decocms 4.513.2 → 4.513.4

package/dist/server/server.js

@@ -4124,7 +4124,7 @@ Propose at most ${$.count} campaign(s). One is a good answer when the seed only
     order by i."createdAt" asc
   `.execute($),X=[];for(let J of Y.rows){if(P9(J))continue;let{invitationId:G,role:W,metadata:K,...H}=J;await uE1(Z,Q.id,H.id,W??"user"),await T70`
       update invitation set status = 'accepted' where id = ${G}
-    `.execute($),X.push(H)}return X}async function uE1($,Z,Q,Y="user"){try{await $.addMember({body:{userId:Z,role:Y,organizationId:Q}})}catch(X){if(!Hz(X))throw X}}async function EW8($,Z){for(let Q=0;Q<LW8;Q++){let Y=Q===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return ke6(await $.createOrganization({body:{name:Z.name,slug:`${Z.baseSlug}${Y}`,userId:Z.userId}}))}catch(X){if(!Ce6(X)||Q===LW8-1)throw X}}throw Error("Failed to create organization")}var LW8=5,Ae6,Te6;var lE1=L(()=>{Df0();Ae6=["labs","agent","studio","workspace","systems","core","cloud","works"],Te6=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});import{APIError as _e6}from"better-auth/api";function PW8($,Z){if(typeof Z!=="string"||Z===$)return;throw new _e6("BAD_REQUEST",{message:"Organization slug cannot be changed after creation."})}var zW8=()=>{};var VW8={};O6(VW8,{resetPasswordEnabled:()=>jf0,grantDeploymentAdmin:()=>pE1,getTrustedOrigins:()=>wf0,authConfig:()=>_4,auth:()=>B4,GENERIC_EMAIL_DOMAINS:()=>pF});import{randomBytes as ve6}from"crypto";import{sso as be6}from"@better-auth/sso";import{organization as xe6}from"@decocms/better-auth/plugins";import{betterAuth as fe6}from"better-auth";import{admin as ye6,apiKey as ge6,jwt as he6,magicLink as ue6,mcp as le6,openAPI as me6}from"better-auth/plugins";import{emailOTP as ce6}from"better-auth/plugins/email-otp";import{APIError as dE1}from"better-auth/api";import{adminAc as de6,defaultRoles as ie6}from"better-auth/plugins/admin/access";import{defaultStatements as pe6}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as ne6}from"@decocms/better-auth/plugins/access";function AW8($){if(!Gj0($))return;throw new dE1("BAD_REQUEST",{message:`Organization slug "${String($).trim()}" is reserved by Studio`})}function pE1($){if(!mE1.includes($))mE1.push($)}function wf0(){let $=[q70];try{let Z=new URL(q70);if(Z.hostname==="localhost")$.push(q70.replace("localhost","127.0.0.1"));else if(Z.hostname==="127.0.0.1")$.push(q70.replace("127.0.0.1","localhost"))}catch{}return $}var qW8,te6,Of0,iE1,oe6,se6,re6,TW8,mE1,_4,RW8=void 0,cE1=void 0,jf0=!1,ae6,ee6,$05,q70,MW8,Z05,B4;var nK=L(()=>{u1();QE();R10();Q6();H9();S3();wH$();iT();PH$();QW8();GW8();WW8();XX();fE1();UW8();Df0();lE1();K31();zW8();qW8=Object.values(qT()).map(($)=>$.map((Z)=>Z.name)).flat(),te6={...pe6,self:["*",...qW8]},Of0=ne6(te6),iE1=bE1(qW8),oe6=Of0.newRole(iE1.user),se6=Of0.newRole(iE1.admin),re6=Of0.newRole(iE1.owner),TW8=Object.values(qT()).map(($)=>$.map((Z)=>`self:${Z.name}`)).flat(),mE1=[];_4=NF().auth;if(_4.inviteEmailProviderId&&_4.emailProviders&&_4.emailProviders.length>0){let $=v3(_4.emailProviders,_4.inviteEmailProviderId);if($){let Z=_3($);RW8=async(Q)=>{let Y=Q.inviter.user?.name||Q.inviter.user?.email,X=`${h9()}/auth/accept-invitation?invitationId=${Q.invitation.id}&redirectTo=/${Q.organization.slug}`;await Z({to:Q.email,subject:`You've been invited to join ${Q.organization.name}`,html:b3({preheader:`${Y} has invited you to join ${Q.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${Y}</strong> has invited you to join <strong>${Q.organization.name}</strong> on deco Studio.`,body:pT("Accept invitation",X),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(_4.resetPasswordEmailProviderId&&_4.emailProviders&&_4.emailProviders.length>0){let $=v3(_4.emailProviders,_4.resetPasswordEmailProviderId);if($){let Z=_3($);jf0=!0,cE1=async({user:Q,url:Y})=>{await Z({to:Q.email,subject:"Reset your password",html:b3({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:pT("Reset password",Y)+IF0("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}ae6=[xe6({...B0().plansEnabled&&{membershipLimit:Number.MAX_SAFE_INTEGER},organizationCreation:{afterCreate:async($)=>{await ZW8($.organization.id,$.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:$})=>{if(AW8($.slug),$.slug&&await VF0(E8().db,$.slug))throw new dE1("BAD_REQUEST",{message:"Organization slug is already taken."})},beforeUpdateOrganization:async({organization:$,member:Z})=>{if(AW8($.slug),typeof $.slug==="string"){let X=await E8().db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(X)PW8(X.slug,$.slug)}let Q=$.logo;if(typeof Q!=="string"||!Q.startsWith("data:"))return;let Y=await JW8(Z.organizationId,Q);if(Y===Q)return;return{data:{...$,logo:Y}}}},ac:Of0,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:b00,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:oe6,admin:se6,owner:re6},sendInvitationEmail:RW8,invitationExpiresIn:604800}),le6({loginPage:"/login",oidcConfig:{scopes:TW8,metadata:{scopes_supported:TW8},loginPage:"/login"}}),ge6({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Q=$.headers?.get("Authorization");if(Q?.startsWith("Bearer "))return Q.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),ye6({defaultRole:"user",adminRoles:["admin","owner"],roles:{...ie6,owner:de6},adminUserIds:mE1}),me6(),he6({jwt:{expirationTime:"5m",definePayload:({user:$})=>({id:$.id,email:$.email,name:$.name,role:$.role})}}),be6(_4.ssoConfig?FW8(_4.ssoConfig):void 0),..._4.magicLinkConfig?.enabled&&_4.emailProviders&&_4.emailProviders.length>0?[ue6(EH$(_4.magicLinkConfig,_4.emailProviders))]:[],..._4.emailOtpConfig?.enabled&&_4.emailProviders&&_4.emailProviders.length>0?[ce6(jH$(_4.emailOtpConfig,_4.emailProviders))]:[]],ee6=y10(),$05=BH$(ee6),q70=h9();MW8=B0(),Z05=MW8.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),ve6(32).toString("base64")})(),B4=fe6({secret:Z05,logger:{log:($,Z,...Q)=>{if($==="error"&&Z.includes("validate API key"))return;if($==="error"&&Q.some((X)=>{let J=X?.statusCode;return typeof J==="number"&&J>=300&&J<400}))return;let Y=`${new Date().toISOString()} ${$.toUpperCase()} [Better Auth]: ${Z}`;if($==="error")console.error(Y,...Q);else if($==="warn")console.warn(Y,...Q);else console.log(Y,...Q)}},baseURL:q70,trustedOrigins:wf0(),database:$05,socialProviders:_4.socialProviders,..._4.ssoConfig&&{account:{accountLinking:{trustedProviders:[_4.ssoConfig.providerId]}}},emailAndPassword:{enabled:_4.emailAndPassword.enabled,...cE1&&{sendResetPassword:cE1}},rateLimit:{enabled:!MW8.disableRateLimit,window:60,max:1e4},plugins:ae6,databaseHooks:{user:{create:{before:async($)=>{let Z=$.name;if(typeof Z==="string"&&Z.trim().length>0)return;let Q=BW8($.email);if(!Q)return;return{data:{...$,name:Q}}},after:async($,Z)=>{_E1({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified});let Q=Z?.getCookie("studio_signup_ref")??null,Y=Z?.getCookie("studio_signup_src")??null;m1.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name,...Q?{signup_ref:Q}:{},...Y?{signup_src:Y}:{}}});let X=NF().autoCreateOrganizationOnSignup!