.push({label:"connection token",error:K})}let Y=null;if($.configuration_state)try{let K=await this.vault.decrypt($.configuration_state);Y=JSON.parse(K)}catch(K){Z.push({label:"configuration state",error:K})}let X=null;if(typeof $.oauth_config==="string")try{X=JSON.parse(await this.vault.decrypt($.oauth_config))}catch{try{X=JSON.parse($.oauth_config)}catch(K){Z.push({label:"oauth config",error:K})}}else X=$.oauth_config;let J=null,G=!1;if($.connection_headers)try{let K=JSON.parse($.connection_headers);if(UU(K)&&K.envVars){G=!0;let H={};for(let[F,U]of Object.entries(K.envVars))try{H[F]=await this.vault.decrypt(U)}catch(N){H[F]="",Z.push({label:`env var "${F}"`,error:N})}J={...K,envVars:H}}else J=K}catch(K){console.error(`Failed to parse connection_headers for connection ${$.id} (org: ${$.organization_id}, type: ${$.connection_type}, title: ${$.title}):`,K)}if(Z.length>0)await this.handleDecryptFailures($,Z);else if($.connection_token||$.configuration_state||$.oauth_config||G)Ye1($.id);let W=(K)=>{if(K===null)return null;if(typeof K==="string")try{return JSON.parse(K)}catch{return null}return K};return{id:$.id,organization_id:$.organization_id,created_by:$.created_by,updated_by:$.updated_by??void 0,title:$.title,description:$.description,icon:$.icon,app_name:$.app_name,app_id:$.app_id,slug:$.slug,url_slug:$.url_slug,connection_type:$.connection_type,connection_url:$.connection_url,connection_token:Q,connection_headers:J,oauth_config:X,configuration_state:Y,configuration_scopes:W($.configuration_scopes),metadata:$.connection_type==="VIRTUAL"?MH(W($.metadata)):W($.metadata),tools:null,bindings:W($.bindings),status:$.status,created_at:$.created_at,updated_at:$.updated_at}}}var c84,m84,Ne1;var Bo0=L(()=>{as();BU();Ml();oQ();R8();iJ0();zw();Xe1();Br();No0();c84=["connection_headers","configuration_scopes","metadata","bindings"],m84=new Set(["id","organization_id","created_by","updated_by","title","description","icon","app_name","app_id","slug","url_slug","connection_type","connection_url","status","created_at","updated_at"]),Ne1=new Set(["metadata","configuration_scopes","bindings"])});import{createHash as d84,randomBytes as i84,timingSafeEqual as tk5}from"crypto";function n84($){return $.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function Lo0($){return d84("sha256").update($).digest("hex")}function we1($){let Z=Do0.length+1,Q=Z+Oe1;if(!$.startsWith(`${Do0}_`)||$.length<=Q+1||$[Q]!=="_")return null;let Y=$.slice(Z,Q),X=$.slice(Q+1);if(!Le1.test(Y)||!Le1.test(X))return null;return Y}function je1(){let $=n84(i84(p84)),Z=$.slice(0,Oe1),Q=`${Do0}_${Z}_${$}`;return{plaintext:Q,prefix:Z,hash:Lo0(Q)}}var Do0="stv",p84=32,Oe1=12,Le1;var Ee1=L(()=>{Le1=/^[A-Za-z0-9_-]+$/});function Pe1($){return{id:$.id,organizationId:$.organization_id,subjectConnectionId:$.subject_connection_id,tokenHash:$.token_hash,tokenPrefix:$.token_prefix,name:$.name,revokedAt:$.revoked_at,lastUsedAt:$.last_used_at,createdAt:$.created_at,updatedAt:$.updated_at}}class Oo0{db;constructor($){this.db=$}async createOrRotateWorkloadToken($){let Z=$.name??"default";return await this.db.transaction().execute(async(Y)=>{if(!await Y.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Subject connection not found in organization");let J=je1(),G=new Date().toISOString();await Y.updateTable("connection_workload_tokens").set({revoked_at:G,updated_at:G}).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",Z).where("revoked_at","is",null).execute();let W=await Y.insertInto("connection_workload_tokens").values({id:l8("cwt"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,token_hash:J.hash,token_prefix:J.prefix,name:Z,revoked_at:null,last_used_at:null,created_at:G,updated_at:G}).returningAll().executeTakeFirstOrThrow();return{plaintextToken:J.plaintext,record:Pe1(W)}})}async findActiveWorkloadToken($){let Z=await this.db.selectFrom("connection_workload_tokens").selectAll().where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("name","=",$.name??"default").where("revoked_at","is",null).executeTakeFirst();return Z?Pe1(Z):null}async revokeWorkloadToken($){let Z=new Date().toISOString();await this.db.updateTable("connection_workload_tokens").set({revoked_at:Z,updated_at:Z}).where("id","=",$.tokenId).where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("revoked_at","is",null).execute()}async authenticateWorkloadToken($){let Z=we1($);if(!Z)return null;let Q=Lo0($),Y=await this.db.selectFrom("connection_workload_tokens").select(["id","organization_id","subject_connection_id","token_prefix"]).where("token_prefix","=",Z).where("token_hash","=",Q).where("revoked_at","is",null).executeTakeFirst();if(!Y)return null;let X=new Date().toISOString();return await this.db.updateTable("connection_workload_tokens").set({last_used_at:X,updated_at:X}).where("id","=",Y.id).execute(),{tokenId:Y.id,tokenPrefix:Y.token_prefix,organizationId:Y.organization_id,subjectConnectionId:Y.subject_connection_id}}async replaceGrantsForSubject($){await this.db.transaction().execute(async(Z)=>{if(!await Z.selectFrom("connections").select("id").where("id","=",$.subjectConnectionId).where("organization_id","=",$.organizationId).executeTakeFirst())throw Error("Referenced connection not found in organization");let Y=[...new Set($.grants.map((G)=>G.targetConnectionId))];if(Y.length>0){if((await Z.selectFrom("connections").select("id").where("organization_id","=",$.organizationId).where("id","in",Y).execute()).length!==Y.length)throw Error("Referenced connection not found in organization")}if(await Z.deleteFrom("connection_credential_grants").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).execute(),$.grants.length===0)return;let X=new Date().toISOString(),J=$.grants.map((G)=>({id:l8("ccg"),organization_id:$.organizationId,subject_connection_id:$.subjectConnectionId,target_connection_id:G.targetConnectionId,scope:G.scope,created_by:$.createdBy,created_at:X,updated_at:X}));await Z.insertInto("connection_credential_grants").values(J).execute()})}async hasGrant($){return!!await this.db.selectFrom("connection_credential_grants").select("id").where("organization_id","=",$.organizationId).where("subject_connection_id","=",$.subjectConnectionId).where("target_connection_id","=",$.targetConnectionId).where("scope","=",$.scope).executeTakeFirst()}}var aJ0="credential:access-token:read",eJ0="credential:configuration:read";var $G0=L(()=>{oQ();Ee1()});function ze1($,Z){let Q=!1,Y={...$},X=$.pinnedViews;if(Array.isArray(X)){let W=X.filter((K)=>K.connectionId!==Z);if(W.length!==X.length)Q=!0,Y.pinnedViews=W.length>0?W:null}let J=$.homeTile;if(J&&J.connectionId===Z)Q=!0,Y.homeTile=null;let G=$.homeTiles;if(Array.isArray(G)){let W=G.filter((K)=>K.connectionId!==Z);if(W.length!==G.length)Q=!0,Y.homeTiles=W.length>0?W:null}return{ui:Y,changed:Q}}function G9($){return wo0.test($)}function l2($){let Z=(Q)=>typeof Q==="string"?Q.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}function Ae1($){let Z=typeof $?.metadata?.analyticsSiteSlug==="string"?$.metadata.analyticsSiteSlug.trim().toLowerCase():"";if(Z&&G9(Z))return Z;return l2($)}var wo0;var pX=L(()=>{wo0=/^[a-z0-9][a-z0-9-]{0,59}$/});import{sql as t84}from"kysely";function jo0($){return $ instanceof Date?$.toISOString():String($)}function c2($){return{slug:$.slug,organizationId:$.organization_id,source:$.source,projectId:$.project_id,linkedAt:$.linked_at?jo0($.linked_at):null,createdBy:$.created_by,createdAt:jo0($.created_at),updatedBy:$.updated_by,updatedAt:jo0($.updated_at)}}class DD{db;constructor($){this.db=$}async claimSite($){if(!G9($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"deco-import",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((J)=>J.column("slug").doNothing()).returningAll().executeTakeFirst();if(Q)return c2(Q);let Y=await this.getBySlug($.slug);if(!Y)throw new Lr($.slug,"unknown");if(Y.organizationId===null)throw new zZ("reserved",$.slug);if(Y.organizationId!==$.organizationId)throw new Lr($.slug,Y.organizationId);let X=await this.db.updateTable("org_sites").set({source:$.source??Y.source,updated_by:$.by,updated_at:Z}).where("slug","=",$.slug).where("organization_id","=",$.organizationId).returningAll().executeTakeFirstOrThrow();return c2(X)}async reassignSite($){if(!G9($.slug))throw Error(`Invalid site slug "${$.slug}" \u2014 must be 1-60 chars of lowercase letters, digits, or hyphens, starting with a letter or digit`);let Z=new Date,Q=await this.db.insertInto("org_sites").values({slug:$.slug,organization_id:$.organizationId,source:$.source??"manual",created_by:$.by,created_at:Z,updated_by:$.by,updated_at:Z}).onConflict((X)=>X.column("slug").doUpdateSet({organization_id:$.organizationId,source:$.source??"manual",updated_by:$.by,updated_at:Z}).where("org_sites.organization_id","is not",null).where("org_sites.linked_at","is",null)).returningAll().executeTakeFirst();if(Q)return c2(Q);if((await this.getBySlug($.slug))?.organizationId===null)throw new zZ("reserved",$.slug);throw new zZ("in_use",$.slug)}async releaseSite($,Z){let Q=await this.db.deleteFrom("org_sites").where("slug","=",$).where("organization_id","=",Z).where("linked_at","is",null).executeTakeFirst();if(Number(Q.numDeletedRows??0n)>0)return!0;if(await this.isOwnedBy($,Z))throw new zZ("in_use",$);return!1}async getByProject($){let Z=await this.db.selectFrom("org_sites").selectAll().where("project_id","=",$).executeTakeFirst();return Z?c2(Z):null}async link($){let{slug:Z,organizationId:Q,projectId:Y,by:X}=$,J=await this.getBySlug(Z);if(!J)throw new zZ("not_found",Z);if(J.organizationId===null)throw new zZ("reserved",Z);if(J.organizationId!==Q)throw new zZ("not_owned",Z);if(J.projectId===Y)return J;if(J.projectId!==null)throw new zZ("linked_elsewhere",Z);if(!await this.db.selectFrom("connections").select("id").where("id","=",Y).where("organization_id","=",Q).where("connection_type","=","VIRTUAL").executeTakeFirst())throw new zZ("project_not_found",Z);let W=await this.getByProject(Y);if(W&&W.slug!==Z)throw new zZ("project_has_other_slug",Z);let K=new Date,H;try{H=await this.db.updateTable("org_sites").set({project_id:Y,linked_at:t84`coalesce(linked_at, now())`,updated_by:X,updated_at:K}).where("slug","=",Z).where("organization_id","=",Q).where("project_id","is",null).returningAll().executeTakeFirst()}catch(U){if(U.code==="23505")throw new zZ("project_has_other_slug",Z);throw U}if(H)return c2(H);let F=await this.getBySlug(Z);if(F?.projectId===Y)return F;if(!F)throw new zZ("not_found",Z);if(F.organizationId===null)throw new zZ("reserved",Z);if(F.organizationId!==Q)throw new zZ("not_owned",Z);throw new zZ("linked_elsewhere",Z)}async getBySlug($){let Z=await this.db.selectFrom("org_sites").selectAll().where("slug","=",$).executeTakeFirst();return Z?c2(Z):null}async listByOrg($){return(await this.db.selectFrom("org_sites").selectAll().where("organization_id","=",$).orderBy("slug","asc").execute()).map((Q)=>c2(Q))}async isOwnedBy($,Z){return!!await this.db.selectFrom("org_sites").select("slug").where("slug","=",$).where("organization_id","=",Z).executeTakeFirst()}}var Eo0="The site id can't change: CDN paths, tokens and asset URLs use it.",m2,o84,zZ,Lr;var xl=L(()=>{pX();m2=class m2 extends Error{code="SITE_SLUG_IMMUTABLE";constructor(){super(Eo0);this.name="SiteSlugImmutableError"}};o84={not_found:"This site id isn't registered for the organization.",reserved:"This site id belonged to a deleted organization and stays reserved.",not_owned:"This site id belongs to another organization.",linked_elsewhere:"This site id is already the site of another project.",project_has_other_slug:`This project already has a site id. ${Eo0}`,project_not_found:"Project not found in this organization.",in_use:`This site id has been used by a project, so it can't be released or moved. ${Eo0}`};zZ=class zZ extends Error{code;slug;constructor($,Z){super(o84[$]);this.code=$;this.slug=Z;this.name="OrgSiteLinkError"}};Lr=class Lr extends Error{slug;ownerOrganizationId;constructor($,Z){super(`Site slug "${$}" is already owned by another organization`);this.slug=$;this.ownerOrganizationId=Z;this.name="OrgSiteConflictError"}}});import{sql as Or}from"kysely";function s84($){return $.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function Po0($){let Z=$?.repository?.repositoryId;return typeof Z==="string"&&Z.length>0?Z:null}function r84($,Z){let Q=$?.siteSlug;if(typeof Q==="string"&&Q.trim()&&Q.trim().toLowerCase()!==Z)throw new m2;return{...$,siteSlug:Z}}class OU{db;constructor($){this.db=$}async create($,Z,Q,Y){let X=Y?.id??l8("vir"),J=new Date().toISOString(),G=rs(Q.title,"project");await sJ0(this.db,$,G,(K)=>this.db.transaction().execute(async(H)=>{if(await H.insertInto("connections").values({id:X,organization_id:$,url_slug:K,created_by:Z,updated_by:Z,title:Q.title,description:Q.description??null,icon:Q.icon??null,app_name:null,app_id:null,connection_type:"VIRTUAL",pinned:Q.pinned??!1,connection_url:`virtual://${X}`,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:Q.metadata?JSON.stringify(KU(Q.metadata)):null,repository_id:Po0(Q.metadata),bindings:null,status:Q.status??"active",created_at:J,updated_at:J}).execute(),Q.connections.length>0)await H.insertInto("connection_aggregations").values(Q.connections.map((F)=>({id:l8("agg"),parent_connection_id:X,child_connection_id:F.connection_id,selected_tools:F.selected_tools?JSON.stringify(F.selected_tools):null,selected_resources:F.selected_resources?JSON.stringify(F.selected_resources):null,selected_prompts:F.selected_prompts?JSON.stringify(F.selected_prompts):null,dependency_mode:"direct",created_at:J}))).execute()}));let W=await this.findById(X);if(!W)throw Error(`Failed to create virtual MCP with id: ${X}`);return W}async findById($,Z){let Q=HQ($);if(Q)return{...st0(Z??Q),pinned:!1,connections:[]};return this.findByIdInternal(this.db,$)}async findByIdInternal($,Z){let Q=await $.selectFrom("connections").selectAll().where("id","=",Z).where("connection_type","=","VIRTUAL").executeTakeFirst();if(!Q)return null;let Y=await $.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","=",Z).where("dependency_mode","=","direct").execute(),[X]=await this.withLinkedSiteSlugs($,[this.deserializeVirtualMCPEntity(Q,Y)]);return X??null}async withLinkedSiteSlugs($,Z){let Q=Z.flatMap((J)=>J.id?[J.id]:[]);if(Q.length===0)return Z;let Y=await $.selectFrom("org_sites").select(["slug","project_id"]).where("project_id","in",Q).execute();if(Y.length===0)return Z;let X=new Map(Y.map((J)=>[J.project_id,J.slug]));return Z.map((J)=>{let G=J.id?X.get(J.id):void 0;return G?{...J,metadata:{...J.metadata,siteSlug:G}}:J})}async currentSiteSlug($,Z){let Q=await $.selectFrom("org_sites").select("slug").where("project_id","=",Z).executeTakeFirst();if(Q)return Q.slug;let Y=await $.selectFrom("connections").select("metadata").where("id","=",Z).where("connection_type","=","VIRTUAL").executeTakeFirst(),X=this.parseJson(Y?.metadata??null)?.siteSlug;return typeof X==="string"&&X.trim()?X.trim().toLowerCase():null}async searchAcrossMemberships($){let{userId:Z,term:Q,limit:Y,offset:X=0,organizationId:J}=$,G=`%${s84(Q)}%`,W=this.db.selectFrom("connections").innerJoin("member",(H)=>H.onRef("member.organizationId","=","connections.organization_id").on("member.userId","=",Z)).innerJoin("organization","organization.id","connections.organization_id").where("connections.connection_type","=","VIRTUAL").where((H)=>H.or([H("connections.title","ilike",G),H("connections.description","ilike",G)]));if(J)W=W.where("connections.organization_id","=",J);return(await W.select(["connections.id as id","connections.title as title","connections.icon as icon","connections.metadata as metadata","connections.organization_id as organization_id","organization.name as organization_name","organization.slug as organization_slug","organization.metadata as organization_metadata"]).orderBy("connections.updated_at","desc").orderBy("connections.id","asc").limit(Y).offset(X).execute()).map((H)=>({id:H.id,title:H.title,icon:H.icon,metadata:MH(this.parseJson(H.metadata)),organization_id:H.organization_id,organization_name:H.organization_name,organization_slug:H.organization_slug,organization_metadata:H.organization_metadata}))}async list($,Z){let Q=this.db.selectFrom("connections").selectAll().where("organization_id","=",$).where("connection_type","=","VIRTUAL");if(Z?.pinnedOnly)Q=Q.where("pinned","=",!0);let Y=await Q.orderBy("created_at","asc").orderBy("id","asc").execute(),X=Y.map((W)=>W.id);if(X.length===0)return[];let J=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",X).where("dependency_mode","=","direct").execute(),G=new Map;for(let W of J){let K=G.get(W.parent_connection_id)??