==!1;try{let J=await Lf0({db:E8().db,authApi:B4.api,user:{id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified},allowCreate:X,createdVia:"signup"});if(J.status==="created")m1.groupIdentify({groupType:"organization",groupKey:J.organization.id,properties:{name:J.organization.name,slug:J.organization.slug,created_at:new Date().toISOString(),created_via:J.createdVia,email_domain:J.domain}}),m1.capture({distinctId:$.id,event:"organization_created",groups:{organization:J.organization.id},properties:{organization_id:J.organization.id,organization_slug:J.organization.slug,name:J.organization.name,created_via:J.createdVia,email_domain:J.domain}});if(J.status==="joined_via_invitation")for(let G of J.organizations)m1.capture({distinctId:$.id,event:"organization_invitation_auto_accepted",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:J.domain,joined_via:J.createdVia,invitation_count:J.organizations.length}});if(J.status==="joined")m1.capture({distinctId:$.id,event:"organization_domain_joined",groups:{organization:J.organization.id},properties:{organization_id:J.organization.id,organization_slug:J.organization.slug,email_domain:J.domain,joined_via:J.createdVia}})}catch(J){m1.captureException(J,$.id),console.error("Failed to ensure organization on signup:",J)}}},update:{before:async($)=>{let Z=$.image;if(typeof Z==="string"&&Z.startsWith("data:"))throw new dE1("BAD_REQUEST",{message:"Inline image data is not accepted. Upload the avatar to /api/_users/avatar and set `image` to the returned URL."})}}},session:{create:{after:async($)=>{let Z=await E8().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!Z)return;_E1({id:Z.id,email:Z.email,name:Z.name??null,emailVerified:!!Z.emailVerified})}}}}})});function tE1($){return $?`/api/${$}`:""}function IW8($){let Q=new URL($).pathname;if(Q.endsWith("/"))Q=Q.slice(0,-1);let Y=(X)=>{let J=new URL($);return J.pathname=X,J.toString()};return[Y(`${Q}/.well-known/oauth-protected-resource`),Y(`/.well-known/oauth-protected-resource${Q}`),Y("/.well-known/oauth-protected-resource")]}function kW8($){let Q=new URL($).pathname;if(Q.endsWith("/"))Q=Q.slice(0,-1);let Y=Q!==""&&Q!=="/",X=(J)=>{let G=new URL($);return G.pathname=J,G.toString()};if(Y)return[X(`/.well-known/oauth-authorization-server${Q}`),X(`/.well-known/openid-configuration${Q}`),X(`${Q}/.well-known/openid-configuration`)];return[X("/.well-known/oauth-authorization-server"),X("/.well-known/openid-configuration")]}function CW8($){return"issuer"in $&&!("resource"in $)&&(("authorization_endpoint"in $)||("token_endpoint"in $))}function SW8($){let Z=$.toLowerCase();return Z.includes("resource_metadata=")||Z.includes("invalid_token")||Z.includes("oauth")}function _W8($){let Z=$.message?.toLowerCase()??"";return $.status===401||$.code===401||($.message?.includes("401")??!1)||Z.includes("unauthorized")||Z.includes("invalid_token")||Z.includes("api key required")||Z.includes("api-key required")}function vW8($,{proxyResourceUrl:Z,proxyAuthServer:Q}){return{...$,resource:Z,authorization_servers:[Q]}}function oE1({proxyResourceUrl:$,proxyAuthServer:Z,scopesSupported:Q=["*"]}){return{resource:$,authorization_servers:[Z],bearer_methods_supported:["header"],scopes_supported:Q}}function bW8($){return"scopes_supported"in $&&Array.isArray($.scopes_supported)&&$.scopes_supported.length>0?$.scopes_supported:["*"]}function xW8($,Z){return{...$,authorization_endpoint:$.authorization_endpoint?`${Z}/authorize`:void 0,token_endpoint:$.token_endpoint?`${Z}/token`:void 0,registration_endpoint:$.registration_endpoint?`${Z}/register`:void 0}}function fW8({origin:$,prefix:Z,connectionId:Q}){return`Bearer realm="mcp",resource_metadata="${$}${Z}/mcp/${Q}/.well-known/oauth-protected-resource"`}var nE1;var yW8=L(()=>{nE1=[404,401,406]});import{oAuthProtectedResourceMetadata as Q05}from"better-auth/plugins";async function Y05($,Z,Q){return(await Z.storage.connections.findById($,Q))?.connection_url??null}async function uW8($,Z={}){try{let Q=await aE1($,{method:"POST",headers:{...Z,"Content-Type":"application/json",Accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:0,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"mcp-cms-proxy",version:"1.0.0"}}})});if(Q.status===401){let Y=Q.headers.get("WWW-Authenticate");if(Y&&SW8(Y))return await ku(Q),Y;if(await ku(Q),await X05($))return'Bearer realm="mcp"';return null}return await ku(Q),null}catch{return null}}async function X05($){try{let Z=new URL($),Q=new URL("/.well-known/oauth-authorization-server",Z.origin),Y=await aE1(Q.toString(),{method:"GET",headers:{Accept:"application/json"}});if(Y.ok){let X=await Y.json();if(X.authorization_endpoint||X.token_endpoint||X.issuer)return!0;return!1}return await ku(Y),!1}catch{return!1}}async function ko($){let Z=IW8($),Q;for(let Y=0;Y<Z.length;Y++){if(Q=await pW8(Z[Y],{method:"GET",headers:{Accept:"application/json"}}),Q.ok)return Q;if(Y<Z.length-1&&!nE1.includes(Q.status))return Q;if(Y<Z.length-1)await ku(Q)}return Q}function rE1($){let Z=typeof $==="object"&&$!==null?$.authorization_servers:void 0,Q=Array.isArray(Z)?Z[0]:void 0;return typeof Q==="string"?Q:void 0}async function J05($){let Z;try{Z=new URL($).origin}catch{return null}try{let Q=await ko($);if(Q.ok){let Y=rE1(await Q.json());if(Y)return Y}}catch{}return Z}async function lW8($){let Z=$.get("studioContext");if(!Z)Z=await xY.create($.req.raw),$.set("studioContext",Z);return Z}async function Hj1({error:$,reqUrl:Z,connectionId:Q,connectionUrl:Y,headers:X,orgSlug:J}){if(!_W8($))return null;if(Boolean(await uW8(Y,X)))return new Response(null,{status:401,headers:{"WWW-Authenticate":fW8({origin:Z.origin,prefix:tE1(J),connectionId:Q})}});return new Response(JSON.stringify({error:"unauthorized",message:"Authentication required but server does not support OAuth"}),{status:401,headers:{"Content-Type":"application/json"}})}function gW8($){let Y=$.pathname;if(Y.endsWith("/.well-known/oauth-protected-resource"))Y=Y.slice(0,-37)||"/";else if(Y.startsWith("/.well-known/oauth-protected-resource"))Y=Y.slice(37)||"/";return`${$.origin}${Y}`}async function hW8($,Z){let Q=await Q05(B4)($),Y=await Q.json();if(Z)Y.resource=Z;return Response.json(Y,Q)}function aE1($,Z,Q=iW8){return tD()($,{...Z,signal:AbortSignal.timeout(Q)})}class sE1{response;constructor($){this.response=$}}async function ku($){await $.text().catch(()=>{})}async function pW8($,Z,{attempts:Q=3,timeoutMs:Y=iW8}={}){let X=0;try{return await e$(async()=>{X++;let J=await aE1($,Z,Y);if(J.status>=500){if(X<Q)await ku(J);throw new sE1(J)}return J},{maxAttempts:Q,minTimeout:150,multiplier:2,jitter:0})}catch(J){if(J instanceof e6){if(J.cause instanceof sE1)return J.cause.response;throw J.cause}throw J}}function nW8($){if(!YW0($))return null;return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}})}async function M70($){if(YW0($))return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}});let Z=kW8($),Q=null;for(let Y=0;Y<Z.length;Y++){if(Q=await pW8(Z[Y],{method:"GET",headers:{Accept:"application/json"}}),Q.ok)return Q;if(Q.status!==404&&Q.status!==401)return Q;if(Y<Z.length-1)await ku(Q)}return Q}var mW8=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $},R70=async($)=>{let Z=$.req.param("connectionId"),Q=await lW8($),Y=mW8(new URL($.req.url)),X=$.req.param("org")??Q.organization?.slug,J;if(X)if(Q.organization?.id&&Q.organization.slug===X)J=Q.organization.id;else{let F=await Q.db.selectFrom("organization").select("id").where("slug","=",X).executeTakeFirst();if(!F)return $.json({error:"Connection not found"},404);J=F.id}if(J&&Q.auth?.tokenOrganizationId&&Q.auth.tokenOrganizationId!==J)return $.json({error:"forbidden: token is scoped to another organization"},403);if(Z==="self")return hW8($.req.raw,gW8(Y));let G=await Y05(Z,Q,J);if(!G)return $.json({error:"Connection not found"},404);if(G.startsWith("virtual://"))return hW8($.req.raw,gW8(Y));let W=tE1(X),K=`${Y.origin}${W}/mcp/${Z}`,H=`${Y.origin}/oauth-proxy/${Z}`;try{let F=await ko(G);if(!F.ok&&nE1.includes(F.status)){if(await uW8(G)){let D=oE1({proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(D),{status:200,headers:{"Content-Type":"application/json"}})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}if(!F.ok)return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}});let U=await F.json();if(CW8(U)){let B=oE1({proxyResourceUrl:K,proxyAuthServer:H,scopesSupported:bW8(U)});return new Response(JSON.stringify(B),{status:200,headers:{"Content-Type":"application/json"}})}let N=vW8(U,{proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(N),{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}catch(F){let U=F;return console.error("[oauth-proxy] Failed to proxy OAuth protected resource metadata:",U),$.json({error:"Failed to proxy OAuth metadata",message:U.message},502)}},cW8=()=>{let $=new Z1;return $.get("/.well-known/oauth-protected-resource/mcp/:connectionId",(Z)=>R70(Z)),$.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>R70(Z)),$},dW8=()=>{let $=new Z1;return $.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>R70(Z)),$},iW8=4000,G05=async($)=>{let Z=$.req.param("connectionId"),Q=await lW8($),Y=await Q.storage.connections.findById(Z);if(!Y?.connection_url)return $.json({error:"Connection not found or no auth server"},404);let X=await J05(Y.connection_url);if(!X)return $.json({error:"Connection not found or no auth server"},404);let J=await Q.db.selectFrom("organization").select("slug").where("id","=",Y.organization_id).executeTakeFirst();try{let G=await M70(X);if(!G.ok)return new Response(G.body,{status:G.status,statusText:G.statusText,headers:{"Content-Type":"application/json"}});let W=await G.json(),K=mW8(new URL($.req.url)),H=J?.slug?`${K.origin}/api/${J.slug}/oauth-proxy/${Z}`:`${K.origin}/oauth-proxy/${Z}`,F=xW8(W,H);return new Response(JSON.stringify(F),{status:200,headers:{"Content-Type":"application/json"}})}catch(G){let W=G;return console.error("[oauth-proxy] Failed to proxy auth server metadata:",W),$.json({error:"Failed to proxy auth server metadata",message:W.message},502)}},tW8=()=>{let $=new Z1;return $.get("/.well-known/oauth-authorization-server/oauth-proxy/:connectionId",G05),$};var $70=L(()=>{H8();vF();nK();p$();um();yW8()});async function oW8($){try{await $.body?.cancel()}catch{}}async function L2($){try{let Z;try{let Y=await ko($);if(Y.ok)Z=(await Y.json()).authorization_servers?.[0];else await oW8(Y)}catch{}if(!Z)Z=new URL($).origin;let Q=await M70(Z);if(Q.ok){let Y=await Q.json();if(typeof Y.token_endpoint==="string")try{let X=new URL(Y.token_endpoint);if((X.protocol==="http:"||X.protocol==="https:")&&!await Aw(Y.token_endpoint))return Y.token_endpoint}catch{}}else await oW8(Q);return null}catch{return null}}var V70=L(()=>{$70();um()});function gP($){return!!$.refreshToken&&!!$.tokenEndpoint&&!!$.clientId}function W05($,Z){if($.includes("/oauth-proxy/"))return!0;try{return new URL($).host!==new URL(Z).host}catch{return!1}}function p2$($){if($)Co.delete($);else Co.clear()}async function F05($,Z){let Q=await D3$($);if(!Q.success||!Q.accessToken){if(Q.permanent===!0)await Z.delete($.connectionId).catch((Y)=>{console.warn("[TokenRefresh] failed to delete dead token row",{connectionId:$.connectionId,message:Y instanceof Error?Y.message:String(Y)})});return{accessToken:null,permanent:Q.permanent===!0}}try{await Z.upsert({connectionId:$.connectionId,accessToken:Q.accessToken,refreshToken:Q.refreshToken??$.refreshToken,scope:Q.scope??$.scope,expiresAt:Q.expiresIn!==void 0?new Date(Date.now()+Q.expiresIn*1000):Q.expiresInMalformed?new Date:null,clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint})}catch(Y){return console.warn("[TokenRefresh] failed to persist refreshed token",{connectionId:$.connectionId,message:Y instanceof Error?Y.message:String(Y)}),{accessToken:Q.accessToken,permanent:!1}}return{accessToken:Q.accessToken,permanent:!1}}function lx0($,Z){let Q=eE1.get($.connectionId);if(Q)return Q;let Y=Co.get($.connectionId);if(Y&&Date.now()<Y.nextAttemptAt)return Promise.resolve(null);let X=F05($,Z).then(({accessToken:J,permanent:G})=>{if(J||G)Co.delete($.connectionId);else{let W=Co.get($.connectionId)?.attempt??0,K=k7(H05,K05,W,2,0.5);Co.set($.connectionId,{attempt:W+1,nextAttemptAt:Date.now()+K})}return J}).finally(()=>{eE1.delete($.connectionId)});return eE1.set($.connectionId,X),X}async function RJ($){let{connectionId:Z,connectionUrl:Q,tokenStorage:Y,force:X}=$,J=await Y.get(Z);if(!J)return{state:"missing",accessToken:null};let G=gP(J),W=G?$.bufferMs??m40:0,K=Y.isExpired(J,W);if(!X&&!K)return{state:"valid",accessToken:J.accessToken,expiresAt:$P1(J)};if(!G){if(K)await Y.delete(Z);return{state:"expired_without_refresh",accessToken:null}}let H=J.tokenEndpoint;if(Q&&H&&W05(H,Q)){let N=await L2(Q);if(N)H=N}let F=await lx0({...J,tokenEndpoint:H},Y);if(!F)return{state:"refresh_failed",accessToken:null};let U=await Y.get(Z).catch(()=>null);return{state:"refreshed",accessToken:F,expiresAt:U?.accessToken===F?$P1(U):$P1(J)}}function $P1($){if(!$.expiresAt)return null;let Z=new Date($.expiresAt);return Number.isNaN(Z.getTime())?new Date:Z}var m40=300000,zT$=3300000,a7="GitHub token refresh failed \u2014 reconnect the mcp-github integration.",eE1,K05=30000,H05=300000,Co;var s3=L(()=>{p$();L3$();V70();eE1=new Map,Co=new Map});import{SpanStatusCode as sW8}from"@opentelemetry/api";function ZP1($){if(Array.isArray($))return $.map(ZP1);if($&&typeof $==="object"){let{__binding:Z,...Q}=$,Y={};for(let[X,J]of Object.entries(Q))Y[X]=ZP1(J);return Y}return $}function QP1($){for(let Z=0;Z<$.length;Z++){let Q=$.charCodeAt(Z);if(Q>255||Q===13||Q===10)return!1}return!0}function U05($){if(!$||Object.keys($).length===0)return null;let Z=JSON.stringify($);if(new TextEncoder().encode(Z).length>YP1)return null;return QP1(Z)?Z:null}function sF0($){if(!