[];K.push(W),G.set(W.parent_connection_id,K)}return this.withLinkedSiteSlugs(this.db,Y.map((W)=>this.deserializeVirtualMCPEntity(W,G.get(W.id)??[])))}async listByIds($,Z){if(Z.length===0)return[];let Q=await this.db.selectFrom("connections").selectAll().where("id","in",Z).where("organization_id","=",$).where("connection_type","=","VIRTUAL").execute();if(Q.length===0)return[];let Y=Q.map((G)=>G.id),X=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",Y).where("dependency_mode","=","direct").execute(),J=new Map;for(let G of X){let W=J.get(G.parent_connection_id)??[];W.push(G),J.set(G.parent_connection_id,W)}return this.withLinkedSiteSlugs(this.db,Q.map((G)=>this.deserializeVirtualMCPEntity(G,J.get(G.id)??[])))}async listByConnectionId($,Z){let Y=(await this.db.selectFrom("connection_aggregations").select("parent_connection_id").where("child_connection_id","=",Z).execute()).map((K)=>K.parent_connection_id);if(Y.length===0)return[];let X=await this.db.selectFrom("connections").selectAll().where("id","in",Y).where("organization_id","=",$).where("connection_type","=","VIRTUAL").execute();if(X.length===0)return[];let J=X.map((K)=>K.id),G=await this.db.selectFrom("connection_aggregations").selectAll().where("parent_connection_id","in",J).where("dependency_mode","=","direct").execute(),W=new Map;for(let K of G){let H=W.get(K.parent_connection_id)??[];H.push(K),W.set(K.parent_connection_id,H)}return this.withLinkedSiteSlugs(this.db,X.map((K)=>this.deserializeVirtualMCPEntity(K,W.get(K.id)??[])))}async update($,Z,Q){let Y=new Date().toISOString(),X={updated_at:Y,updated_by:Z};if(Q.title!==void 0)X.title=Q.title;if(Q.description!==void 0)X.description=Q.description;if(Q.icon!==void 0)X.icon=Q.icon;if(Q.status!==void 0)X.status=Q.status;if(Q.pinned!==void 0)X.pinned=Q.pinned;if(Q.metadata!==void 0){let W=await this.currentSiteSlug(this.db,$),K=W?r84(Q.metadata,W):Q.metadata;X.repository_id=Po0(K),X.metadata=K?JSON.stringify(KU(K)):null}if(Q.url_slug)await rJ0(this.db,$,Q.url_slug);let J=[];await this.db.transaction().execute(async(W)=>{if(await W.updateTable("connections").set(X).where("id","=",$).where("connection_type","=","VIRTUAL").execute(),Q.connections!==void 0){let K=await W.selectFrom("connection_aggregations").select("child_connection_id").where("parent_connection_id","=",$).where("dependency_mode","=","direct").execute(),H=new Set(K.map((U)=>U.child_connection_id));if(await W.deleteFrom("connection_aggregations").where("parent_connection_id","=",$).where("dependency_mode","=","direct").execute(),Q.connections.length>0)await W.insertInto("connection_aggregations").values(Q.connections.map((U)=>({id:l8("agg"),parent_connection_id:$,child_connection_id:U.connection_id,selected_tools:U.selected_tools?JSON.stringify(U.selected_tools):null,selected_resources:U.selected_resources?JSON.stringify(U.selected_resources):null,selected_prompts:U.selected_prompts?JSON.stringify(U.selected_prompts):null,dependency_mode:"direct",created_at:Y}))).execute();let F=new Set(Q.connections.map((U)=>U.connection_id));for(let U of H)if(!F.has(U))J.push(U)}});for(let W of J)await this.cleanOrphanedPinnedViews([$],W);let G=await this.findById($);if(!G)throw Error("Virtual MCP not found after update");return G}async patchMetadata($){if(Object.hasOwn($.set,"siteSlug")||$.unset.includes("siteSlug"))throw new m2;let Z=[...new Set([...$.unset,...Object.keys($.set)].flatMap((X)=>[X,Qa1(X)]))],Q=Or`(coalesce(metadata::jsonb, '{}'::jsonb) - ${Z}::text[]) || ${JSON.stringify(KU($.set))}::jsonb`,Y=await this.db.updateTable("connections").set({metadata:Or`(${Q})::text`,...Object.hasOwn($.set,"repository")||$.unset.includes("repository")?{repository_id:Po0($.set)}:{},updated_at:new Date().toISOString(),updated_by:$.by}).where("id","=",$.id).where("organization_id","=",$.organizationId).where("connection_type","=","VIRTUAL").where((X)=>X.or([X("metadata","is",null),Or`jsonb_typeof(metadata::jsonb) = 'object'`])).executeTakeFirst();return Number(Y.numUpdatedRows)>0}async clearAnalyticsSiteSlugReferences($,Z){let Q=await this.db.updateTable("connections").set({metadata:Or`(metadata::jsonb - 'analyticsSiteSlug')::text`,updated_at:new Date().toISOString()}).where("organization_id","=",$).where("connection_type","=","VIRTUAL").where(Or`metadata::jsonb ->> 'analyticsSiteSlug' = ${Z}`).executeTakeFirst();return Number(Q.numUpdatedRows)}async delete($){await this.db.transaction().execute(async(Z)=>{await Z.deleteFrom("threads").where("virtual_mcp_id","=",$).execute(),await Z.deleteFrom("connection_aggregations").where("parent_connection_id","=",$).execute(),await Z.deleteFrom("connections").where("id","=",$).where("connection_type","=","VIRTUAL").execute()})}async removeConnectionReferences($){let Z=await this.db.selectFrom("connection_aggregations").select("parent_connection_id").where("child_connection_id","=",$).execute();await this.db.deleteFrom("connection_aggregations").where("child_connection_id","=",$).execute(),await this.cleanOrphanedPinnedViews(Z.map((Q)=>Q.parent_connection_id),$)}async cleanOrphanedPinnedViews($,Z){for(let Q of $){let Y=await this.db.selectFrom("connections").select("metadata").where("id","=",Q).executeTakeFirst();if(!Y?.metadata)continue;let X;try{X=typeof Y.metadata==="string"?JSON.parse(Y.metadata):Y.metadata}catch{continue}let J=X.ui??null;if(!J)continue;let{ui:G,changed:W}=ze1(J,Z);if(!W)continue;let K={...X,ui:G};await this.db.updateTable("connections").set({metadata:JSON.stringify(K)}).where("id","=",Q).execute()}}deserializeVirtualMCPEntity($,Z){let Q=$.created_at instanceof Date?$.created_at.toISOString():$.created_at,Y=$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at,X=$.status==="active"?"active":"inactive",J=this.parseJson($.metadata),{sandboxMap:G,...W}=MH(J)??{},K=G!==void 0?Dt0(G):void 0;return{id:$.id,organization_id:$.organization_id,title:$.title,url_slug:$.url_slug,description:$.description,icon:$.icon,status:X,pinned:$.pinned,created_at:Q,updated_at:Y,created_by:$.created_by,updated_by:$.updated_by??void 0,metadata:{...W,instructions:J?.instructions??null,...K!==void 0?{sandboxMap:K}:{}},connections:Z.map((H)=>({connection_id:H.child_connection_id,selected_tools:this.parseJson(H.selected_tools),selected_resources:this.parseJson(H.selected_resources),selected_prompts:this.parseJson(H.selected_prompts)}))}}parseJson($){if($===null)return null;if(typeof $==="string")try{return JSON.parse($)}catch{return null}return $}}function Te1($){let Z=new Map,Q=(Y,X)=>{let J=Z.get(Y);if(J)return J;let G=X();return Z.set(Y,G),G};return new Proxy($,{get(Y,X,J){if(X==="list")return(G,W)=>Q(`list:${G}:${W?.pinnedOnly?1:0}`,()=>Y.list(G,W));if(X==="create"||X==="update"||X==="delete"||X==="removeConnectionReferences"||X==="patchMetadata"||X==="clearAnalyticsSiteSlugReferences")return(...G)=>{return Z.clear(),Y[X](...G)};return Reflect.get(Y,X,J)}})}var ZG0=L(()=>{zw();No0();as();oQ();R8();xl()});function d2($){let Z=String($??"");if(Z&&!Z.includes("T"))return Z.replace(" ","T")+"Z";return Z}function e$($){return $.replace(/\0/g,"").replace(/\\/g,"\\\\").replace(/'/g,"''")}function I4($){let Z=Number($??0);return Number.isFinite(Z)?Z:0}function e84($){if(!a84.has($))throw Error(`Invalid groupByColumn: ${$}`);return $}function zo0($){if(!$44.test($))throw Error(`Invalid JSONPath: ${$}`);if($.startsWith("$."))return $;if($.startsWith("."))return`$${$}`;return`$.${$}`}function qo0($){return $.replace(/^\$\./,"").split(".").map((Q)=>`'${e$(Q)}'`).join(", ")}function Y44($){let Z=Z44.exec($);if(!Z||!Z[1]||!Z[2])throw Error(`Invalid interval: ${$}`);let Q=parseInt(Z[1],10),Y=Z[2],X=Q44[Y];if(Q<1||Q>X)throw Error(`Invalid interval amount: ${Q}${Y} (max ${X}${Y})`);return{amount:Q,unit:Y}}function xw($,Z,Q="timestamp"){let{amount:Y,unit:X}=Y44($),G={m:"MINUTE",h:"HOUR",d:"DAY"}[X];if(Z==="duckdb")return`time_bucket(INTERVAL '${Y} ${G}', CAST(${Q} AS TIMESTAMP))`;return`toStartOfInterval(${Q}, INTERVAL ${Y} ${G})`}function wr($,Z,Q){if(Q==="duckdb")return`json_extract_string(${$}, '${Z}')`;let Y=qo0(Z);return`JSONExtractString(${$}, ${Y})`}function X44($,Z,Q){if(Q==="duckdb")return`CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let Y=qo0(Z);return`JSONExtractFloat(${$}, ${Y})`}function Re1($,Z,Q){if(Q==="duckdb")return`TRY_CAST(json_extract_string(${$}, '${Z}') AS DOUBLE)`;let Y=qo0(Z);return`toFloat64OrZero(JSONExtractString(${$}, ${Y}))`}function Ao0($){if($===null||$===void 0)return{};if(typeof $==="object")return $;let Z=String($);try{return JSON.parse(Z)}catch{return{_decocms_truncated:Z}}}function To0($){return{id:String($.id??""),organizationId:String($.organization_id??""),connectionId:String($.connection_id??""),toolName:String($.tool_name??""),input:Ao0($.input),output:Ao0($.output),isError:$.is_error===1||$.is_error===!0||$.is_error==="1"||typeof $.is_error==="bigint"&&$.is_error===1n,errorMessage:$.error_message!=null?String($.error_message):null,durationMs:Number($.duration_ms??0),timestamp:(()=>{if($.timestamp instanceof Date)return $.timestamp.toISOString();let Z=String($.timestamp??""),Q=new Date(Z.includes("T")?Z:Z.replace(" ","T")+"Z");return Number.isNaN(Q.getTime())?Z:Q.toISOString()})(),userId:$.user_id!=null?String($.user_id):null,requestId:String($.request_id??""),userAgent:$.user_agent!=null?String($.user_agent):null,virtualMcpId:$.virtual_mcp_id!=null?String($.virtual_mcp_id):null,properties:$.properties?Ao0($.properties):null}}function Ve1($,Z){let Q=[];if($.properties)for(let[Y,X]of Object.entries($.properties)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${J}') = '${G}'`);else Q.push(`JSONExtractString(properties, '${J}') = '${G}'`)}if($.propertyKeys)for(let Y of $.propertyKeys){let X=e$(Y);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${X}') IS NOT NULL AND json_extract_string(properties, '$.${X}') != ''`);else Q.push(`JSONExtractString(properties, '${X}') IS NOT NULL AND JSONExtractString(properties, '${X}') != ''`)}if($.propertyPatterns)for(let[Y,X]of Object.entries($.propertyPatterns)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`json_extract_string(properties, '$.${J}') ILIKE '${G}'`);else Q.push(`JSONExtractString(properties, '${J}') ILIKE '${G}'`)}if($.propertyInValues)for(let[Y,X]of Object.entries($.propertyInValues)){let J=e$(Y),G=e$(X);if(Z==="duckdb")Q.push(`list_contains(string_split(json_extract_string(properties, '$.${J}'), ','), '${G}')`);else Q.push(`has(splitByChar(',', JSONExtractString(properties, '${J}')), '${G}')`)}return Q}function Me1($,Z){let Q=[];if(uW(Q,Z?.startDate,$),!Z)return Q;if(Z.connectionIds?.length){let Y=Z.connectionIds.map((X)=>`'${e$(X)}'`).join(",");Q.push(`connection_id IN (${Y})`)}if(Z.toolNames?.length){let Y=Z.toolNames.map((X)=>`'${e$(X)}'`).join(",");Q.push(`tool_name IN (${Y})`)}if(Z.virtualMcpIds?.length){let Y=Z.virtualMcpIds.map((X)=>`'${e$(X)}'`).join(",");Q.push(`virtual_mcp_id IN (${Y})`)}if(Z.endDate)Q.push(hW(Z.endDate,$));if(Z.propertyFilters)Q.push(...Ve1(Z.propertyFilters,$));return Q}function Ie1($,Z,Q="timestamp"){if(Z==="duckdb")return`CAST(${Q} AS TIMESTAMP) >= TIMESTAMP '${$.toISOString()}'`;if(Q==="bucket")return`${Q} >= parseDateTimeBestEffort('${$.toISOString()}')`;return`${Q} >= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function hW($,Z,Q="timestamp"){if(Z==="duckdb")return`CAST(${Q} AS TIMESTAMP) <= TIMESTAMP '${$.toISOString()}'`;if(Q==="bucket")return`${Q} <= parseDateTimeBestEffort('${$.toISOString()}')`;return`${Q} <= parseDateTime64BestEffort('${$.toISOString()}', 9)`}function uW($,Z,Q,Y="timestamp"){if(Z)$.push(Ie1(Z,Q,Y));else if(Q==="clickhouse")$.push(Ie1(new Date(Date.now()-J44),Q,Y))}class Mo0{engine;sourceFactory;metricEngine;metricSourceFactory;dialect;metricsFromLogs;constructor($,Z,Q,Y,X="clickhouse",J=!1){this.engine=$;this.sourceFactory=Z;this.metricEngine=Q;this.metricSourceFactory=Y;this.dialect=X;this.metricsFromLogs=J}async query($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`];if($.connectionId)Q.push(`connection_id = '${e$($.connectionId)}'`);if($.excludeConnectionIds?.length){let N=$.excludeConnectionIds.map((B)=>`'${e$(B)}'`).join(",");Q.push(`connection_id NOT IN (${N})`)}if($.virtualMcpId)Q.push(`virtual_mcp_id = '${e$($.virtualMcpId)}'`);if($.toolName)Q.push(`tool_name = '${e$($.toolName)}'`);if($.isError!==void 0)Q.push(`is_error = ${$.isError?1:0}`);if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));if($.propertyFilters)Q.push(...Ve1($.propertyFilters,this.dialect));let Y=1000,X=Math.min(Math.max(1,Math.floor($.limit??50)),Y),J=Math.max(0,Math.floor($.offset??0)),G=Q.join(" AND ");if(this.dialect==="duckdb"){let N=`SELECT ${qe1}, count(*) OVER () AS _total FROM ${Z} WHERE ${G} ORDER BY timestamp DESC LIMIT ${X} OFFSET ${J}`,B=await this.engine.query(N);if(B.length===0)return{logs:[],total:0};let D=Number(B[0]._total??0);return{logs:B.map(To0),total:D}}let W=`SELECT count(*) AS total FROM ${Z} WHERE ${G}`,K=`SELECT ${qe1} FROM ${Z} WHERE ${G} ORDER BY timestamp DESC LIMIT ${X} OFFSET ${J}`,[H,F]=await Promise.all([this.engine.query(W),this.engine.query(K)]),U=Number(H[0]?.total??0);return{logs:F.map(To0),total:U}}async getById($,Z){if(!$||!Z)return null;let Y=`SELECT * FROM ${this.sourceFactory($)} WHERE organization_id = '${e$($)}' AND id = '${e$(Z)}' LIMIT 1`,X=await this.engine.query(Y);if(X.length===0)return null;return To0(X[0])}async getStats($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`];if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));let Y=`SELECT count(*) AS total_calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1.0 ELSE 0.0 END) / NULLIF(count(*), 0), 0) AS error_rate, coalesce(avg(duration_ms), 0) AS avg_duration_ms FROM ${Z} WHERE ${Q.join(" AND ")}`,J=(await this.engine.query(Y))[0]??{};return{totalCalls:Number(J.total_calls??0),errorRate:Number(J.error_rate??0),avgDurationMs:Number(J.avg_duration_ms??0)}}async queryToolCallHeatmap($){if(!$.organizationId)throw Error("organizationId is required");let Z=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),Q=[`organization_id = '${e$($.organizationId)}'`,"type = 'tool_call'"];if($.filters?.virtualMcpIds?.length){let G=$.filters.virtualMcpIds.map((W)=>`'${e$(W)}'`).join(",");Q.push(`virtual_mcp_id IN (${G})`)}if($.filters?.excludeConnectionIds?.length){let G=$.filters.excludeConnectionIds.map((W)=>`'${e$(W)}'`).join(",");Q.push(`connection_id NOT IN (${G})`)}if(uW(Q,$.startDate,this.dialect),$.endDate)Q.push(hW($.endDate,this.dialect));let Y=Math.min(Math.max(1,Math.floor($.limit??500)),1000),X=`SELECT virtual_mcp_id, tool_name, count(*) AS calls, coalesce(sum(CASE WHEN is_error = 1 THEN 1 ELSE 0 END), 0) AS errors, coalesce(sum(length(output)), 0) AS output_size FROM ${Z} WHERE ${Q.join(" AND ")} GROUP BY virtual_mcp_id, tool_name ORDER BY calls DESC LIMIT ${Y}`;return{cells:(await this.engine.query(X)).map((G)=>({virtualMcpId:G.virtual_mcp_id?String(G.virtual_mcp_id):null,toolName:String(G.tool_name??""),calls:Number(G.calls??0),errors:Number(G.errors??0),outputSize:Number(G.output_size??0)}))}}async queryLlmUsageStats($){let Z={totalCalls:0,totalErrors:0,avgDurationMs:0,p50DurationMs:0,p95DurationMs:0,totalInputTokens:0,totalOutputTokens:0,totalTokens:0,totalCostUsd:0,topTools:[],timeseries:[]};if(!$.organizationId||!$.connectionId)return Z;let Q=this.dialect,Y=Q==="clickhouse",X=this.sourceFactory($.organizationId,{startDate:$.startDate,endDate:$.endDate}),J=xw($.interval,Q,"timestamp"),G=(j)=>`coalesce(${Re1("properties",`$.${j}`,Q)}, 0)`,W=Y?"count()":"count(*)",K=Y?"countIf(is_error = 1)":"count(*) FILTER (WHERE is_error = 1)",H=(j)=>Y?`quantile(${j})(duration_ms)`:`quantile_cont(duration_ms, ${j})`,F=[`organization_id = '${e$($.organizationId)}'`,`connection_id = '${e$($.connectionId)}'`];if(uW(F,$.startDate,Q),$.endDate)F.push(hW($.endDate,Q));if($.userIds?.length){let j=$.userIds.slice(0,100).map((E)=>`'${e$(E)}'`).join(",");F.push(`user_id IN (${j})`)}let U=F.join(" AND "),N=Math.min(Math.max(1,Math.floor($.topN??5)),20),B=`${W} AS calls,