$)return{};let Z={};for(let[Q,Y]of Object.entries($)){let X=new TextEncoder().encode(Y).length;if(!QP1(Q)||X>YP1||!QP1(Y)||N05.has(Q.toLowerCase())){console.warn(`[Proxy] Dropping unsafe, oversized, or reserved custom header "${Q}"`);continue}Z[Q]=Y}return Z}async function rW8($,Z,Q){return Z.tracer.startActiveSpan("studio.connection.build_headers",{attributes:{"connection.id":$.id}},async(Y)=>{try{let X=await B05($,Z,Q);return Y.setStatus({code:sW8.OK}),X}catch(X){throw Y.setStatus({code:sW8.ERROR,message:X.message}),Y.recordException(X),X}finally{Y.end()}})}async function B05($,Z,Q){let Y=$.id,X=Z81($.configuration_state,$.configuration_scopes),J=Z.auth.user,G=J?.id??Z.auth.apiKey?.userId??(Q?$.created_by:void 0),[W,K]=G?await D$$({sub:G,user:{id:G,email:J?.email,name:J?.name,role:J?.role},metadata:{state:$.configuration_state?ZP1($.configuration_state):void 0,studioUrl:Z.baseUrl,meshUrl:Z.baseUrl,connectionId:Y,organizationId:Z.organization?.id,organizationName:Z.organization?.name,organizationSlug:Z.organization?.slug},permissions:X}).then((O)=>[O,null]).catch((O)=>[null,O]):[null,Error("User ID required to issue configuration token")];if(K)console.error("Failed to issue configuration token:",K);let H=Z.auth.user?.connectionId,F={...H?{"x-caller-id":H}:{},...Z.metadata.wellKnownForwardableHeaders??{},"x-request-id":Z.metadata.requestId},U=U05(Z.metadata.runMetadata);if(U)v01(F,"runMetadata",U);else if(Z.metadata.runMetadata&&Object.keys(Z.metadata.runMetadata).length>0)console.warn(`[Proxy] runMetadata for connection ${Y} exceeds ${YP1} bytes, dropping header`);let N=null;if(!!UZ($)?.sourceConnectionId)try{N=await u40(Z,$)}catch(O){console.error("[Proxy] repo-scoped legacy token mint failed",{connectionId:Y,error:O.message})}else{let O=new e5(Z.db,Z.vault),j=await RJ({connectionId:Y,connectionUrl:$.connection_url,tokenStorage:O});if(j.accessToken)N=j.accessToken;else if(j.state==="expired_without_refresh")console.warn(`[Proxy] Token expired for ${Y} with no refresh capability`)}if(!N&&$.connection_token)N=$.connection_token;if(N)F.Authorization=`Bearer ${N}`;if(W)v01(F,"token",W);return F}var YP1=8192,N05;var i41=L(()=>{Q81();tH();s3();xK();l40();vG();b01();N05=new Set(["authorization","x-caller-id","x-request-id",...Object.values(TK0),...Object.values(qK0)].map(($)=>$.toLowerCase()))});function Ef0(){let $=new Map;function Z(Y,X){let J=$.get(X);if(J)return J;let G=(async()=>{let W=await Y(),K=new u7({name:`outbound-client-${X}`,version:"1.0.0"},{capabilities:{tasks:{list:{},cancel:{},requests:{tool:{call:{}}}}},jsonSchemaValidator:SZ});K.onclose=()=>{$.delete(X)};try{await K.connect(W)}catch(H){throw await W.close?.().catch(()=>{}),H}return K})().catch((W)=>{throw $.delete(X),W});return $.set(X,G),G}return Object.assign(Z,{[Symbol.asyncDispose]:async()=>{let Y=[];for(let[X,J]of $)Y.push(J.then((G)=>G.close()).catch(()=>{}));await Promise.all(Y),$.clear()}})}var XP1=L(()=>{GN();NJ()});function aW8($){let Z=new e10({command:$.command,args:$.args,env:$.env,cwd:$.cwd,stderr:"pipe"}),Q=$.name||$.id,Y="\x1B[2m",X="\x1B[0m";return Z.stderr?.on("data",(J)=>{let G=J.toString().trimEnd();if(G)console.error(`${G} \x1B[2m[${Q}]\x1B[0m`)}),Z}var eW8=L(()=>{d41()});async function D05($,Z,Q){let Y=$.organization?.id;if(!$.boundAuth?.isApiKeyPrincipal||!Y||$.auth.permissionsOrganizationId!==Y)return!1;for(let[X,J]of Object.entries($.auth.permissions??{})){if(!J.includes("*")&&!J.includes(Q))continue;let G=await $.storage.virtualMcps.findById(X,Y);if(G?.organization_id!==Y||G.status!=="active")continue;let W=G.connections.find((K)=>K.connection_id===Z);if(W&&(W.selected_tools==null||W.selected_tools.includes(Q)))return!0}return!1}var Pf0;var $K8=L(()=>{TJ();JX();NJ();Pf0=class Pf0 extends Nd{options;constructor($,Z){super($);this.options=Z}toolsListPromise=null;fetchToolsFromServer(){if(!this.toolsListPromise)this.toolsListPromise=new Promise(($)=>{let Z=`auth-tools-${Date.now()}`,Q=this.innerTransport.onmessage,Y=(J)=>{clearTimeout(X),this.innerTransport.onmessage=Q,this.toolsListPromise=null,$(J)},X=setTimeout(()=>Y(null),qw);this.innerTransport.onmessage=(J)=>{if("id"in J&&J.id===Z)if("result"in J){let G=J.result?.tools??null;Y(G)}else Y(null);else Q?.(J)},this.innerTransport.send({jsonrpc:"2.0",id:Z,method:"tools/list",params:{}}).catch(()=>Y(null))});return this.toolsListPromise}async ensureToolsMap(){let $=this.options.cache??d9(),Z=await cN("tools",this.options.connection.id,async()=>{let Q=await this.fetchToolsFromServer();if(Q===null)throw Error("Failed to fetch tools list");return Q},$,(Q)=>this.options.ctx.pendingRevalidations.push(Q),mN);if(!Z)return new Map;return new Map(Z.map((Q)=>[Q.name,Q]))}async handleOutgoingMessage($){if(!this.isRequest($))return this.innerTransport.send($);let Z=$;if(Z.method==="tools/call")await this.authorizeToolCall(Z),this.stripMetaFromArguments(Z);return this.innerTransport.send($)}async authorizeToolCall($){if(this.options.superUser)return;let Q=$.params.name,{ctx:Y,connection:X}=this.options;if(await this.isPublicTool(Q))return;if(!Y.auth.user?.id&&!Y.auth.apiKey?.id)throw Error("Authentication required. Please provide a valid OAuth token or API key.");let J=async()=>{return(await this.ensureToolsMap()).get(Q)?._meta},G=new MT(Y.auth.user?.id??Y.auth.apiKey?.userId,Q,Y.boundAuth,Y.organization?.role??Y.auth.user?.role,X.id,J,Y.organization?.id,!1);try{await G.check(Q)}catch(W){if(W instanceof m6&&await D05(Y,X.id,Q))return;throw W}}async isPublicTool($){let Q=(await this.ensureToolsMap()).get($);if(!Q?._meta)return!1;return ZN(Q._meta)?.public_tool===!0}stripMetaFromArguments($){let Z=$.params;if(Z.arguments&&"_meta"in Z.arguments){let{_meta:Q,...Y}=Z.arguments;Z.arguments=Y}}}});function ZK8($){let{ctx:Z,organizationId:Q,connectionId:Y,toolName:X,durationMs:J,isError:G}=$;if(!Q||!Y||!X)return;let W={"tool.name":X,"organization.id":Q,"connection.id":Y,status:G?"error":"success","error.type":G?$.errorType||"Error":""};Z.meter.createHistogram("tool.execution.duration",{description:"Duration of tool executions in milliseconds",unit:"ms"}).record(J,W),Z.meter.createCounter("tool.execution.count",{description:"Number of tool executions"}).add(1,W)}function QK8($){if(!$||typeof $!=="object"||!$.isError)return;let Z=$.content;if(!Array.isArray(Z))return;for(let Q of Z)if(Q&&typeof Q==="object"&&"type"in Q&&Q.type==="text"&&"text"in Q&&typeof Q.text==="string")return Q.text;return}function YK8($){if(!$)return;let Z=$._meta;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z.properties;if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let Y={};for(let[X,J]of Object.entries(Q)){if(Object.keys(Y).length>=JP1)break;if(typeof J==="string"&&X.length<=I70&&J.length<=I70)Y[X]=J}return Object.keys(Y).length>0?Y:void 0}function XK8($,Z){if(!$&&!Z)return;if(!$)return Z;if(!Z)return $;return{...Z,...$}}var JK8=L(()=>{vF()});import{trace as L05,context as GK8}from"@opentelemetry/api";var O05=500,zf0;var WK8=L(()=>{NJ();ZL1();JK8();zf0=class zf0 extends Nd{options;inflightRequests=new Map;requestContext;constructor($,Z){super($);this.options=Z;this.requestContext=GK8.active()}async handleOutgoingMessage($){if(this.isRequest($)){let Z=$;this.onRequestStart(Z)}return this.innerTransport.send($)}handleIncomingMessage($){if(this.isResponse($)){let Z=$;this.onResponseEnd(Z)}this.onmessage?.