   ${K} AS errors,
   avg(duration_ms) AS avg,
   sum(${G("input_tokens")}) AS in_tok,
@@ -4327,7 +4327,7 @@ ${J.join(`
 `)}`:X}function E55($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var xH8=200,W55=12,K55,F55,U55=6,B55=300,Bx0=3;var mE1=L(()=>{O7();UZ0();r$();Nx0();K55={aheadBy:0,behindBy:0,files:[]};F55=/(?:^|\/)\.deco\/blocks\/[^/]+\.json$/i});function z55($){if(!$||$.includes(".."))return!1;return P55.test($)}function gH8($){return A55.includes($)}function dE1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!z55(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function iE1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var P55,A55;var hH8=L(()=>{P55=/^[\w./@-]+$/;A55=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function OZ0($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function lH8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Pz(t7);let J=await qN($.storage,X,Y);if(J&&await BL($.storage,J)){let F=await RN($,J,{forceRefresh:!0}).catch((U)=>{throw new Pz(U instanceof Error?U.message:t7)});await uH8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Pz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Ji({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:t7;throw new Pz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await IN(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=yz$(F instanceof Error?F.message:String(F));throw U?new Pz(N):F});await uH8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function uH8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=kt($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await GP(K,T55).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var T55=10485760,Pz;var pE1=L(()=>{v3();Qx0();t80();YN0();e$0();O7();Pz=class Pz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function q55($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!R55.test(Z))throw Error(`Invalid branch name: ${$}`)}function vh($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(I55)])}async function k55($,Z){let Q=$.var.studioContext,Y=LX(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=uy(G?.metadata?.runtime);if(W)return W;let K=KM0(Z.virtualMcpMetadata),H=K==="cms"?await zE1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)o80(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function S55($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await Y7($.var.studioContext)}catch{return null}}function xt($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function jZ0($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=OZ0(Z,Q);if(!X)throw new y0({provider:"github",status:404,message:"Project has no repository"});let J=Y0(Y);return Qi(Y,J.id,X)}function tE1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=rE$(Z);if(Y!==void 0)return $.json({error:Q},429,{...hZ,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof Z5)return $.json({error:Q},409,hZ);let X=OK(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,hZ)}return $.json({error:Q},502,hZ)}async function nE1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function dH8($){try{let Z=await jZ0($),Q=await lE1(Z,$.get("vmClaim").branch);return $.json(Q,200,hZ)}catch(Z){return tE1($,Z)}}function wZ0($,Z){let Y=(Lx0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return Lx0.set($,X),X.finally(()=>{if(Lx0.get($)===X)Lx0.delete($)}),Y}async function xQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,hZ);let Y=Q?.runner??xt($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...hZ}})}}let D=await B.text(),O=Q?.redactRepoDir?C55(D):D,w=B.headers.get("content-type")??"application/json";return new Response(O,{status:B.status,headers:{"content-type":w,...hZ}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((O,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let D=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${D}`},502)}}function C55($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function iH8($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function _55($){return pH8.includes($)}var R55,M55=524288,cH8=65536,I55=1e4,mH8=2000,V55,Lx0,hZ,pH8,nH8=()=>{let $=new Q1;$.use("/:virtualMcpId/:branch/*",V55),$.post("/:virtualMcpId/:branch/write",(Q)=>xQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>xQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>xQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>xQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>xQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>xQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>xQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:vh(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return xQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return xQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>xQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>xQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!_55(Y))return Q.json({error:`step must be one of: ${pH8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await zE1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await S55(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,hZ);if(Y==="start"){let G=Y0(Q.var.studioContext),W=ui(X.virtualMcpMetadata);try{await XM0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return xQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return EO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return mK8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return dH8(Q);return Z(Q)});let Z=(Q)=>xQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(mH8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return dH8(Q);return xQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(mH8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await jZ0(Q),G=await cE1(J,Y.branch,X.base);return Q.json(G,200,hZ)}catch(X){return tE1(Q,X)}return xQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,hZ);let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return wZ0(X,async()=>{try{await AE1(W,Y,X);let K=OZ0(J,G);if(K)await lH8(W,Y,X,K)}catch(K){if(K instanceof Pz)return Q.json({error:K.message},403,hZ);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,hZ)}return xQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return wZ0(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,hZ);try{let G=await jZ0(Q);return await yH8(G,Y.branch,J),Q.json({ok:!0},200,hZ)}catch(G){let W=OK(G)===409||G instanceof Z5?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,hZ)}});return wZ0(Y.claimName,()=>xQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return wZ0(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await jZ0(Q),H=W.base??await K.getDefaultBranch();return await Dx0(K,Y.branch,H),Q.json({ok:!0},200,hZ)}catch(W){return tE1(Q,W)}});let X=xt(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return wZ0(J,async()=>{try{await AE1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,hZ)}return xQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/judge-review",g5({maxSize:M55,onError:(Q)=>Q.json({error:"Payload too large"},413,hZ)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=xt(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,D]=pK8(F)&&N?[F,U]:X?await Promise.all([iH8(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),iH8(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await jZ0(Q);return Promise.all([lE1(w,Y.branch),cE1(w,Y.branch)])})();await WK(K,Y0(K).id,"judging whether a change needs review");let O=await oK8(K,B,D,typeof H.language==="string"?H.language:void 0);return Q.json(O,200,hZ)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,hZ);return Q.json({error:F},502,hZ)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return nE1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",g5({maxSize:cH8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=dE1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=iE1(J,W.resolveType);return nE1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",g5({maxSize:cH8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):li(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=dE1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!gH8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=iE1(G,K.resolveType);return nE1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var tH8=L(()=>{W8();aK();Vt();PE1();hi();uK8();DX();ci();lK8();RJ();XF();cK8();dK8();yY1();n80();sK8();O7();k5();mE1();hH8();s80();pE1();R55=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;V55=Zx0(async($,Z)=>{let Q=$.var.studioContext;try{p(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=_0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=Y0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{q55(G)}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=V80({orgId:X.id,virtualMcpId:J,branch:G}),H=await mY1(Q,G),F=dY1(H,Y),U=hK8({userId:F,projectRef:K}),N=W.metadata??null,B=await k55($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z();let D;try{D=await Y7(Q)}catch{D=null}if(!D)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:D,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z()});Lx0=new Map;hZ={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};pH8=["clone","install","start"]});function oH8($,Z,Q){let Y=oE1.get($);if(!Y)Y={pending:null,running:!1},oE1.set($,Y);if(!Y.pending)Y.pending={patches:[],deps:Z};let X=Y.pending;X.deps=Z;let J=new Promise((G,W)=>{X.patches.push({patch:Q,resolve:G,reject:W})});if(!Y.running)b55($,Y);return J}async function b55($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let{sha:Y,accepted:X,conflicts:J}=await y55(Q);for(let G of X)G.resolve(Y);for(let{queued:G,blocks:W}of J)G.reject(new Ox0(W))}catch(Y){for(let X of Q.patches)X.reject(Y)}}}finally{if(Z.running=!1,!Z.pending)oE1.delete($)}}async function x55($,Z,Q,Y){let X=new Map,J=[];for(let W of Q){let K=Ux0(Z,W)[0],H=K?Z.find((F)=>F.path===K):void 0;if(!H)X.set(W,null);else J.push({key:W,stem:H.stem,sha:H.sha})}let G=await hE1($,J,Y);for(let[W,{content:K}]of G.entries()){let H=J[W].key;try{X.set(H,await Xx0(JSON.parse(K)))}catch{X.set(H,sH8)}}return X}async function f55($,Z){let Q=new Map(Z),Y=[],X=[];for(let J of $){let{patch:G}=J,W=Object.entries(G.expect??{}).filter(([K,H])=>{let F=Q.get(K);return F!==sH8&&F!==H}).map(([K])=>K);if(W.length>0){X.push({queued:J,blocks:W});continue}Y.push(J);for(let[K,H]of Object.entries(G.set??{}))if(Q.has(K))Q.set(K,await Xx0(H));for(let K of G.delete??[])if(Q.has(K))Q.set(K,null)}return{accepted:Y,conflicts:X}}async function y55($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await bt(Z,Q),W=await Z.listDecofileEntries(G,Y),K=gE1(W,Y),H=new Set($.patches.flatMap(({patch:j})=>Object.keys(j.expect??{}))),{accepted:F,conflicts:U}=await f55($.patches,H.size>0?await x55(Z,K,H,X):new Map),N=new Map,B=new Set;for(let{patch:j}of F){for(let[E,P]of Object.entries(j.set??{}))N.set(E,P),B.delete(E);for(let E of j.delete??[])B.add(E),N.delete(E)}let D=[],O=new Map(K.map((j)=>[j.path,{stem:j.stem,sha:j.sha}]));for(let[j,E]of N){let P=Ux0(K,j),T=`${JSON.stringify(E,null,2)}
 `;await _H8(Z.repo,T);let z=P[0]??`${Fx0(Y)}/${IE1(j)}.json`;D.push({path:z,content:T});let A=z.slice(z.lastIndexOf("/")+1,-5);O.set(z,{stem:A,content:T});for(let q of P.slice(1))D.push({path:q,deleted:!0}),O.delete(q)}for(let j of B)for(let E of Ux0(K,j))D.push({path:E,deleted:!0}),O.delete(E);if(D.length===0)return{sha:G,accepted:F,conflicts:U};let w=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((j)=>j.type==="blob"&&j.path===w)){let j=await hE1(Z,O.values(),X),{decofile:E,skipped:P}=KZ0(j);if(P.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:JF(Z.repo),branch:Q,packagePath:Y,blocks:P.map((T)=>T.key)});D.push({path:w,content:E})}try{let{sha:j}=await Z.commitFiles({branch:Q,message:g55(N,B,$.deps.coAuthor),expectedHead:G,changes:D});return{sha:j,accepted:F,conflicts:U}}catch(j){if(!(j instanceof Z5)||J>=v55-1)throw j;await F$(I7(2000,200,J,2,0.5))}}}function g55($,Z,Q){let Y=(G)=>{let W=G.slice(0,3).join(", ");return G.length>3?`${W} (+${G.length-3} more)`:W},X=[];if($.size>0)X.push(`update ${Y([...$.keys()])}`);if(Z.size>0)X.push(`delete ${Y([...Z])}`);let J=`chore(decofile): ${X.join("; ")}`;return WQ1(J,Q)}var v55=3,Ox0,oE1,sH8;var rH8=L(()=>{Rq0();UZ0();t4();r$();O7();Nx0();Ox0=class Ox0 extends Error{blocks;constructor($){super(`Blocks changed since they were loaded: ${$.join(", ")}`);this.blocks=$;this.name="BlockConflictError"}};oE1=new Map;sH8=Symbol("unreadable")});import{createHmac as aH8,randomBytes as h55,timingSafeEqual as u55}from"crypto";function eH8(){if(wx0)return wx0;let $;try{let Z=L0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return wx0=$?Buffer.from($):h55(32),wx0}function sE1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+l55)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=aH8("sha256",eH8()).update(Y).digest("base64url");return`${Y}.${X}`}function $F8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(aH8("sha256",eH8()).update(Y).digest("base64url"));if(X.length!==J.length||!u55(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var l55=21600000,wx0=null;var ZF8=L(()=>{r1()});function jx0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function c55($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=jx0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function QF8($){let Z;try{Z=jx0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=c55(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=jx0(G),K=W&&jx0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as zO}from"zod";function d55($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&m55.test($)}function WF8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function EZ0($){let Z=$.get("decofileScope");return Qi($.var.studioContext,Z.organizationId,Z.repository)}function PZ0($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof Ox0)return $.json({error:Q,code:"block-conflict",blocks:Z.blocks},409);if(Z instanceof Z5)return $.json({error:Q},409);let Y=OK(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function KF8(){let $=new Q1;return $.use("/:virtualMcpId/:branch",GF8),$.use("/:virtualMcpId/:branch/*",GF8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await vH8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(QF8(X.decofile),200,{...J,"content-type":"application/json"});let G=sE1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(WF8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return PZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await EZ0(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return PZ0(Z,X)}}),$.patch("/:virtualMcpId/:branch",p55,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=n55.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=Ch(X.data)}catch(G){if(G instanceof HZ0)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Yx0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(ME1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await EZ0(Z),W=await oH8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:kt(Y)},J),K=sE1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:WF8(Z)})}catch(G){return PZ0(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(OK(W)!==409)throw W;await Dx0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(OK(G)===409)return Z.json({error:"merge-conflict"},409);if(OK(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return PZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(OK(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return PZ0(Z,Y)}}),$}var m55,YF8=500,XF8=1048576,JF8=1024,i55=8388608,p55,n55,GF8;var HF8=L(()=>{s80();UZ0();W8();aK();PE1();Qx0();pE1();O7();rH8();ZF8();mE1();Nx0();XF();m55=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;p55=g5({maxSize:i55,onError:($)=>$.json({error:"Payload too large"},413)}),n55=zO.object({set:zO.record(zO.string(),zO.unknown()).optional(),delete:zO.array(zO.string()).optional(),expect:zO.record(zO.string(),zO.string().regex(/^[0-9a-f]{64}$/).nullable()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=YF8,{message:`Patch cannot touch more than ${YF8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=XF8),{message:`Each block must be at most ${XF8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=JF8),{message:`Each block key must be at most ${JF8} characters`}).refine(($)=>Object.keys($.expect??{}).every((Z)=>(Z in($.set??{}))||($.delete??[]).includes(Z)),{message:"Each expected block must be one the patch sets or deletes"}).refine(($)=>Object.keys($.set??{}).every((Z)=>!($.delete??[]).includes(Z)),{message:"A block cannot be both set and deleted in the same patch"}),GF8=Zx0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!d55(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!$F8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await LG(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!li(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=OZ0(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var FF8=($)=>{let Z=new Q1;if(Z.use("*",Jt),Z.use("*",xJ8),Z.route("/",vJ8($.voiceSessions)),Z.route("/",Fb0()),Z.route("/",KG8()),Z.route("/",PG8()),Z.route("/",YG8()),Z.route("/",RK8()),Z.route("/",MK8()),Z.route("/",OK8()),Z.route("/",AK8()),Z.route("/",jK8()),Z.route("/",ab0()),Z.route("/tools",vK8()),Z.route("/",SK8()),Z.route("/",sW8({kvStorage:$.kvStorage})),Z.route("/",tW8()),Z.route("/fs",WK8({getConnection:$.getNatsConnection})),Z.route("/sandbox",nH8()),Z.route("/decofile",KF8()),Z.route("/",BK8()),Z.route("/",HK8()),Z.route("/deco-sites",Nb0()),Z.route("/hosting",pJ8()),Z.route("/monitor",eJ8()),Z.route("/sso",Xb0()),Z.route("/",eb0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",lJ8()),$.mountDevAssets)Z.route("/dev-assets",Ob0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of UE1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",SQ8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of UE1)Z.route(Q,UK8());return Z.route("/mcp",lk0()),Z.route("/mcp/self",tb0()),Z.route("/mcp",dk0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var UF8=L(()=>{W8();bJ8();fJ8();nv0();cJ8();hw1();nJ8();$G8();wb0();Dz();bw1();HG8();dw1();oW8();rW8();KK8();FK8();t60();qw1();ik0();FE1();NK8();DK8();wK8();EK8();DE1();qK8();IK8();CK8();LE1();bK8();OE1();ck0();tH8();HF8()});import{z as bh}from"zod";class rE1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new DF8.Kvm(Ex0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Ex0.StorageType.Memory,ttl:LF8.nanos(ML),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?BF8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await F$(200);continue}let G=NF8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await F$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,NF8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new I1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?BF8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var Ex0,DF8,LF8,NF8,BF8;var OF8=L(()=>{$G();gN();r$();Ex0=C(UH(),1),DF8=C(VT(),1),LF8=C(cz(),1),NF8=new TextEncoder,BF8=bh.discriminatedUnion("state",[bh.object({state:bh.literal("ready"),agentId:bh.string()}),bh.object({state:bh.literal("creating"),expiresAt:bh.number()})])});import{z as ft}from"zod";function t55($){return{model:$.model,instructions:`${JC$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class aE1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:t55({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:ft.object({session:ft.object({id:ft.string().min(1)}),transport:ft.object({type:ft.literal("webrtc"),sdp:ft.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var wF8=L(()=>{gN()});var jF8;var EF8=L(()=>{jF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function eE1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:YC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:jF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:ML/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var PF8=L(()=>{gN();EF8()});import{z as vJ}from"zod";import{createHash as o55,createHmac as s55}from"crypto";class Px0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=o55("sha256").update(JSON.stringify(eE1($))).digest("hex"),this.conversationKey=s55("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Px0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...eE1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var zF8=L(()=>{PF8()});import{createHmac as r55,timingSafeEqual as a55}from"crypto";import{z as yt}from"zod";function TF8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return r55("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function RF8($,Z){let Q=Buffer.from(JSON.stringify(AF8.parse($))).toString("base64url");return`${Q}.${TF8(Q,Z)}`}function qF8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(TF8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!a55(W,G))return null;try{let K=AF8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+ML)return null;return K.data}catch{return null}}var AF8;var MF8=L(()=>{gN();AF8=yt.object({sessionId:yt.string().uuid(),organizationId:yt.string().min(1).max(256),userId:yt.string().min(1).max(256),threadId:yt.string().min(1).max(256),expiresAt:yt.number().int().positive()})});import{z as $P1}from"zod";function IF8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return ZP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var ZP1;var VF8=L(()=>{ZP1=$P1.object({provider:$P1.enum(["elevenlabs","openai"]),model:$P1.string().trim().min(1).max(128)})});import{createHash as e55}from"crypto";import{z as gt}from"zod";function ht($){return`user.${e55("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class YP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new kF8.Kvm(Ax0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Ax0.StorageType.Memory,ttl:SF8.nanos(ML),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new I1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=IF8(this.deps.defaults,Y)}catch{throw new I1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new I1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+ML},W=RF8(G,this.deps.secret),K=await this.kv(),H=ht(G),F=await K.get(H),U=F?.operation==="PUT"?zx0.parse(F.json()):null,N=QP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new I1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:ht($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=qF8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new I1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=ht(Q),J=await Y.get(X),G=J?.operation==="PUT"?zx0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new I1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new I1(409,{message:"Voice session already connected"});try{await Y.update(X,QP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new I1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=ht(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?zx0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new I1(429,{message:"Voice session speech limit reached"});try{await J.update(G,QP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new I1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(ht($));if(Q?.operation==="PUT"&&zx0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(ht($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Ax0,kF8,SF8,zx0,QP1;var CF8=L(()=>{$G();gN();MF8();VF8();Ax0=C(UH(),1),kF8=C(VT(),1),SF8=C(cz(),1),zx0=gt.object({sessionId:gt.string().uuid(),expiresAt:gt.number(),connected:gt.boolean().optional(),conversation:ZP1.optional(),characters:gt.number().int().nonnegative(),requests:gt.number().int().nonnegative()}),QP1=new TextEncoder});function $95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Z95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},_F8=()=>{let $=new Q1;return $.use("*",Z95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:$95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var vF8=L(()=>{W8();r1();v_0()});import{z as c1}from"zod";function EB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function U95($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function N95($,Z,Q){try{return JSON.parse($)}catch{throw new fF8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function B95($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:N95(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function D95($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nU(Q.function.parameters):nU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function L95($){if(!$)return;return{openai:{response_format:$}}}function O95(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function bF8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function xF8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Q95=256,Y95,X95,J95,G95,W95,K95,H95,F95,fF8,yF8,gF8;var hF8=L(()=>{u4();W8();Vt();VF();Y95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),X95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),J95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(X95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),G95=c1.object({type:c1.literal("text")}),W95=c1.object({type:c1.literal("json_object")}),K95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),H95=c1.union([G95,W95,K95]),F95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(J95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(Y95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:H95.optional(),user:c1.string().optional()});fF8=class fF8 extends Error{constructor($){super($);this.name="MessageConversionError"}};yF8=new Q1;yF8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(EB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(EB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(EB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=F95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(EB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=U95(J.model);if(!G)return $.json(EB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>f2(E.providerId));if(!j)return $.json(EB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(EB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=B95(J.messages),N=J.tools?D95(J.tools):void 0,B=L95(J.response_format),D=O95(),O=Math.floor(Date.now()/1000);if(J.stream)return EO($,async(w)=>{let j=bF8(F,U,N,J,B,$.req.raw.signal);try{let E=Jp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=Q95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:xF8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=bF8(F,U,N,J,B,$.req.raw.signal),j=await SL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:xF8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(EB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(EB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(EB(X.message,"server_error"),500)}});gF8=yF8});function w95($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function uF8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=_0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(l2(U)!==J)continue;if(!w95(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var lF8=L(()=>{W8();pX()});var Tx0;var XP1=L(()=>{Tx0={name:"decocms",version:"4.498.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function P95(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??E95}}var cF8,E95="https://ph.studio.decocms.com",mF8;var dF8=L(()=>{W8();ke();wg();w9();r1();Uw1();XP1();cF8=new Q1;cF8.get("/",($)=>{let Z={version:Tx0.version,theme:TY$(),...cH().logo&&{logo:cH().logo},...uL()&&{internalUrl:dr1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:qX8(),posthog:P95(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:nF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});mF8=cF8});import{z as q$}from"zod";var z95,iF8;var pF8=L(()=>{z95=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),iF8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(z95)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function nF8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Rx0($,Z={}){let Q=await fetch(nF8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return iF8.parse(await Q.json())}async function tF8($,Z={}){let Q=await fetch(nF8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var JP1=L(()=>{pF8();rD()});import{join as oF8}from"path";async function T95($){try{let Z=await Rx0($,{signal:AbortSignal.timeout(A95)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||GL1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function R95($,Z){let Q=Lh($),Y=Z?.brand?.trim()||GL1(Q),X=RZ8(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=qZ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class aE1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:t55({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:ft.object({session:ft.object({id:ft.string().min(1)}),transport:ft.object({type:ft.literal("webrtc"),sdp:ft.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var wF8=L(()=>{gN()});var jF8;var EF8=L(()=>{jF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function eE1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:YC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:jF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:ML/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var PF8=L(()=>{gN();EF8()});import{z as vJ}from"zod";import{createHash as o55,createHmac as s55}from"crypto";class Px0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=o55("sha256").update(JSON.stringify(eE1($))).digest("hex"),this.conversationKey=s55("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Px0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...eE1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var zF8=L(()=>{PF8()});import{createHmac as r55,timingSafeEqual as a55}from"crypto";import{z as yt}from"zod";function TF8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return r55("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function RF8($,Z){let Q=Buffer.from(JSON.stringify(AF8.parse($))).toString("base64url");return`${Q}.${TF8(Q,Z)}`}function qF8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(TF8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!a55(W,G))return null;try{let K=AF8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+ML)return null;return K.data}catch{return null}}var AF8;var MF8=L(()=>{gN();AF8=yt.object({sessionId:yt.string().uuid(),organizationId:yt.string().min(1).max(256),userId:yt.string().min(1).max(256),threadId:yt.string().min(1).max(256),expiresAt:yt.number().int().positive()})});import{z as $P1}from"zod";function IF8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return ZP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var ZP1;var VF8=L(()=>{ZP1=$P1.object({provider:$P1.enum(["elevenlabs","openai"]),model:$P1.string().trim().min(1).max(128)})});import{createHash as e55}from"crypto";import{z as gt}from"zod";function ht($){return`user.${e55("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class YP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new kF8.Kvm(Ax0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Ax0.StorageType.Memory,ttl:SF8.nanos(ML),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new I1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=IF8(this.deps.defaults,Y)}catch{throw new I1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new I1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+ML},W=RF8(G,this.deps.secret),K=await this.kv(),H=ht(G),F=await K.get(H),U=F?.operation==="PUT"?zx0.parse(F.json()):null,N=QP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new I1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:ht($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=qF8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new I1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=ht(Q),J=await Y.get(X),G=J?.operation==="PUT"?zx0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new I1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new I1(409,{message:"Voice session already connected"});try{await Y.update(X,QP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new I1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=ht(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?zx0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new I1(429,{message:"Voice session speech limit reached"});try{await J.update(G,QP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new I1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(ht($));if(Q?.operation==="PUT"&&zx0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(ht($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Ax0,kF8,SF8,zx0,QP1;var CF8=L(()=>{$G();gN();MF8();VF8();Ax0=C(UH(),1),kF8=C(VT(),1),SF8=C(cz(),1),zx0=gt.object({sessionId:gt.string().uuid(),expiresAt:gt.number(),connected:gt.boolean().optional(),conversation:ZP1.optional(),characters:gt.number().int().nonnegative(),requests:gt.number().int().nonnegative()}),QP1=new TextEncoder});function $95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Z95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},_F8=()=>{let $=new Q1;return $.use("*",Z95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:$95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var vF8=L(()=>{W8();r1();v_0()});import{z as c1}from"zod";function EB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function U95($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function N95($,Z,Q){try{return JSON.parse($)}catch{throw new fF8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function B95($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:N95(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function D95($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nU(Q.function.parameters):nU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function L95($){if(!