($)}onRequestStart($){let{ctx:Z,connectionId:Q}=this.options,Y,X;if($.method==="tools/call"&&$.params){let G=$.params;Y=G.name,X=G.arguments}let J;if($.method==="tools/call"&&Y)J=Z.tracer.startSpan("mcp.proxy.callTool",{attributes:{"connection.id":Q,"tool.name":Y,"request.id":Z.metadata.requestId,"jsonrpc.id":$.id,"jsonrpc.method":$.method}},this.requestContext);if($.id!==null&&$.id!==void 0){if(!this.inflightRequests.has($.id)&&this.inflightRequests.size>=O05){let G=this.inflightRequests.keys().next().value;if(G!==void 0)this.inflightRequests.get(G)?.span?.end(),this.inflightRequests.delete(G)}this.inflightRequests.set($.id,{startTime:Date.now(),method:$.method,toolName:Y,toolArguments:X,span:J})}}onResponseEnd($){if($.id===null||$.id===void 0)return;let Z=this.inflightRequests.get($.id);if(!Z)return;let{ctx:Q,connectionId:Y}=this.options,{startTime:X,method:J,toolName:G,toolArguments:W,span:K}=Z,H=Date.now()-X;if(this.inflightRequests.delete($.id),J!=="tools/call"||!G)return;let F=Q.organization?.id??"",U="error"in $,N=U?$.error:$.result,B=U?{content:[{type:"text",text:$.error?.message||"Unknown error"}],isError:!0}:N,D=U||B?.isError===!0,O=U?$.error?.message:void 0,j=QK8(B)||null;if(Q.meter.createHistogram("connection.proxy.duration").record(H,{"connection.id":Y,"organization.id":F,"tool.name":G,status:D?"error":"success"}),D)Q.meter.createCounter("connection.proxy.errors").add(1,{"connection.id":Y,"organization.id":F,"tool.name":G,error:O??j??void 0});else Q.meter.createCounter("connection.proxy.requests").add(1,{"connection.id":Y,"organization.id":F,"tool.name":G,status:"success"});if(F)ZK8({ctx:Q,organizationId:F,connectionId:Y,toolName:G,durationMs:H,isError:D,errorType:U?"RemoteError":D?"ToolError":""});if(K){if(D)K.recordException(Error(O??j??"Tool error"));let w=YK8(W),E=XK8(Q.metadata.properties,w),P=L05.setSpan(GK8.active(),K);Gb0({organizationId:Q.organization?.id??"",connectionId:Y,toolName:G,toolArguments:W,result:B,duration:H,isError:D,errorMessage:j,userId:Q.auth.user?.id||Q.auth.apiKey?.userId||null,requestId:Q.metadata.requestId,userAgent:Q.metadata.userAgent||null,virtualMcpId:this.options.virtualMcpId||null,properties:E||null},P),K.end()}}async close(){for(let $ of this.inflightRequests.values())if($.span)$.span.setAttributes({"transport.closed":!0}),$.span.end();return this.inflightRequests.clear(),super.close()}}});var KK8=L(()=>{NJ();$K8();WK8()});function HK8($,Z){return MH0($,(Q)=>new Pf0(Q,{ctx:Z.ctx,connection:Z.connection,superUser:Z.superUser}),(Q)=>new zf0(Q,{ctx:Z.ctx,connectionId:Z.connectionId,virtualMcpId:Z.virtualMcpId}))}async function FK8($,Z,Q=!1){let Y=$.id,X=Z.connectionId&&Z.connectionId!==Y?Z.connectionId:void 0;switch($.connection_type){case"STDIO":{if(!B0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let J=$.connection_headers;if(!mU(J))throw Error("STDIO connection missing parameters");let G=aW8({id:Y,name:$.title,command:J.command,args:J.args,env:J.envVars,cwd:J.cwd});return G=HK8(G,{ctx:Z,connection:$,superUser:Q,connectionId:Y,virtualMcpId:X}),j05(()=>G,Y)}case"HTTP":case"Websocket":case"SSE":{if(!$.connection_url)throw Error(`${$.connection_type} connection missing URL`);let J=$.connection_url,G=$.connection_type==="SSE"?(W,K)=>new gT(W,{requestInit:{headers:K}}):(W,K)=>new WN(W,{requestInit:{headers:K}});return Z.getOrCreateClient(async()=>{let W=await rW8($,Z,Q),K=$.connection_headers;if(K&&"headers"in K)Object.assign(W,sF0(K.headers));let H=G(new URL(J),W);return H=HK8(H,{ctx:Z,connection:$,superUser:Q,connectionId:Y,virtualMcpId:X}),H},Y)}default:throw Error(`Unknown connection type: ${$.connection_type}`)}}var j05;var UK8=L(()=>{u1();dU();oH0();Md();i41();XP1();eW8();KK8();j05=Ef0()});var AT$={};O6(AT$,{clientFromConnection:()=>zY});async function zY($,Z,Q=!1){if($.connection_type==="VIRTUAL")return Wo$($,Z,Q);return FK8($,Z,Q)}var l80=L(()=>{UK8();Yt()});function GP1($){if($===null)return"null";if(Array.isArray($))return"array";return typeof $}function w05($,Z){if(Z==="integer")return typeof $==="number"&&Number.isInteger($);return GP1($)===Z}function E05($,Z){if(Z==="object"||Z==="array"){let Q;try{Q=JSON.parse($)}catch{return}return GP1(Q)===Z?Q:void 0}if(Z==="boolean"){if($==="true")return!0;if($==="false")return!1;return}if(Z==="number"||Z==="integer"){if($.trim()==="")return;let Q=Number($);if(!Number.isFinite(Q))return;if(Z==="integer"&&!Number.isInteger(Q))return;return Q}return}function NK8($,Z){if(!$?.properties||!Z)return null;let Q=!1,Y={...Z};for(let[X,J]of Object.entries(Z)){if(typeof J!=="string")continue;let G=$.properties[X]?.type;if(!G||G==="string")continue;let W=E05(J,G);if(W===void 0)continue;Y[X]=W,Q=!0}return Q?Y:null}function WP1($,Z,Q){let Y=Object.keys(Q??{}),X=Z?.required??[],J=X.filter((H)=>!Y.includes(H)),G=(H)=>{let F=Z?.properties?.[H]?.type;return F?`${H} (${F})`:H},W=Y.filter((H)=>{let F=Z?.properties?.[H]?.type;return F!=null&&!w05(Q?.[H],F)}).map((H)=>`${H} (expected ${Z?.properties?.[H]?.type}, got ${GP1(Q?.[H])})`);return[`Invalid arguments for "${$}".`,X.length?`Required: ${X.map(G).join(", ")}.`:"",`You sent: ${Y.length?Y.join(", "):"(none)"}.`,J.length?`Missing required: ${J.join(", ")}.`:"",W.length?`Wrong type: ${W.join(", ")}.`:""].filter(Boolean).join(" ")}function BK8($,Z,Q,Y){if(!($ instanceof x1)||$.code!==l1.InvalidParams)return $;if(!Z)return $;let X=WP1(Z,Q,Y),J=$.message.replace(/^MCP error -?\d+: /,"");return new x1(l1.InvalidParams,`${J}
+    `.execute($),X.push(H)}return X}async function uE1($,Z,Q,Y="user"){try{await $.addMember({body:{userId:Z,role:Y,organizationId:Q}})}catch(X){if(!Hz(X))throw X}}async function EW8($,Z){for(let Q=0;Q<LW8;Q++){let Y=Q===0?"":`-${Math.random().toString(36).slice(2,6)}`;try{return ke6(await $.createOrganization({body:{name:Z.name,slug:`${Z.baseSlug}${Y}`,userId:Z.userId}}))}catch(X){if(!Ce6(X)||Q===LW8-1)throw X}}throw Error("Failed to create organization")}var LW8=5,Ae6,Te6;var lE1=L(()=>{Df0();Ae6=["labs","agent","studio","workspace","systems","core","cloud","works"],Te6=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"]});import{APIError as _e6}from"better-auth/api";function PW8($,Z){if(typeof Z!=="string"||Z===$)return;throw new _e6("BAD_REQUEST",{message:"Organization slug cannot be changed after creation."