$)return;return{openai:{response_format:$}}}function O95(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function bF8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function xF8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Q95=256,Y95,X95,J95,G95,W95,K95,H95,F95,fF8,yF8,gF8;var hF8=L(()=>{u4();W8();Vt();VF();Y95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),X95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),J95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(X95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),G95=c1.object({type:c1.literal("text")}),W95=c1.object({type:c1.literal("json_object")}),K95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),H95=c1.union([G95,W95,K95]),F95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(J95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(Y95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:H95.optional(),user:c1.string().optional()});fF8=class fF8 extends Error{constructor($){super($);this.name="MessageConversionError"}};yF8=new Q1;yF8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(EB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(EB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(EB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=F95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(EB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=U95(J.model);if(!G)return $.json(EB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>f2(E.providerId));if(!j)return $.json(EB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(EB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=B95(J.messages),N=J.tools?D95(J.tools):void 0,B=L95(J.response_format),D=O95(),O=Math.floor(Date.now()/1000);if(J.stream)return EO($,async(w)=>{let j=bF8(F,U,N,J,B,$.req.raw.signal);try{let E=Jp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=Q95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:xF8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=bF8(F,U,N,J,B,$.req.raw.signal),j=await SL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:xF8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(EB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(EB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(EB(X.message,"server_error"),500)}});gF8=yF8});function w95($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function uF8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=_0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(l2(U)!==J)continue;if(!w95(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var lF8=L(()=>{W8();pX()});var Tx0;var XP1=L(()=>{Tx0={name:"decocms",version:"4.498.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function P95(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??E95}}var cF8,E95="https://ph.studio.decocms.com",mF8;var dF8=L(()=>{W8();ke();wg();w9();r1();Uw1();XP1();cF8=new Q1;cF8.get("/",($)=>{let Z={version:Tx0.version,theme:TY$(),...cH().logo&&{logo:cH().logo},...uL()&&{internalUrl:dr1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:qX8(),posthog:P95(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:nF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});mF8=cF8});import{z as q$}from"zod";var z95,iF8;var pF8=L(()=>{z95=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),iF8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(z95)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function nF8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Rx0($,Z={}){let Q=await fetch(nF8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return iF8.parse(await Q.json())}async function tF8($,Z={}){let Q=await fetch(nF8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var JP1=L(()=>{pF8();rD()});import{join as oF8}from"path";async function T95($){try{let Z=await Rx0($,{signal:AbortSignal.timeout(A95)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||GL1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function R95($,Z){let Q=Lh($),Y=Z?.brand?.trim()||GL1(Q),X=RZ8(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=qZ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
     `)}function q95($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function sF8($){let Z=new Q1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Lh(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(oF8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(M95)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=Lh(Q.req.param("file").replace(/\.md$/,""));try{let X=await tF8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(I95)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?oF8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await T95(Lh(Y)),K=R95(Y,W);return Q.html(q95(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var A95=2500,M95=1e4,I95=1e4;var rF8=L(()=>{W8();rD();JP1();r1()});function qx0($,Z){return fetch(`${KK({})}${$}`,Z)}async function V95($,Z){let Q=await Rx0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function S95($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var k95,AO,aF8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},eF8;var $U8=L(()=>{W8();LK();rD();JP1();k95=new Set(["complete","errored","terminated","unknown"]);AO=new Q1;AO.use("*",async($,Z)=>{let Q=await B4.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});AO.use("/link-token/*",aF8);AO.use("/suggest",aF8);AO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await V95(Z,Q))}catch{return $.json({error:"report read failed"},502)}});AO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=S95(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await qx0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${NE({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});AO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await qx0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${NE({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:k95.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});AO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await qx0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});AO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await qx0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});eF8=AO});var C95=1048576,GP1;var ZU8=L(()=>{W8();aK();r1();sO1();GP1=new Q1;GP1.post("/webhook",g5({maxSize:C95,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=L0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!gY8(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=hY8(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await uY8(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as _95}from"crypto";function x95($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return _95(Buffer.from(X),Buffer.from(Y))}function f95($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function QU8($){let Z=new Q1;return Z.post("/webhook",g5({maxSize:v95,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!x95(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!b95.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return l80().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=f95(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await y95($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function y95($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await Ru$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var v95=5242880,b95;var YU8=L(()=>{W8();aK();RJ();IQ();b95=new Set(["check_suite","issue_comment"])});import{DBOS as KP1,SchedulerMode as g95}from"@dbos-inc/dbos-sdk";async function u95(){try{return await l95()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function l95(){if(!u80())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (AY1(),zY1)),Promise.resolve().then(() => (PY1(),EY1))]),Q=await l80(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=z8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=gV$({sandboxes:J,pools:G,records:await hV$(X,J,G),legacyPools:fq0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await uV$(K,XN0(X,new iX(L0().encryptionKey)),{now:W,orgFsLifetimeMs:hq0}),U=0,N=0,B=0;for(let D of H)try{let O=await Y.pushCredentials(D);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function c95($,Z){let Q=await KP1.runStep(u95,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function XU8(){if(WP1)return;if(!L0().agentSandboxEnabled||!u80())return;WP1=KP1.registerWorkflow(c95,{name:"sandboxCredentialPushWorkflow"}),KP1.registerScheduled(WP1,{name:"sandboxCredentialPushWorkflow",crontab:h95,mode:g95.ExactlyOncePerIntervalWhenActive})}var h95="1-59/10 * * * *",WP1=null;var JU8=L(()=>{D3();Pw();GZ1();uq0();yq0();RJ();r1()});function GU8($){let Z=new KO($.db,new iX($.encryptionKey)),Q=new Q1;return Q.get("/attachments/:token",async(Y)=>{let X=Sg$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new r7(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var WU8=L(()=>{W8();Pw();iJ1();CL()});function Mx0(){try{return L0().jiraSettleSeconds*1000}catch{return SP}}function KU8($,Z){let Q=Z.windowMs??SP,Y=$.at(-1);if(!Y)return null;if(Z.changeId!==void 0&&Y.id!==Z.changeId)return{kind:"superseded"};if(Z.now!==void 0&&Z.now-Y.at<Q)return{kind:"moving"};let X=m95($,Q);if((X.id&&Y.toId?X.id===Y.toId:!1)||!X.id&&X.name===Y.to)return{kind:"returned",change:Y};return{kind:"moved",change:Y,from:X}}function m95($,Z){for(let Y=$.length-2;Y>=0;Y--){let X=$[Y],J=$[Y+1];if(X&&J&&J.at-X.at>=Z)return{id:X.toId,name:X.to}}let Q=$[0];return{id:Q?.fromId??null,name:Q?.from??null}}var HP1=L(()=>{lL();r1()});function HU8($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,Y=Z.issue?.key,X=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof Y!=="string"||typeof X!=="string"&&typeof X!=="number")return null;let J=Z.changelog?.items?.find((G)=>G.field==="status");if(!J||typeof J.toString!=="string")return null;return{issueId:String(Q),issueKey:Y,toStatus:J.toString,changelogId:String(X)}}async function FP1($,Z,Q){if(!Z.enabled)return"disabled";let Y=Z.organizationId,X=new r7(Z.siteUrl,Z.email,Z.apiToken),J=KU8(await X.listStatusChanges(Q.issueId),{changeId:Q.changelogId,now:Q.now,windowMs:Mx0()});if(!J)return"no_rule";if(J.kind!=="moved")return J.kind;let{change:G,from:W}=J,K=(await $.storage.automations.listJiraTransitionTriggers(Y,{jiraStatus:G.to,activeOnly:!0})).map((N)=>({...N,from:kP(N)})),H=Ld$(K)&&Z.boardId?Dd$(await X.getBoardColumnStatusIds(Z.boardId),W.id,G.toId):null,F=Bd$(K,W.name,H);if(!F)return"no_rule";if(!await $.storage.jiraIntegrations.claimTrigger(Y,Q.issueId,G.id))return"duplicate";return await kK({automationId:F.automation_id,organizationId:Y,triggerId:F.id,target:{kind:"jira",issues:[Q.issueId],move:{toStatus:G.to,fromStatus:W.name,movedBy:G.by,movedAt:new Date(G.at).toISOString()},eventKey:G.id}},{idempotencyKey:`jira:${F.id}:${G.id}`}),"fired"}var UP1=L(()=>{MF();CL();up();HP1()});import{DBOS as zz,SchedulerMode as d95}from"@dbos-inc/dbos-sdk";function FU8($){BP1=$}function LP1(){if(!BP1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return BP1}function OP1(){let $=LP1();return new KO($.db,new iX($.encryptionKey))}async function o95($){try{let Z=await OP1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,fired:0};let Q=await o3(LP1().db,Z.organizationId);if(!Q)return{integrationId:$,fired:0};if((await Q.storage.automations.listJiraTransitionTriggers(Z.organizationId,{activeOnly:!0})).length===0)return{integrationId:$,fired:0};let X=new r7(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${p95}m"`,W=0,K;for(let H=0;H<n95;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await FP1(Q,Z,{issueId:U.id,now:Date.now()})==="fired")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,fired:W}}catch(Z){return{integrationId:$,fired:0,error:Z instanceof Error?Z.message:String(Z)}}}async function s95($,Z){let Q=await zz.runStep(()=>OP1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>zz.runStep(()=>o95(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.fired>0)console.log(`[jira-trigger] integration ${X.integrationId} fired ${X.fired} automation(s) the webhook missed`)}async function r95($,Z){try{let Q=await OP1().getById($);if(!Q?.enabled)return"disabled";let Y=await o3(LP1().db,Q.organizationId);if(!Y)return"disabled";let X=await FP1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="fired")console.log(`[jira-trigger] fired an automation for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no fire`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function a95($,Z){await zz.sleep(Mx0()+t95),await zz.runStep(()=>r95($,Z),{name:"settleJiraMove"})}async function UU8($,Z){if(!DP1)throw Error("[jira-trigger] settle workflow is not registered");await zz.startWorkflow(DP1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function NU8(){if(NP1)return;DP1=zz.registerWorkflow(a95,{name:"jiraSettleWorkflow"}),NP1=zz.registerWorkflow(s95,{name:"jiraTriggerSweepWorkflow"}),zz.registerScheduled(NP1,{name:"jiraTriggerSweepWorkflow",crontab:i95,mode:d95.ExactlyOncePerIntervalWhenActive})}var i95="*/5 * * * *",p95=20,n95=5,t95=5000,BP1=null,DP1=null,NP1=null;var wP1=L(()=>{Pw();Bg();CL();HP1();UP1()});function BU8($){let Z=new KO($.db,new iX($.encryptionKey)),Q=Kj($.db);async function Y(J,G){let W=HU8(G);if(!W)return;let K=await Z.getByWebhookSecret(J);if(!K?.enabled)return;if((await Q.listJiraTransitionTriggers(K.organizationId,{activeOnly:!0})).length===0)return;await UU8(K.id,W)}let X=new Q1;return X.post("/webhook/:secret",g5({maxSize:e95}),async(J)=>{let G=J.req.param("secret");if(!await Z.getByWebhookSecret(G))return J.json({error:"Unknown webhook"},404);let K;try{K=await J.req.json()}catch{return J.json({error:"Body must be JSON"},400)}return Y(G,K).catch((H)=>{console.error("[jira-webhook] trigger failed",H)}),J.body(null,202)}),X}var e95=1048576;var DU8=L(()=>{W8();aK();Pw();wP1();UP1();Ca()});function LU8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var OU8,$Z5,ZZ5,wU8;var jU8=L(()=>{W8();$G();kp();bd();OU8=new Q1,$Z5=["range","if-none-match","if-modified-since"],ZZ5=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];OU8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Xt($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new I1(401,{message:"Authentication required"})}if(!Q)throw new I1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new I1(400,{message:"Missing file key"});let X=await z60(Y,Z);if(!X)throw new I1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&UK()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new I1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return LU8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of $Z5){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new I1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new I1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of ZZ5){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),LU8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});wU8=OU8});var zZ0=b((xh)=>{var QZ5=xh&&xh.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),YZ5=xh&&xh.