})}var zW8=()=>{};var VW8={};O6(VW8,{resetPasswordEnabled:()=>jf0,grantDeploymentAdmin:()=>pE1,getTrustedOrigins:()=>wf0,authConfig:()=>_4,auth:()=>B4,GENERIC_EMAIL_DOMAINS:()=>pF});import{randomBytes as ve6}from"crypto";import{sso as be6}from"@better-auth/sso";import{organization as xe6}from"@decocms/better-auth/plugins";import{betterAuth as fe6}from"better-auth";import{admin as ye6,apiKey as ge6,jwt as he6,magicLink as ue6,mcp as le6,openAPI as me6}from"better-auth/plugins";import{emailOTP as ce6}from"better-auth/plugins/email-otp";import{APIError as dE1}from"better-auth/api";import{adminAc as de6,defaultRoles as ie6}from"better-auth/plugins/admin/access";import{defaultStatements as pe6}from"@decocms/better-auth/plugins/organization/access";import{createAccessControl as ne6}from"@decocms/better-auth/plugins/access";function AW8($){if(!Gj0($))return;throw new dE1("BAD_REQUEST",{message:`Organization slug "${String($).trim()}" is reserved by Studio`})}function pE1($){if(!mE1.includes($))mE1.push($)}function wf0(){let $=[q70];try{let Z=new URL(q70);if(Z.hostname==="localhost")$.push(q70.replace("localhost","127.0.0.1"));else if(Z.hostname==="127.0.0.1")$.push(q70.replace("127.0.0.1","localhost"))}catch{}return $}var qW8,te6,Of0,iE1,oe6,se6,re6,TW8,mE1,_4,RW8=void 0,cE1=void 0,jf0=!1,ae6,ee6,$05,q70,MW8,Z05,B4;var nK=L(()=>{u1();QE();R10();Q6();H9();S3();wH$();iT();PH$();QW8();GW8();WW8();XX();fE1();UW8();Df0();lE1();K31();zW8();qW8=Object.values(qT()).map(($)=>$.map((Z)=>Z.name)).flat(),te6={...pe6,self:["*",...qW8]},Of0=ne6(te6),iE1=bE1(qW8),oe6=Of0.newRole(iE1.user),se6=Of0.newRole(iE1.admin),re6=Of0.newRole(iE1.owner),TW8=Object.values(qT()).map(($)=>$.map((Z)=>`self:${Z.name}`)).flat(),mE1=[];_4=NF().auth;if(_4.inviteEmailProviderId&&_4.emailProviders&&_4.emailProviders.length>0){let $=v3(_4.emailProviders,_4.inviteEmailProviderId);if($){let Z=_3($);RW8=async(Q)=>{let Y=Q.inviter.user?.name||Q.inviter.user?.email,X=`${h9()}/auth/accept-invitation?invitationId=${Q.invitation.id}&redirectTo=/${Q.organization.slug}`;await Z({to:Q.email,subject:`You've been invited to join ${Q.organization.name}`,html:b3({preheader:`${Y} has invited you to join ${Q.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${Y}</strong> has invited you to join <strong>${Q.organization.name}</strong> on deco Studio.`,body:pT("Accept invitation",X),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(_4.resetPasswordEmailProviderId&&_4.emailProviders&&_4.emailProviders.length>0){let $=v3(_4.emailProviders,_4.resetPasswordEmailProviderId);if($){let Z=_3($);jf0=!0,cE1=async({user:Q,url:Y})=>{await Z({to:Q.email,subject:"Reset your password",html:b3({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:pT("Reset password",Y)+IF0("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}ae6=[xe6({...B0().plansEnabled&&{membershipLimit:Number.MAX_SAFE_INTEGER},organizationCreation:{afterCreate:async($)=>{await ZW8($.organization.id,$.member.userId)}},organizationHooks:{beforeCreateOrganization:async({organization:$})=>{if(AW8($.slug),$.slug&&await VF0(E8().db,$.slug))throw new dE1("BAD_REQUEST",{message:"Organization slug is already taken."})},beforeUpdateOrganization:async({organization:$,member:Z})=>{if(AW8($.slug),typeof $.slug==="string"){let X=await E8().db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(X)PW8(X.slug,$.slug)}let Q=$.logo;if(typeof Q!=="string"||!Q.startsWith("data:"))return;let Y=await JW8(Z.organizationId,Q);if(Y===Q)return;return{data:{...$,logo:Y}}}},ac:Of0,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:b00,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:oe6,admin:se6,owner:re6},sendInvitationEmail:RW8,invitationExpiresIn:604800}),le6({loginPage:"/login",oidcConfig:{scopes:TW8,metadata:{scopes_supported:TW8},loginPage:"/login"}}),ge6({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Q=$.headers?.get("Authorization");if(Q?.startsWith("Bearer "))return Q.replace("Bearer ","").trim();return null},rateLimit:{enabled:!1}}),ye6({defaultRole:"user",adminRoles:["admin","owner"],roles:{...ie6,owner:de6},adminUserIds:mE1}),me6(),he6({jwt:{expirationTime:"5m",definePayload:({user:$})=>({id:$.id,email:$.email,name:$.name,role:$.role})}}),be6(_4.ssoConfig?FW8(_4.ssoConfig):void 0),..._4.magicLinkConfig?.enabled&&_4.emailProviders&&_4.emailProviders.length>0?[ue6(EH$(_4.magicLinkConfig,_4.emailProviders))]:[],..._4.emailOtpConfig?.enabled&&_4.emailProviders&&_4.emailProviders.length>0?[ce6(jH$(_4.emailOtpConfig,_4.emailProviders))]:[]],ee6=y10(),$05=BH$(ee6),q70=h9();MW8=B0(),Z05=MW8.betterAuthSecret||(()=>{return console.warn("BETTER_AUTH_SECRET not set - generating a random secret (not persistent across restarts)"),ve6(32).toString("base64")})(),B4=fe6({secret:Z05,logger:{log:($,Z,...Q)=>{if($==="error"&&Z.includes("validate API key"))return;if($==="error"&&Q.some((X)=>{let J=X?.statusCode;return typeof J==="number"&&J>=300&&J<400}))return;let Y=`${new Date().toISOString()} ${$.toUpperCase()} [Better Auth]: ${Z}`;if($==="error")console.error(Y,...Q);else if($==="warn")console.warn(Y,...Q);else console.log(Y,...Q)}},baseURL:q70,trustedOrigins:wf0(),database:$05,advanced:{database:{defaultFindManyLimit:500}},socialProviders:_4.socialProviders,..._4.ssoConfig&&{account:{accountLinking:{trustedProviders:[_4.ssoConfig.providerId]}}},emailAndPassword:{enabled:_4.emailAndPassword.enabled,...cE1&&{sendResetPassword:cE1}},rateLimit:{enabled:!MW8.disableRateLimit,window:60,max:1e4},plugins:ae6,databaseHooks:{user:{create:{before:async($)=>{let Z=$.name;if(typeof Z==="string"&&Z.trim().length>0)return;let Q=BW8($.email);if(!Q)return;return{data:{...$,name:Q}}},after:async($,Z)=>{_E1({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified});let Q=Z?.getCookie("studio_signup_ref")??null,Y=Z?.getCookie("studio_signup_src")??null;m1.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name,...Q?{signup_ref:Q}:{},...Y?{signup_src:Y}:{}}});let X=NF().autoCreateOrganizationOnSignup!==!1;try{let J=await Lf0({db:E8().db,authApi:B4.api,user:{id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified},allowCreate:X,createdVia:"signup"});if(J.status==="created")m1.groupIdentify({groupType:"organization",groupKey:J.organization.id,properties:{name:J.organization.name,slug:J.organization.slug,created_at:new Date().toISOString(),created_via:J.createdVia,email_domain:J.domain}}),m1.capture({distinctId:$.id,event:"organization_created",groups:{organization:J.organization.id},properties:{organization_id:J.organization.id,organization_slug:J.organization.slug,name:J.organization.name,created_via:J.createdVia,email_domain:J.domain}});if(J.status==="joined_via_invitation")for(let G of J.organizations)m1.capture({distinctId:$.id,event:"organization_invitation_auto_accepted",groups:{organization:G.id},properties:{organization_id:G.id,organization_slug:G.slug,email_domain:J.domain,joined_via:J.createdVia,invitation_count:J.organizations.length}});if(J.status==="joined")m1.capture({distinctId:$.id,event:"organization_domain_joined",groups:{organization:J.organization.id},properties:{organization_id:J.organization.id,organization_slug:J.organization.slug,email_domain:J.domain,joined_via:J.createdVia}})}catch(J){m1.captureException(J,$.id),console.error("Failed to ensure organization on signup:",J)}}},update:{before:async($)=>{let Z=$.image;if(typeof Z==="string"&&Z.startsWith("data:"))throw new dE1("BAD_REQUEST",{message:"Inline image data is not accepted. Upload the avatar to /api/_users/avatar and set `image` to the returned URL."})}}},session:{create:{after:async($)=>{let Z=await E8().