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))QZ5(Z,$,Q)};Object.defineProperty(xh,"__esModule",{value:!0});YZ5(rG(),xh)});var zU8=b((EU8)=>{Object.defineProperty(EU8,"__esModule",{value:!0});EU8.version=void 0;EU8.version="3.4.0"});var RU8=b((PB)=>{var XZ5=PB&&PB.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(PB,"__esModule",{value:!0});PB.NodeTransport=PB.VERSION=void 0;PB.nodeResolveHost=FZ5;var Q9=zZ0(),JZ5=I0("net"),jP1=I0("tls"),GZ5=I0("path"),AU8=I0("fs"),WZ5=XZ5(I0("dns")),KZ5=zU8();PB.VERSION=KZ5.version;var HZ5="nats.js";class TU8{socket;version;lang;yields=[];signal=(0,Q9.deferred)();closedNotification=(0,Q9.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=HZ5,this.version=PB.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,Q9.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw Q9.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new Q9.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new Q9.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,Q9.deferred)(),Q,Y=(0,JZ5.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,Q9.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=Q9.DataBuffer.concat(...this.yields),X=(0,Q9.extractProtocolMessage)(Y);if(X!=="")try{let J=Q9.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,Q9.deferred)();try{if($=(0,GZ5.resolve)($),!(0,AU8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,AU8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,Q9.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,Q9.deferred)();try{let X=(0,jP1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,Q9.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,Q9.deferred)();try{let Y=(0,jP1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,Q9.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Q9.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof jP1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,Q9.render)($)}`);let Z=(0,Q9.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}PB.NodeTransport=TU8;function FZ5($){let Z=(0,Q9.deferred)();return WZ5.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var kU8=b((VU8)=>{Object.defineProperty(VU8,"__esModule",{value:!0});VU8.connect=UZ5;var qU8=RU8(),MU8=zZ0(),IU8=zZ0();function UZ5($={}){if((0,IU8.hasWsProtocol)($))return Promise.reject(IU8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,MU8.setTransportFactory)({factory:()=>{return new qU8.NodeTransport},dnsResolveFn:qU8.nodeResolveHost}),MU8.NatsConnectionImpl.connect($)}});var SU8=b((TO)=>{var BZ5=TO&&TO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),DZ5=TO&&TO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))BZ5(Z,$,Q)};Object.defineProperty(TO,"__esModule",{value:!0});TO.connect=void 0;var LZ5=kU8();Object.defineProperty(TO,"connect",{enumerable:!0,get:function(){return LZ5.connect}});DZ5(zZ0(),TO)});function vU8($){let Z=$?.connectFn??EZ5,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:jZ5,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let O=I7(wZ5,OZ5,D-1,2,0.5);await F$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?Ix0.credsAuthenticator(new TextEncoder().encode(B.creds)):B?.user?Ix0.usernamePasswordAuthenticator(B.user,B.password):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=_U8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function EZ5($){return CU8.connect($)}var Ix0,CU8,_U8,OZ5=100,wZ5=3000,jZ5=3000;var bU8=L(()=>{r$();Ix0=C(cz(),1),CU8=C(SU8(),1),_U8=C(UH(),1)});function Vx0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function kx0($,Z){return`${$}.${Z}`}class EP1{cache;constructor($){this.cache=Vx0({ttlMs:$?.ttlMs??PZ5,maxSize:$?.maxSize??zZ5})}async get($,Z){return this.cache.get(kx0($,Z))??null}async set($,Z,Q){this.cache.set(kx0($,Z),Q)}async invalidate($,Z){this.cache.delete(kx0($,Z)),this.cache.delete(kx0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var PZ5=600000,zZ5=5000;var xU8=()=>{};function Sx0($,Z){return`${$}:${Z}`}function PP1($){let Z=Vx0({ttlMs:$?.ttlMs??AZ5,maxSize:$?.maxSize??TZ5}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(fU8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(Sx0(K,H))},set(K,H,F){Z.set(Sx0(K,H),F)},invalidate(K,H){Z.delete(Sx0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(fU8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(Sx0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var fU8="studio.ai-provider-keys.invalidate",AZ5=30000,TZ5=5000;var yU8=()=>{};class zP1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var gU8=($)=>{let Z;return()=>Z??=$()},AP1,TP1;var hU8=L(()=>{v6();AP1=gU8(()=>J$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),TP1=gU8(()=>J$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function SZ5($=cU8){return{name:tN,subjects:[`${CW1}.>`],storage:dF.StorageType.File,max_age:MZ5,max_bytes:VZ5,max_msgs_per_subject:kZ5,discard:dF.DiscardPolicy.Old,retention:dF.RetentionPolicy.Limits,duplicate_window:IZ5,num_replicas:$}}class mU8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function uU8($){let Z=lU8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function bZ5($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,qZ5().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function xZ5($,Z){return $.info?.cluster?Z:1}function fZ5($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class RP1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=SZ5(X);try{await Y.streams.info(tN),await Y.streams.update(tN,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(tN,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(tN),await Y.streams.add(J);else throw G}},Q=await D8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await dF.jetstreamManager($),X=xZ5($,cU8);try{await Z(Y,X)}catch(J){if(X<=1||!fZ5(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:hp});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=bZ5(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=cm$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=vW1(H,{runId:Z}),N=performance.now()-F;AP1().record(N),TP1().add(1,{"org.id":Y??"unknown"}),vZ5?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?uU8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),_Z5)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await D8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:uU8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:hp}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=vW1(Z,{runId:$,dedup:Q});AP1().record(performance.now()-X),TP1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=lm$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?dF.DeliverPolicy.New:dF.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=VP($),W;try{W=await D8(async()=>{return(await Y.consumers.get(tN,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:hp})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=Gk0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Qk0()).pipeThrough(Yk0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:w,value:j}=await F.read();if(w){D(),O.close();return}let E=j;if(E.kind==="done"){if(J){D(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(tN,{filter:VP($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var dF,lU8,RZ5=($)=>{let Z;return()=>Z??=$()},qZ5,MZ5=86400000000000,IZ5=120000000000,VZ5=4294967296,cU8,kZ5=500000,CZ5,_Z5,vZ5;var dU8=L(()=>{r$();bW1();Wk0();Xk0();v6();hU8();dF=C(UH(),1),lU8=C(cz(),1),qZ5=RZ5(()=>J$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),cU8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);CZ5=process.env.STREAM_ENCODE_TRACE==="1",_Z5=process.env.DECOPILOT_STREAM_TRACE==="1";vZ5=CZ5?new mU8:null});function Cx0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,NU(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var iU8=L(()=>{R8()});class qP1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function yZ5($,Z,Q={}){let Y=$.startsWith("thread:")?wF($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function MP1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await yN($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await WP($,{threadId:X,runBranch:G?.branch}),K=await o$0($,Q,ZZ1(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=yZ5(W,await HM0($,X),{flat:cy(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await s3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var pU8=L(()=>{O7();DX();IQ()});async function nU8($,Z,Q){let Y=Z.organizationId;if(!IJ(Z))return!1;if(!Dg(Q))return!1;if(!await Mm($,Y,se))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=N1.shipped,J=await $.storage.taskBoard.update(Z.id,Y,{status:X},Z.updatedBy);return await r5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:X,reason:"pr_merged"}}),w8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${X}`),!0}var tU8=L(()=>{XG();m8();EX();zp();RF();a5()});function dZ5($){return $ instanceof JX}function oU8($,Z){return Z-$>=cZ5}class IP1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??gZ5;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??uZ5,Q=this.options.itemIntervalMs??hZ5,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-gJ1),F31);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-mZ5));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await K31(this.taskBoard,X,Y),await H31(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==N1.progress||IJ(W)||W.assigneeId!==F8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await MP1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!oU8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceFromProgress(X,J,N1.review,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:N1.progress,to:N1.review,reason:H}}).catch(()=>{}),w8(J,F),await qF(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==N1.progress||G.assigneeId!==F8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await fL(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),dZ5(G)){await this.returnToBacklog(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+lZ5)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToBacklog($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==N1.progress)return;let X=await this.taskBoard.returnToBacklogAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:N1.progress,to:N1.intake,reason:Q,retriesSpent:Y.retryAttempts}}).catch(()=>{}),w8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to backlog failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!oU8(SD(Q,Z.reviewCycleStartedAt),Date.now()))return;await qF($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!IJ(Y))return!1;let X=Y.assigneeId===F8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await MP1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Rp(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await nU8(G,Y,W))return!0;if(!X)return!1;if(await uu$(G,Y))return!0;if(!X31(W))return!1;return await Tp(G,Y,{previewMatchesHead:J31(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var gZ5=60000,hZ5=300000,uZ5=50,lZ5=60000,cZ5=900000,mZ5=120000;var sU8=L(()=>{m8();QV0();pU8();yL();Vp();RF();tU8();a5();x3();U31();IQ();p40()});async function rU8($,Z,Q=SP){return await eU8($,Z,Q,{})}async function aU8($,Z,Q,Y=SP){return await eU8($,Q,Y,{activityId:Z})}async function eU8($,Z,Q,Y){let X=await $.automations.findActiveBoardColumnTriggers();if(X.length===0)return 0;let J=new Map;for(let K of X){let H=K.automation.organization_id;J.set(H,[...J.get(H)??[],K])}let G=await $.taskBoard.listSettledTransitions({organizationIds:[...J.keys()],since:new Date(Z-iZ5),settledBefore:new Date(Z-Q),limit:pZ5,...Y}),W=0;for(let K of G)try{let H=(J.get(K.organizationId)??[]).filter((U)=>U.column_key===K.to&&Date.parse(U.created_at)<Date.parse(K.occurredAt));if(H.length===0)continue;let F=await nZ5($.taskBoard,K,Q);for(let U of H){if(!wd$(U,{from:F,to:K.to}))continue;if(!await $.automations.claimTriggerFire(U.id,K.activityId))continue;await $.fire({automationId:U.automation_id,organizationId:K.organizationId,triggerId:U.id,target:{kind:"card",itemId:K.itemId,columnKey:K.to,eventKey:K.activityId,movedBy:K.actorId}},{idempotencyKey:`board:${U.id}:${K.activityId}`}),W++}}catch(H){console.error(`[automations] board transition ${K.activityId} failed`,H)}return W}async function nZ5($,Z,Q){let X=(await $.listActivity(Z.itemId,Z.organizationId)).flatMap((J)=>{let G=J.data;if(J.action!=="status_changed"||typeof G?.to!=="string")return[];let W=typeof G.from==="string"?G.from:null;return W===G.to?[]:[{from:W,to:G.to,occurredAt:J.occurredAt}]});return X.length>0?jd$(X,Q):Z.from}var iZ5=1800000,pZ5=200;var $N8=L(()=>{lL()});import{DBOS as Az,DBOSClient as tZ5,SchedulerMode as oZ5}from"@dbos-inc/dbos-sdk";function ZN8($){RO=$}async function aZ5($){if(!RO)return 0;try{return await aU8(RO,$,Date.now(),RO.settleMs)}catch(Z){return console.error(`[automations] settling board move ${$} failed`,Z),0}}async function eZ5(){if(!RO)return 0;try{return await rU8(RO,Date.now(),RO.settleMs)}catch($){return console.error("[automations] board transition sweep failed",$),0}}async function $75($){await Az.sleep((RO?.settleMs??SP)+rZ5),await Az.runStep(()=>aZ5($),{name:"settleBoardMove"})}async function Z75($,Z){let Q=await Az.runStep(()=>eZ5(),{name:"sweepBoardMoves"});if(Q>0)console.log(`[automations] board transition sweep fired ${Q} trigger(s) the settle wait missed`)}async function YN8($){let Z=RO;if(!Z||!kP1)return;if(!await Z.automations.hasActiveBoardColumnTrigger($.taskBoardItemId,$.to))return;let Q=`board-settle:${$.activityId}`;if(!Az.isWithinWorkflow()){await Az.startWorkflow(kP1,{workflowID:Q,queueName:kz})($.activityId);return}let Y=await tZ5.create({systemDatabaseUrl:Z.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:1});try{await Y.enqueue({workflowName:QN8,queueName:kz,workflowID:Q},$.activityId)}finally{await Y.destroy()}}function XN8(){if(VP1)return;kP1=Az.registerWorkflow($75,{name:QN8}),VP1=Az.registerWorkflow(Z75,{name:"boardTransitionSweepWorkflow"}),Az.registerScheduled(VP1,{name:"boardTransitionSweepWorkflow",crontab:sZ5,mode:oZ5.ExactlyOncePerIntervalWhenActive})}var sZ5="*/5 * * * *",rZ5=2000,RO=null,QN8="boardTransitionSettleWorkflow",kP1=null,VP1=null;var JN8=L(()=>{lL();$N8()});import{readdir as Q75,rm as _x0}from"fs/promises";import{join as vx0}from"path";async function bx0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-Y75),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await fh($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await GN8($,X,Z);else if(!X.startsWith(".")){let J=vx0($,X),G=await fh(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await GN8(J,K,Z)}if((await fh(J)).length===0)await _x0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function GN8($,Z,Q){let Y=0,X=vx0($,Z),J=await fh(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=vx0(X,W),H=await fh(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=vx0(K,U);await _x0(B,{recursive:!0,force:!0}),Y++}}if((await fh(K)).length===0)await _x0(K,{recursive:!0,force:!0})}if((await fh(X)).length===0)await _x0(X,{recursive:!0,force:!0});return Y}async function fh($){try{return(await Q75($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var Y75=30;var SP1=()=>{};import{DBOS as CP1,SchedulerMode as X75}from"@dbos-inc/dbos-sdk";async function G75(){let $=[YH(),ih(),VB()],Z=0;for(let Q of $)try{Z+=await bx0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function W75($,Z){await CP1.runStep(()=>G75(),{name:"monitoringRetention"})}function KN8(){if(WN8)return;WN8=!0;let $=CP1.registerWorkflow(W75,{name:"monitoringRetentionWorkflow"});CP1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:J75,mode:X75.ExactlyOncePerIntervalWhenActive})}var J75="23 4 * * *",WN8=!1;var HN8=L(()=>{PW();SP1()});function FN8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await BY.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await zE($.db,Z,Y.role);return X.boundAuth=cO1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new jA(Q,void 0,X.boundAuth,Y.role,"self"),RP(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var UN8=L(()=>{tX();EN()});function NN8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=AZ0(N.params.name),D=N.params.arguments||{},O=Object.keys(D).map((j)=>AZ0(j)),w=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${N9.tool}${B}${N9.dim}(${w})${N9.reset}`}else if(N.method)J=`${N9.dim}${AZ0(N.method)}${N9.reset}`}}catch{}}let W=AZ0(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${N9.mcp}${AZ0(F.slice(0,12))}\u2026${N9.reset}`}else if(X==="/mcp")W=`${N9.mcp}/mcp${N9.reset}`;else if(X==="/mcp/registry")W=`${N9.mcp}/mcp/registry${N9.reset}`;let K=H75(Y),H=G?"\u25C0":"\u2190";console.log(`${N9.dim}${H}${N9.reset} ${K}${Y}${N9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=K75(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";console.log(`${N9.dim}${D}${N9.reset} ${K}${Y}${N9.reset} ${W}${J?` ${J}`:""} ${N}${U}${N9.reset} ${N9.duration}${B}${N9.reset}`)}}}var N9,K75=($)=>{if($>=500)return N9.serverError;if($>=400)return N9.clientError;if($>=300)return N9.redirect;return N9.ok},H75=($)=>{return N9[$]||N9.reset},AZ0=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var BN8=L(()=>{N9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as wN8}from"crypto";import{mkdir as F75,readdir as U75,rm as DN8,stat as jN8}from"fs/promises";import{join as vP1,relative as N75}from"path";import{z as Y8}from"zod";function PN8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return vP1(B75,Z)}function zN8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function _P1($,Z){let Q=PN8($),Y=zN8(Z);return vP1(Q,Y)}function D75($,Z,Q,Y){let X=L0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return wN8("sha256",X).update(J).digest("hex")}function ON8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=D75(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${zN8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function AN8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${wN8("md5","etag").update(Y).digest("hex")}"`}async function TN8($,Z,Q,Y,X){try{let J=await U75($,{withFileTypes:!0});for(let G of J){let W=vP1($,G.name),H=N75(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await TN8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await jN8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:AN8(W,F.mtime,F.size)})}catch{}}}}catch{}}function RN8($,Z){let Y=Y0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Y8.object({prefix:Y8.string().optional(),maxKeys:Y8.number().optional().default(1000),continuationToken:Y8.string().optional(),delimiter:Y8.string().optional()}),outputSchema:Y8.object({objects:Y8.array(Y8.object({key:Y8.string(),size:Y8.number(),lastModified:Y8.string(),etag:Y8.string()})),nextContinuationToken:Y8.string().optional(),isTruncated:Y8.boolean(),commonPrefixes:Y8.array(Y8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=PN8(Y);await F75(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await TN8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,O=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({contentType:Y8.string().optional(),contentLength:Y8.number(),lastModified:Y8.string(),etag:Y8.string(),metadata:Y8.record(Y8.string(),Y8.string()).optional()}),handler:async(X)=>{let J=X,G=_P1(Y,J.key),W=await jN8(G);return{contentType:cw1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:AN8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=ZO(J.expiresIn,LN8);return{url:ON8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional(),contentType:Y8.string().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=ZO(J.expiresIn,LN8);return{url:ON8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({success:Y8.boolean(),key:Y8.string()}),handler:async(X)=>{let J=X,G=_P1(Y,J.key);try{return await DN8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Y8.object({keys:Y8.array(Y8.string()).max(1000)}),outputSchema:Y8.object({deleted:Y8.array(Y8.string()),errors:Y8.array(Y8.object({key:Y8.string(),message:Y8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=_P1(Y,K);try{await DN8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function bP1($,Z,Q){let Y=RN8(Z,Q),X=new zj({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:o9});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Y8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Y8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new QW({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),gK(X,J,$,"mcp:dev-assets")}async function qN8($,Z,Q,Y){let J=RN8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var B75="./data/assets",LN8=3600,EN8,MN8;var IN8=L(()=>{r1();sp();W8();FW0();op();eX();QO();wb0();EN8=new Q1;EN8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return bP1($.req.raw,Z,Y)});MN8=EN8});var VN8={};O6(VN8,{mountDevRoutes:()=>L75});function L75($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return bP1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await qN8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",MN8);let Q=new Q1;Q.use("*",cF({mountPath:"/api/dev-assets"})),Q.route("/",Ob0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var kN8=L(()=>{W8();xw1();wb0();IN8()});var hN8={};O6(hN8,{watchHandler:()=>gN8,resolveVoiceSigningSecret:()=>xN8,resolveCorsOrigin:()=>fN8,isSsoExemptPath:()=>bN8,isAllowedOAuthRedirectUri:()=>yN8,createApp:()=>M75});import{readFileSync as O75}from"fs";import{randomBytes as w75}from"crypto";import{PrometheusSerializer as j75}from"@opentelemetry/exporter-prometheus";import{DBOS as zB}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as z75,oAuthProtectedResourceMetadata as A75}from"better-auth/plugins";async function E75($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,CN8(SN8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),CN8(SN8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function CN8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function bN8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${Zb0}/`)||$.startsWith(`${ov0}/`)}function xN8($){let Z=$.studioJwtSecret||$.betterAuthSecret;if(Z)return Z;return console.warn("STUDIO_JWT_SECRET/BETTER_AUTH_SECRET not set - generating a random secret for voice sessions (not persistent across restarts)"),w75(32).toString("base64")}function fN8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function yN8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"}async function M75($={}){let Z=$.database??z8(),Q=!1;g6.stop().catch((H0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H0)});let Y,X,J,G,W=new EP1,K,H,F,U=null;if($.disableNats)K=PP1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new n60,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(H0)=>{return(async()=>{let J0=H0.getReader();try{while(!0){let{done:P0}=await J0.read();if(P0)break}}catch{}finally{J0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=vU8();let H0=L0().natsCredsPath,J0;if(H0)try{J0=O75(H0,"utf8")}catch(U8){console.error(`[app] failed to read NATS_CREDS at ${H0}; connecting anonymously`,U8)}U.init(L0().natsUrls,{creds:J0,user:L0().natsUser,password:L0().natsPassword});let P0=h61()?new T61({getJetStream:()=>U.getJetStream(),selfListVersion:Tx0.version}):null;P0?.init().catch(()=>{}),Y=P0;let z0=new H51({getJetStream:()=>U.getJetStream()});z0.init().catch(()=>{}),X=z0;let w1=new Lg(aG1,{getJetStream:()=>U.getJetStream()}),b$=new Lg(n40,{getJetStream:()=>U.getJetStream()});w1.init().catch(()=>{}),b$.init().catch(()=>{}),J={reads:w1,cards:b$};let o$=new jH1({getJetStream:()=>U.getJetStream()});o$.init().catch(()=>{}),G=o$,K=PP1({getConnection:()=>U.getConnection()}),H=new zP1({getConnection:()=>U.getConnection()}),F=new RP1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),GX8(U),U.onReady(()=>{P0?.init().catch((U8)=>{console.error("[McpListCache] Deferred init failed:",U8)}),z0.init().catch((U8)=>{console.error("[SkillCatalogCache] Deferred init failed:",U8)}),w1.init().catch((U8)=>{console.error("[PrReadCache] Deferred init failed:",U8)}),b$.init().catch((U8)=>{console.error("[PrCardCache] Deferred init failed:",U8)}),o$.init().catch((U8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",U8)}),K.start(),Fj$(()=>U.getConnection()),F.init().catch((U8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",U8)})})}if(Tz)await Tz();R61(Y),U51(X),B51(()=>U?.getConnection()??null),eG1(J),EH1(G);let B={storage:new bl(Z.db),sseHub:g6,onThreadFinished:async(H0,J0)=>Mp(new t3(Z.db),H0,J0,new B3(Z.db))},D=new e31(B),O=new z90(Z.db),w=new qP1(O);w.start(),qd$(H),H.start((H0)=>{pV0(H0),D.execute({type:"CANCEL",taskId:H0}).catch((J0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",J0)})}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast start failed:",H0)}),U?.onReady(()=>{H.start().catch((H0)=>{console.error("[CancelBroadcast] Deferred start failed:",H0)})});let j=()=>U?.getConnection()??null;kw1(j),U?.onReady(()=>kw1(j)),eH1(j),U?.onReady(()=>eH1(j)),F.init().catch((H0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H0)}),Tz=async()=>{await D.stopAll(),D.dispose(),w.dispose(),H.stop().catch(()=>{}),TJ8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),Uj$(),G.teardown(),R61(null),U51(null),B51(null),eG1(null),EH1(null)};let E=new Q1;if(E.use("*",LH1({enabled:(H0)=>Yt(H0,"debug")==="1"})),E.use("*",Qf0),E.use("/*",ZX8({origin:(H0,J0)=>fN8(H0,{baseUrl:L0().baseUrl,requestOrigin:new URL(J0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(H0,J0)=>{if(await J0(),H0.req.path.includes("/files/"))return;if(H0.req.path.includes("/fs/")&&H0.req.path.endsWith("/read"))return;H0.header("X-Frame-Options","DENY"),H0.header("Content-Security-Policy","frame-ancestors 'none'")}),L0().nodeEnv==="development")E.use("*",NN8());E.use("*",async(H0,J0)=>{if(await J0(),ot(H0.req.path))return;if(H0.res.status>=500){let z0=await H0.res.clone().text();console.error(`[5xx Response] ${H0.req.method} ${H0.req.path} - ${H0.res.status}:`,z0)}}),E.get(_X.HEALTH,(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);return H0.json({status:"ok"})}),E.get(_X.HEALTH_LIVE,(H0)=>{return H0.json({status:"ok"})}),E.get(_X.HEALTH_READY,async(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);let J0={};if(J0.postgres={status:await E75(Z.pool)?"up":"down"},U)J0.nats=U.isConnected()?{status:"up"}:{status:"down"};else J0.nats={status:"down"};let P0=J0.postgres.status==="up",z0=P0?200:503;return H0.json({status:P0?"ready":"not_ready",services:J0},z0)}),E.get(_X.METRICS,async(H0)=>{try{let J0=await Gf0.collect(),P0=P75.serialize(J0.resourceMetrics);return H0.text(P0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(J0){return console.error("Failed to collect metrics:",J0),H0.text("# Error collecting metrics",500)}});let P=1800000;E.get(`${_X.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H0)=>{let J0=H0.req.param("queueName");if(!T75.has(J0))return H0.json({error:`Unknown queue: ${J0}`},404);let[P0,z0]=await Promise.all([zB.listQueuedWorkflows({queueName:J0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),zB.listQueuedWorkflows({queueName:J0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-P).toISOString()})]);return H0.json({queue_length:P0.length,in_flight:z0.length})}),E.route("/api/config",mF8),E.route("/api/_reports",eF8),E.route("/api/_stripe",GP1),E.route("/api/_github",QU8({taskBoard:()=>i,contextFactory:()=>y})),E.route("/api/_git",Ut);let T={db:Z.db,encryptionKey:L0().encryptionKey};E.route("/api/_jira",BU8(T)),E.route("/api/_jira",GU8(T)),E.route("/report",sF8($.clientDir)),E.route("/api/auth/custom",MX8),E.all("/api/auth/admin/*",FJ8),E.all("/api/auth/*",async(H0)=>{return await B4.handler(H0.req.raw)});let z=kQ8();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",_90),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",_90),E.route("/",z),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",j90),E.route("/",bQ8()),E.use("/oauth-proxy/:connectionId/*",_90),E.all("/oauth-proxy/:connectionId/*",_N8);let A=async(H0)=>{let P0=await R75()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",_90),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(H0)=>{let P0=await q75()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=YX8({ttlMs:120000}),_=await VY8({db:Z.db,auth:B4,encryption:{key:L0().encryptionKey},observability:{tracer:_O,meter:J$},modelListCache:W,providerKeyCache:K,memberRoleCache:x});BY.set(_),vr1({db:Z.db,baseUrl:N5()}),kY8({db:Z.db}),vY8({db:Z.db}),lY8({db:Z.db}),FU8({db:Z.db,encryptionKey:L0().encryptionKey}),vh$({db:Z.db}),nY8({db:Z.db}),Fu$({db:Z.db});let V=Kj(Z.db),g=new _a(Z.db),y=FN8({db:Z.db});FK1({storage:V,studioContextFactory:y,orgContextFactory:(H0)=>o3(Z.db,H0),systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl)}),nW1({systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),studioContextFactory:y,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}}),uW1({dispatchRunFn:bm$,studioContextFactory:y,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}});let u=new bl(Z.db),i=new t3(Z.db),n=new B3(Z.db),U0=new IP1(i,y,n);if(L0().taskBoardReviewSweeperEnabled){U0.start();let H0=Tz;Tz=async()=>{await H0?.(),U0.dispose()}}ZN8({automations:V,taskBoard:i,fire:kK,systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),settleMs:L0().boardTransitionSettleSeconds*1000}),ch$(YN8),Zd$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let H0=U?.getConnection();return H0?await vN8.jetstreamManager(H0):null},messageParts:u.messageParts(),resolveRun:async(H0)=>{let J0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H0).executeTakeFirst();return J0?{orgId:J0.organization_id,createdBy:J0.created_by,version:J0.message_storage_version??1,status:J0.status,runFenceToken:J0.run_fence_token,title:J0.title??null}:null},completeRunIfNotCompleted:async(H0,J0)=>{let P0=await u.completeRunIfNotCompleted(H0,J0);if(Cx0(g6,J0,H0,P0),P0)await Mp(i,H0,J0,n);return P0},markRunRequiresAction:async(H0,J0)=>{let P0=await u.requiresActionIfInProgress(H0,J0);return Cx0(g6,J0,H0,P0),P0},markRunFailed:async(H0,J0,P0,z0)=>{let w1=await u.markRunFailed(H0,J0,P0,z0);if(Cx0(g6,J0,H0,w1),w1)await Mp(i,H0,J0,n);return w1},clearSynthesizedError:async(H0,J0)=>{await u.messageParts().replaceMessageParts(H0,IP(H0,J0),[])},persistTitle:(H0,J0,P0)=>u.update(H0,J0,{title:P0}),onTitleUpdated:async({runId:H0,orgId:J0,title:P0})=>{let z0=await u.get(H0,J0).catch(()=>null);g6.emit(J0,NU(H0,z0?.status??"in_progress",{title:P0,virtualMcpId:z0?.virtual_mcp_id??void 0,createdBy:z0?.created_by,triggerId:z0?.trigger_id,branch:z0?.branch??null,harnessId:z0?.harness_id??void 0,createdAt:z0?.created_at,updatedAt:z0?.updated_at}))},bumpProgress:async({runId:H0,orgId:J0})=>{await u.bumpProgress(H0,J0)},recordCompleted:async({runId:H0,orgId:J0,distinctId:P0,usage:z0})=>{l1.capture({distinctId:P0,event:"chat_message_completed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",input_tokens:z0.inputTokens,output_tokens:z0.outputTokens,total_tokens:z0.totalTokens}})},recordFailed:async({runId:H0,orgId:J0,distinctId:P0,reason:z0,kind:w1})=>{l1.capture({distinctId:P0,event:"chat_message_failed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",error_category:w1,error_message:z0}})},purgeRun:async(H0)=>{F.purge(H0)}}),Qm$({studioContextFactory:y,systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),streamBuffer:F}),KN8(),br1(),CY8(),xY8(),mY8(),NU8(),XN8(),gh$(),oY8(),Uu$(),XU8();let b0=async(H0,J0,P0)=>{let z0=await V.findById(H0,J0);if(!z0)throw Error("Automation not found");return LK1({automationId:z0.id,organizationId:z0.organization_id,triggerId:null})},G0=new Ht(V,({automation:H0,trigger:J0,contextMessages:P0,idempotencyKey:z0})=>kK({automationId:H0.id,organizationId:H0.organization_id,triggerId:J0.id,contextMessages:P0},{idempotencyKey:z0})),N0=[YH(),ih(),VB()];for(let H0 of N0)bx0(H0).then(()=>{}).catch((J0)=>console.error("[monitoring] Retention cleanup failed:",J0));let o=()=>B4.api.deleteAllExpiredApiKeys().catch((H0)=>console.error("[auth] Expired API key cleanup failed:",H0));o(),setInterval(o,86400000).unref(),E.use("*",async(H0,J0)=>{if($f0(H0.req.path))return J0();let P0={measure:async(w1,b$)=>{yK(H0,w1);try{return await b$()}finally{YW(H0,w1)}}},z0=await BY.create(H0.req.raw,{timings:P0});z0.automationRunner=b0,H0.set("studioContext",z0);try{await J0()}finally{let w1=z0.pendingRevalidations;if(w1.length>0)Promise.race([Promise.allSettled(w1),F$(30000)]).catch((o$)=>console.error("[studio] revalidation cleanup error:",o$))}}),E.use("/api/:org/decopilot/*",Jt),E.use("/api/:org/v1/*",Jt),E.use("/api/:org/files/*",Jt),E.use("*",async(H0,J0)=>{if(bN8(H0.req.path))return J0();let P0=H0.get("studioContext");if(!P0?.organization?.id||!P0?.auth?.user?.id)return J0();if(!