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!Z)return;_E1({id:Z.id,email:Z.email,name:Z.name??null,emailVerified:!!Z.emailVerified})}}}}})});function tE1($){return $?`/api/${$}`:""}function IW8($){let Q=new URL($).pathname;if(Q.endsWith("/"))Q=Q.slice(0,-1);let Y=(X)=>{let J=new URL($);return J.pathname=X,J.toString()};return[Y(`${Q}/.well-known/oauth-protected-resource`),Y(`/.well-known/oauth-protected-resource${Q}`),Y("/.well-known/oauth-protected-resource")]}function kW8($){let Q=new URL($).pathname;if(Q.endsWith("/"))Q=Q.slice(0,-1);let Y=Q!==""&&Q!=="/",X=(J)=>{let G=new URL($);return G.pathname=J,G.toString()};if(Y)return[X(`/.well-known/oauth-authorization-server${Q}`),X(`/.well-known/openid-configuration${Q}`),X(`${Q}/.well-known/openid-configuration`)];return[X("/.well-known/oauth-authorization-server"),X("/.well-known/openid-configuration")]}function CW8($){return"issuer"in $&&!("resource"in $)&&(("authorization_endpoint"in $)||("token_endpoint"in $))}function SW8($){let Z=$.toLowerCase();return Z.includes("resource_metadata=")||Z.includes("invalid_token")||Z.includes("oauth")}function _W8($){let Z=$.message?.toLowerCase()??"";return $.status===401||$.code===401||($.message?.includes("401")??!1)||Z.includes("unauthorized")||Z.includes("invalid_token")||Z.includes("api key required")||Z.includes("api-key required")}function vW8($,{proxyResourceUrl:Z,proxyAuthServer:Q}){return{...$,resource:Z,authorization_servers:[Q]}}function oE1({proxyResourceUrl:$,proxyAuthServer:Z,scopesSupported:Q=["*"]}){return{resource:$,authorization_servers:[Z],bearer_methods_supported:["header"],scopes_supported:Q}}function bW8($){return"scopes_supported"in $&&Array.isArray($.scopes_supported)&&$.scopes_supported.length>0?$.scopes_supported:["*"]}function xW8($,Z){return{...$,authorization_endpoint:$.authorization_endpoint?`${Z}/authorize`:void 0,token_endpoint:$.token_endpoint?`${Z}/token`:void 0,registration_endpoint:$.registration_endpoint?`${Z}/register`:void 0}}function fW8({origin:$,prefix:Z,connectionId:Q}){return`Bearer realm="mcp",resource_metadata="${$}${Z}/mcp/${Q}/.well-known/oauth-protected-resource"`}var nE1;var yW8=L(()=>{nE1=[404,401,406]});import{oAuthProtectedResourceMetadata as Q05}from"better-auth/plugins";async function Y05($,Z,Q){return(await Z.storage.connections.findById($,Q))?.connection_url??null}async function uW8($,Z={}){try{let Q=await aE1($,{method:"POST",headers:{...Z,"Content-Type":"application/json",Accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:0,method:"initialize",params:{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"mcp-cms-proxy",version:"1.0.0"}}})});if(Q.status===401){let Y=Q.headers.get("WWW-Authenticate");if(Y&&SW8(Y))return await ku(Q),Y;if(await ku(Q),await X05($))return'Bearer realm="mcp"';return null}return await ku(Q),null}catch{return null}}async function X05($){try{let Z=new URL($),Q=new URL("/.well-known/oauth-authorization-server",Z.origin),Y=await aE1(Q.toString(),{method:"GET",headers:{Accept:"application/json"}});if(Y.ok){let X=await Y.json();if(X.authorization_endpoint||X.token_endpoint||X.issuer)return!0;return!1}return await ku(Y),!1}catch{return!1}}async function ko($){let Z=IW8($),Q;for(let Y=0;Y<Z.length;Y++){if(Q=await pW8(Z[Y],{method:"GET",headers:{Accept:"application/json"}}),Q.ok)return Q;if(Y<Z.length-1&&!nE1.includes(Q.status))return Q;if(Y<Z.length-1)await ku(Q)}return Q}function rE1($){let Z=typeof $==="object"&&$!==null?$.authorization_servers:void 0,Q=Array.isArray(Z)?Z[0]:void 0;return typeof Q==="string"?Q:void 0}async function J05($){let Z;try{Z=new URL($).origin}catch{return null}try{let Q=await ko($);if(Q.ok){let Y=rE1(await Q.json());if(Y)return Y}}catch{}return Z}async function lW8($){let Z=$.get("studioContext");if(!Z)Z=await xY.create($.req.raw),$.set("studioContext",Z);return Z}async function Hj1({error:$,reqUrl:Z,connectionId:Q,connectionUrl:Y,headers:X,orgSlug:J}){if(!_W8($))return null;if(Boolean(await uW8(Y,X)))return new Response(null,{status:401,headers:{"WWW-Authenticate":fW8({origin:Z.origin,prefix:tE1(J),connectionId:Q})}});return new Response(JSON.stringify({error:"unauthorized",message:"Authentication required but server does not support OAuth"}),{status:401,headers:{"Content-Type":"application/json"}})}function gW8($){let Y=$.pathname;if(Y.endsWith("/.well-known/oauth-protected-resource"))Y=Y.slice(0,-37)||"/";else if(Y.startsWith("/.well-known/oauth-protected-resource"))Y=Y.slice(37)||"/";return`${$.origin}${Y}`}async function hW8($,Z){let Q=await Q05(B4)($),Y=await Q.json();if(Z)Y.resource=Z;return Response.json(Y,Q)}function aE1($,Z,Q=iW8){return tD()($,{...Z,signal:AbortSignal.timeout(Q)})}class sE1{response;constructor($){this.response=$}}async function ku($){await $.text().catch(()=>{})}async function pW8($,Z,{attempts:Q=3,timeoutMs:Y=iW8}={}){let X=0;try{return await e$(async()=>{X++;let J=await aE1($,Z,Y);if(J.status>=500){if(X<Q)await ku(J);throw new sE1(J)}return J},{maxAttempts:Q,minTimeout:150,multiplier:2,jitter:0})}catch(J){if(J instanceof e6){if(J.cause instanceof sE1)return J.cause.response;throw J.cause}throw J}}function nW8($){if(!YW0($))return null;return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}})}async function M70($){if(YW0($))return new Response(JSON.stringify({error:"URLs targeting private networks are not allowed"}),{status:502,headers:{"Content-Type":"application/json"}});let Z=kW8($),Q=null;for(let Y=0;Y<Z.length;Y++){if(Q=await pW8(Z[Y],{method:"GET",headers:{Accept:"application/json"}}),Q.ok)return Q;if(Q.status!==404&&Q.status!==401)return Q;if(Y<Z.length-1)await ku(Q)}return Q}var mW8=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $},R70=async($)=>{let Z=$.req.param("connectionId"),Q=await lW8($),Y=mW8(new URL($.req.url)),X=$.req.param("org")??Q.organization?.slug,J;if(X)if(Q.organization?.id&&Q.organization.slug===X)J=Q.organization.id;else{let F=await Q.db.selectFrom("organization").select("id").where("slug","=",X).executeTakeFirst();if(!F)return $.json({error:"Connection not found"},404);J=F.id}if(J&&Q.auth?.tokenOrganizationId&&Q.auth.tokenOrganizationId!==J)return $.json({error:"forbidden: token is scoped to another organization"},403);if(Z==="self")return hW8($.req.raw,gW8(Y));let G=await Y05(Z,Q,J);if(!G)return $.json({error:"Connection not found"},404);if(G.startsWith("virtual://"))return hW8($.req.raw,gW8(Y));let W=tE1(X),K=`${Y.origin}${W}/mcp/${Z}`,H=`${Y.origin}/oauth-proxy/${Z}`;try{let F=await ko(G);if(!F.ok&&nE1.includes(F.status)){if(await uW8(G)){let D=oE1({proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(D),{status:200,headers:{"Content-Type":"application/json"}})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}if(!F.ok)return new Response(F.body,{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}});let U=await F.json();if(CW8(U)){let B=oE1({proxyResourceUrl:K,proxyAuthServer:H,scopesSupported:bW8(U)});return new Response(JSON.stringify(B),{status:200,headers:{"Content-Type":"application/json"}})}let N=vW8(U,{proxyResourceUrl:K,proxyAuthServer:H});return new Response(JSON.stringify(N),{status:F.status,statusText:F.statusText,headers:{"Content-Type":"application/json"}})}catch(F){let U=F;return console.error("[oauth-proxy] Failed to proxy OAuth protected resource metadata:",U),$.json({error:"Failed to proxy OAuth metadata",message:U.message},502)}},cW8=()=>{let $=new Z1;return $.get("/.well-known/oauth-protected-resource/mcp/:connectionId",(Z)=>R70(Z)),$.