(await P0.storage.orgSsoConfig.getByOrgId(P0.organization.id))?.enforced)return J0();if(!await P0.storage.orgSsoSessions.isValid(P0.auth.user.id,P0.organization.id))return H0.json({error:"SSO authentication required for this organization"},403);return J0()});let e=new Q1;e.use("*",cF({mountPath:"/api/org-sso"})),e.route("/",Xb0()),E.route("/api/org-sso",e),E.get("/api/tools/management",(H0)=>{return H0.json({tools:ya,grouped:OA()})}),E.use("/mcp/*",async(H0,J0)=>{yK(H0,"mcp");try{return await J0()}finally{YW(H0,"mcp")}});let Q0=async(H0,J0)=>{let P0=H0.var.studioContext;if(!P0.auth.user?.id&&!P0.auth.apiKey?.id){let z0=new URL(H0.req.url),w1=H0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),b$=w1?`${w1}://${z0.host}`:z0.origin;return H0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${b$}${z0.pathname}/.well-known/oauth-protected-resource"`}})}return await J0()};if(E.use("/mcp/:connectionId?",Q0),E.use("/mcp/gateway/:virtualMcpId?",Q0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Q0),E.use("/mcp/self",Q0),UK()){let{mountDevRoutes:H0}=(kN8(),cx0(VN8));H0(E,Q0)}let $0=new Q1;$0.use("*",cF({mountPath:"/mcp"})),$0.route("/",lk0()),E.route("/mcp",$0);let X0=new Q1;X0.use("*",cF({mountPath:"/mcp/self"})),X0.route("/",tb0()),E.route("/mcp/self",X0);let h0=new Q1;h0.use("*",cF({mountPath:"/mcp"})),h0.route("/",dk0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(H0,J0)=>{yK(H0,"llm_models");try{return await J0()}finally{YW(H0,"llm_models")}});let k0=kJ8({cancelBroadcast:H,streamBuffer:F,runRegistry:D});E.route("/api",k0),E.route("/api",wU8);let K1=new Q1;K1.use("*",cF({mountPath:"/api"})),K1.route("/",ab0()),E.route("/api",K1),E.route("/api",gF8);let c0=new Q1;c0.use("*",cF({mountPath:"/api"})),c0.route("/",eb0({tokenStorage:g,automationEventDispatcher:G0})),E.route("/api",c0);let w0=new va(Z.db),E0=new Q1;E0.use("*",cF({mountPath:"/api"})),E0.route("/",Fb0()),E.route("/api",E0),E.route("/api/deco-sites",dJ8()),E.route("/api/deco-apps",_F8());let n0=new Q1;n0.use("*",cF({mountPath:"/api/deco-sites"})),n0.route("/",Nb0()),E.route("/api/deco-sites",n0),E.route(Zb0,UJ8()),E.route(PK8,TK8()),E.route("/api/_editor-resolve",uF8()),E.route(kX8,SX8()),E.route(ov0,iX8());let O1=L0(),o0=O1.elevenlabsApiKey?new Px0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,v0={openai:O1.openaiLiveApiKey?new aE1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:o0?new rE1(o0,()=>U?.getConnection()??null):null},d0=new YP1({adapter:o0,conversationAdapters:v0,defaults:O1,secret:xN8(O1),getConnection:()=>U?.getConnection()??null}),i0=FF8({voiceSessions:d0,kvStorage:w0,runRegistry:D,streamBuffer:F,sseHub:g6,cancelBroadcast:H,tokenStorage:g,automationEventDispatcher:G0,mountDevAssets:UK(),mcpAuth:Q0,oauthProxyHandler:_N8,watchHandler:gN8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((H0)=>{return H0.json({error:"Not Found",path:H0.req.path},404)}),E.onError(CJ8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([g6.stop(),Tz?Promise.resolve(Tz()).finally(()=>{Tz=null}):Promise.resolve()]),U)await U.drain().catch((H0)=>console.error("[shutdown] NATS drain error:",H0));console.log("[shutdown] Flushing telemetry..."),await xJ().catch((H0)=>console.error("[shutdown] Telemetry flush error:",H0)),console.log("[shutdown] Closing database..."),await hJ$(Z).catch((H0)=>console.error("[shutdown] Database close error:",H0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await zB.registerQueue(nG,{partitionQueue:!0,concurrency:WK1,minPollingIntervalMs:KK1}),await zB.registerQueue(jW,{partitionQueue:!0,concurrency:iW1,priorityEnabled:!0}),await zB.registerQueue(MB,{workerConcurrency:L0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await zB.registerQueue(IB,{workerConcurrency:L0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await zB.registerQueue(CO,{partitionQueue:!0,concurrency:Zm$}),await zB.registerQueue(Vz,Hu$),await zB.registerQueue(kz),await fw1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((H0)=>zB.deleteQueue(H0))),await HK1(Z.pool),EK$().catch((H0)=>{console.error("[studio-pack-backfill] failed:",H0)}),qm(Z.db).catch((H0)=>{console.error("[automations] built-in seed failed:",H0)}),xr1().catch((H0)=>{console.error("[org-fs] public-sets boot sync kick failed:",H0)})}})}var vN8,SN8=5000,Tz=null,_N8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await BY.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let g=await $.req.json().catch(()=>({}));return $.json({...typeof g==="object"&&g!==null?g:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await $t(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=UO1(await W.json());if(!K)K=H.origin;let N=await E90(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),D;if(Y==="authorize")D=B.authorization_endpoint;else if(Y==="token")D=B.token_endpoint;else if(Y==="register")D=B.registration_endpoint;if(!D)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=vQ8(D);if(O)return O;let w=new URL(D),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let g=w.searchParams.get("redirect_uri");if(g){let y=L0().baseUrl??j.origin;try{if(!yN8(new URL(g),y))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",g)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(rY8(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},P=$.req.header("Content-Type");if(P)E["Content-Type"]=P;let T=$.req.header("Authorization");if(T)E.Authorization=T;let z,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&P?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let n=atob(T.slice(6).trim()),U0=n.indexOf(":");if(U0!==-1){let b0=decodeURIComponent(n.slice(0,U0)),G0=decodeURIComponent(n.slice(U0+1));A=b0||null,q=G0||null}}catch{}let g=await $.req.formData();if(g.has("resource"))g.set("resource",U);let y=g.get("client_id"),u=g.get("client_secret");if(typeof y==="string"&&y)A=y;if(typeof u==="string"&&u)q=u;let i=new URLSearchParams;for(let[n,U0]of g.entries())i.append(n,U0.toString());z=i.toString()}else if(Y==="register"&&P?.toLowerCase().includes("application/json")){let g=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),y=await $.req.text(),u={};try{u=y?JSON.parse(y):{}}catch{z=y}let i=typeof u==="object"&&u!==null&&!Array.isArray(u);if(z===void 0&&!i)z=y;if(z===void 0){let n=u,U0=n.metadata&&typeof n.metadata==="object"?n.metadata:{};n.metadata={...U0,organization_id:G.organization_id,...g?.slug?{organization_slug:g.slug}:{},...g?.name?{organization_name:g.name}:{}},z=JSON.stringify(n),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[g,y]of x.headers.entries())if(!V.includes(g.toLowerCase()))_.set(g,y);if(Y==="token"&&x.ok){let g=await x.text();try{let y=JSON.parse(g);if(typeof y.access_token==="string"&&y.access_token){let u=typeof y.expires_in==="number"?new Date(Date.now()+y.expires_in*1000):null,i=null;try{i=await Fz(G.connection_url)??D}catch{i=D}let n={connectionId:Z,accessToken:y.access_token,refreshToken:typeof y.refresh_token==="string"?y.refresh_token:null,scope:typeof y.scope==="string"?y.scope:null,expiresAt:u,clientId:A,clientSecret:q,tokenEndpoint:i};await new o5(X.db,X.vault).upsert(n)}}catch(y){console.error("[oauth-proxy] failed to persist downstream token:",y)}return new Response(g,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},gN8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!dN(Y)||!await iN(Z)))return $.json({error:"forbidden"},403);let W=G?cI0:Y;if(G)xL({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return EO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!g6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{g6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),g6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),g6.remove(W,K),N()})})})},P75,T75,R75=()=>A75(B4),q75=()=>z75(B4);var uN8=L(()=>{r$();r1();fr1();_Y8();fY8();dY8();$50();_G1();sY8();p40();w9();bd();R8();W8();iv0();QX8();OH1();LK();EN();Xw1();D3();v6();Q6();Uw1();CX8();pX8();Ow1();NJ8();qw1();vw1();bw1();NK();P90();xw1();_J8();nv0();UF8();OF8();wF8();zF8();CF8();hw1();vF8();ck0();t60();hF8();ik0();OE1();lF8();DE1();dF8();rF8();$U8();ZU8();YU8();JU8();WU8();DU8();wP1();dw1();jU8();LE1();FE1();yZ0();bU8();XP1();UJ();OU0();O$0();Z31();F$0();N$0();zH1();xU8();yU8();Sw1();dU8();xV0();iU8();Br();fa();bL();a5();MO1();sU8();JN8();XG();Bg();HN8();yK0();SP1();PW();yw1();vL();gW1();yK0();Zk0();Ca();Wr0();UN8();Hj();BN8();Vt();Xw1();Ep();yp();nV0();vN8=C(UH(),1);P75=new j75,T75=new Set([nG,jW,MB,IB,CO,Vz])});var dN8={};O6(dN8,{resolveClientDir:()=>v75,resolveAssetPathWithTraversalCheck:()=>mN8,isPathWithinDirectory:()=>cN8,createAssetHandler:()=>b75});import{resolve as TZ0,dirname as I75,join as V75,extname as k75,basename as S75,sep as lN8}from"path";function C75($,Z){if($===Z||S75($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${lN8}assets${lN8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function cN8($,Z){let Q=TZ0(Z),Y=TZ0($);return Y===Q||Y.startsWith(Q+"/")}function mN8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=TZ0(Z,Q);if(!cN8(Y,Z))return null;return Y}function v75($,Z="../client"){let Q=new URL($),Y=I75(Q.pathname);return TZ0(Y,Z)}function b75($={}){let{env:Z="production",clientDir:Q=_75,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=mN8({requestPath:W,clientDir:Q});if(!K)return null;let H=V75(K,"index.html"),F=TZ0(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(k75(K))?[H,F]:[];for(let D of[K,...B])try{let O=Bun.file(D);if(await O.exists())return new Response(O,{headers:C75(D,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var _75="./dist/client";var iN8=()=>{};var pN8={};O6(pN8,{tryUpgradePreviewWs:()=>l75,tryHandlePreviewHttp:()=>u75,previewWebSocketHandler:()=>c75,parsePreviewBaseDomain:()=>h75,isPreviewWsData:()=>xx0,extractHandleFromHost:()=>xP1});function y75($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function g75(){return new Response(f75,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function h75($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function xP1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function u75($,Z){let Q=xP1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return qZ0(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Ii)&&y75($))return g75();return X.headers.delete(Ii),X}function qZ0($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function xx0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function l75($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=xP1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return qZ0(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return qZ0(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return qZ0(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return qZ0(426,"upgrade failed");return}function RZ0($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var x75=256,f75='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',c75;var nN8=L(()=>{v80();c75={open($){let Z=$.data;if(!xx0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),RZ0($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{RZ0($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{RZ0($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!xx0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=x75){RZ0($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!xx0(Z))return;RZ0($,Z,1000,"")}}});r$();var tP1="13";function oP1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:tP1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}r$();import UB8 from"pg";var sP1=8314027461559302n,NB8=600000,BB8=500;async function rP1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=NB8}=$,X=$.log??((K)=>console.log(K)),J=new UB8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[sP1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await F$(BB8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[sP1.toString()])}catch{}await J.end().catch(()=>{})}}r1();px0();v6();function UD8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Hf0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function vz1(){let $=UD8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Hf0($,"--cpu-prof-dir")??process.cwd(),name:Hf0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Hf0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Nf0();var uZ0;function cz1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=_z();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),uZ0=setInterval(()=>void Z().catch(()=>{}),$),uZ0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(uZ0)clearInterval(uZ0)}}import*as DD8 from"bun:jsc";var{startSamplingProfiler:LD8,samplingProfilerStackTraces:OD8}=DD8;function mz1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{LD8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=OD8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function dz1(){vz1();let $=[cz1(),lz1(),mz1()];return()=>{for(let Z of $)Z()}}import{existsSync as s75}from"fs";var OW=L0();Sz1();var{DBOS:MZ0,DBOSClient:m75}=await import("@dbos-inc/dbos-sdk");function lP1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var d75=[nG,jW,MB,IB,CO,Vz,kz],i75=OW.dispatchRole==="worker"?d75:OW.dispatchRole==="api"?[]:void 0;MZ0.setConfig(oP1({systemDatabaseUrl:lP1(OW.databaseUrl,OW.databasePgSsl),poolSize:OW.dbosPoolSize,executorID:OW.podName,listenQueues:i75}));var{createApp:p75}=await Promise.resolve().then(() => (uN8(),hN8)),{isServerPath:n75}=await Promise.resolve().then(() => (yZ0(),Bz1)),{createAssetHandler:t75,resolveClientDir:aN8}=await Promise.resolve().then(() => (iN8(),dN8)),o75=OW.port,tN8=aN8(import.meta.url,"../client"),eN8=s75(tN8)?tN8:aN8(import.meta.url,"../dist/client"),r75=t75({clientDir:eN8,isServerPath:n75}),a75={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function e75($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(a75))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:$Q5,tryHandlePreviewHttp:ZQ5,tryUpgradePreviewWs:QQ5,previewWebSocketHandler:fP1,isPreviewWsData:yP1}=await Promise.resolve().then(() => (nN8(),pN8)),{getOrInitSharedRunner:$B8}=await Promise.resolve().then(() => (RJ(),$S$)),ZB8=$Q5(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),oN8={baseDomain:ZB8??"",getRunner:$B8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())$B8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var fx0=await p75({clientDir:eN8}),gP1=process.env.DBOS_CONDUCTOR_KEY?.trim(),sN8=process.env.DBOS_CONDUCTOR_URL?.trim();await rP1({databaseUrl:lP1(OW.databaseUrl,OW.databasePgSsl)},()=>MZ0.launch({...gP1?{conductorKey:gP1}:{},...gP1&&sN8?{conductorURL:sN8}:{}}));console.log(`[dbos] application version: ${MZ0.applicationVersion}`);var hP1=5,uP1=0;await D8(async()=>{uP1++;try{return await fx0.initDbos()}catch($){let Z=uP1>=hP1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${uP1}/${hP1} failed, ${Z}`,$),$}},{maxAttempts:hP1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});var YQ5=Bun.serve({idleTimeout:0,port:o75,hostname:"0.0.0.0",fetch:async($,Z)=>{if(ZB8){let Y=await QQ5($,Z,oN8);if(Y===void 0)return;if(Y)return Y;let X=await ZQ5($,oN8);if(X)return X}let Q=await r75($);if(Q)return e75(Q);return fx0.fetch($,{server:Z})},websocket:{open($){if(yP1($.data))fP1.open($)},message($,Z){if(yP1($.data))fP1.message($,Z)},close($){if(yP1($.data))fP1.close($)}},development:!1}),XQ5=dz1();if(OW.localMode)Promise.resolve().then(() => (wg(),VV0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (wg(),VV0));Z()}catch{}});var rN8=!1;async function JQ5($){let Z;try{Z=await m75.create({systemDatabaseUrl:lP1(OW.databaseUrl,OW.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:jW,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:jW}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function yx0($){if(rN8)return;rN8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{XQ5(),fx0.markShuttingDown();let J=aP1(OW.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await F$(J),await YQ5.stop(!0);let G=MZ0.executorID;await MZ0.shutdown(),await JQ5(G),await fx0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>yx0("SIGTERM"));process.on("SIGINT",()=>yx0("SIGINT"));process.on("SIGHUP",()=>yx0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),yx0("uncaughtException")});