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>R70(Z)),$},dW8=()=>{let $=new Z1;return $.get("/mcp/:connectionId/.well-known/oauth-protected-resource",(Z)=>R70(Z)),$},iW8=4000,G05=async($)=>{let Z=$.req.param("connectionId"),Q=await lW8($),Y=await Q.storage.connections.findById(Z);if(!Y?.connection_url)return $.json({error:"Connection not found or no auth server"},404);let X=await J05(Y.connection_url);if(!X)return $.json({error:"Connection not found or no auth server"},404);let J=await Q.db.selectFrom("organization").select("slug").where("id","=",Y.organization_id).executeTakeFirst();try{let G=await M70(X);if(!G.ok)return new Response(G.body,{status:G.status,statusText:G.statusText,headers:{"Content-Type":"application/json"}});let W=await G.json(),K=mW8(new URL($.req.url)),H=J?.slug?`${K.origin}/api/${J.slug}/oauth-proxy/${Z}`:`${K.origin}/oauth-proxy/${Z}`,F=xW8(W,H);return new Response(JSON.stringify(F),{status:200,headers:{"Content-Type":"application/json"}})}catch(G){let W=G;return console.error("[oauth-proxy] Failed to proxy auth server metadata:",W),$.json({error:"Failed to proxy auth server metadata",message:W.message},502)}},tW8=()=>{let $=new Z1;return $.get("/.well-known/oauth-authorization-server/oauth-proxy/:connectionId",G05),$};var $70=L(()=>{H8();vF();nK();p$();um();yW8()});async function oW8($){try{await $.body?.cancel()}catch{}}async function L2($){try{let Z;try{let Y=await ko($);if(Y.ok)Z=(await Y.json()).authorization_servers?.[0];else await oW8(Y)}catch{}if(!Z)Z=new URL($).origin;let Q=await M70(Z);if(Q.ok){let Y=await Q.json();if(typeof Y.token_endpoint==="string")try{let X=new URL(Y.token_endpoint);if((X.protocol==="http:"||X.protocol==="https:")&&!await Aw(Y.token_endpoint))return Y.token_endpoint}catch{}}else await oW8(Q);return null}catch{return null}}var V70=L(()=>{$70();um()});function gP($){return!!$.refreshToken&&!!$.tokenEndpoint&&!!$.clientId}function W05($,Z){if($.includes("/oauth-proxy/"))return!0;try{return new URL($).host!==new URL(Z).host}catch{return!1}}function p2$($){if($)Co.delete($);else Co.clear()}async function F05($,Z){let Q=await D3$($);if(!Q.success||!Q.accessToken){if(Q.permanent===!0)await Z.delete($.connectionId).catch((Y)=>{console.warn("[TokenRefresh] failed to delete dead token row",{connectionId:$.connectionId,message:Y instanceof Error?Y.message:String(Y)})});return{accessToken:null,permanent:Q.permanent===!0}}try{await Z.upsert({connectionId:$.connectionId,accessToken:Q.accessToken,refreshToken:Q.refreshToken??$.refreshToken,scope:Q.scope??$.scope,expiresAt:Q.expiresIn!==void 0?new Date(Date.now()+Q.expiresIn*1000):Q.expiresInMalformed?new Date:null,clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint})}catch(Y){return console.warn("[TokenRefresh] failed to persist refreshed token",{connectionId:$.connectionId,message:Y instanceof Error?Y.message:String(Y)}),{accessToken:Q.accessToken,permanent:!1}}return{accessToken:Q.accessToken,permanent:!1}}function lx0($,Z){let Q=eE1.get($.connectionId);if(Q)return Q;let Y=Co.get($.connectionId);if(Y&&Date.now()<Y.nextAttemptAt)return Promise.resolve(null);let X=F05($,Z).then(({accessToken:J,permanent:G})=>{if(J||G)Co.delete($.connectionId);else{let W=Co.get($.connectionId)?.attempt??0,K=k7(H05,K05,W,2,0.5);Co.set($.connectionId,{attempt:W+1,nextAttemptAt:Date.now()+K})}return J}).finally(()=>{eE1.delete($.connectionId)});return eE1.set($.connectionId,X),X}async function RJ($){let{connectionId:Z,connectionUrl:Q,tokenStorage:Y,force:X}=$,J=await Y.get(Z);if(!J)return{state:"missing",accessToken:null};let G=gP(J),W=G?$.bufferMs??m40:0,K=Y.isExpired(J,W);if(!X&&!K)return{state:"valid",accessToken:J.accessToken,expiresAt:$P1(J)};if(!G){if(K)await Y.delete(Z);return{state:"expired_without_refresh",accessToken:null}}let H=J.tokenEndpoint;if(Q&&H&&W05(H,Q)){let N=await L2(Q);if(N)H=N}let F=await lx0({...J,tokenEndpoint:H},Y);if(!F)return{state:"refresh_failed",accessToken:null};let U=await Y.get(Z).catch(()=>null);return{state:"refreshed",accessToken:F,expiresAt:U?.accessToken===F?$P1(U):$P1(J)}}function $P1($){if(!$.expiresAt)return null;let Z=new Date($.expiresAt);return Number.isNaN(Z.getTime())?new Date:Z}var m40=300000,zT$=3300000,a7="GitHub token refresh failed \u2014 reconnect the mcp-github integration.",eE1,K05=30000,H05=300000,Co;var s3=L(()=>{p$();L3$();V70();eE1=new Map,Co=new Map});import{SpanStatusCode as sW8}from"@opentelemetry/api";function ZP1($){if(Array.isArray($))return $.map(ZP1);if($&&typeof $==="object"){let{__binding:Z,...Q}=$,Y={};for(let[X,J]of Object.entries(Q))Y[X]=ZP1(J);return Y}return $}function QP1($){for(let Z=0;Z<$.length;Z++){let Q=$.charCodeAt(Z);if(Q>255||Q===13||Q===10)return!1}return!0}function U05($){if(!$||Object.keys($).length===0)return null;let Z=JSON.stringify($);if(new TextEncoder().encode(Z).length>YP1)return null;return QP1(Z)?Z:null}function sF0($){if(!$)return{};let Z={};for(let[Q,Y]of Object.entries($)){let X=new TextEncoder().encode(Y).length;if(!QP1(Q)||X>YP1||!QP1(Y)||N05.has(Q.toLowerCase())){console.warn(`[Proxy] Dropping unsafe, oversized, or reserved custom header "${Q}"`);continue}Z[Q]=Y}return Z}async function rW8($,Z,Q){return Z.tracer.startActiveSpan("studio.connection.build_headers",{attributes:{"connection.id":$.id}},async(Y)=>{try{let X=await B05($,Z,Q);return Y.setStatus({code:sW8.OK}),X}catch(X){throw Y.setStatus({code:sW8.ERROR,message:X.message}),Y.recordException(X),X}finally{Y.end()}})}async function B05($,Z,Q){let Y=$.id,X=Z81($.configuration_state,$.configuration_scopes),J=Z.auth.user,G=J?.id??Z.auth.apiKey?.userId??(Q?$.created_by:void 0),[W,K]=G?await D$$({sub:G,user:{id:G,email:J?.email,name:J?.name,role:J?.role},metadata:{state:$.configuration_state?ZP1($.configuration_state):void 0,studioUrl:Z.baseUrl,meshUrl:Z.baseUrl,connectionId:Y,organizationId:Z.organization?.id,organizationName:Z.organization?.name,organizationSlug:Z.organization?.slug},permissions:X}).then((O)=>[O,null]).catch((O)=>[null,O]):[null,Error("User ID required to issue configuration token")];if(K)console.error("Failed to issue configuration token:",K);let H=Z.auth.user?.connectionId,F={...H?{"x-caller-id":H}:{},...Z.metadata.wellKnownForwardableHeaders??{},"x-request-id":Z.metadata.requestId},U=U05(Z.metadata.runMetadata);if(U)v01(F,"runMetadata",U);else if(Z.metadata.runMetadata&&Object.keys(Z.metadata.runMetadata).length>0)console.warn(`[Proxy] runMetadata for connection ${Y} exceeds ${YP1} bytes, dropping header`);let N=null;if(!!UZ($)?.sourceConnectionId)try{N=await u40(Z,$)}catch(O){console.error("[Proxy] repo-scoped legacy token mint failed",{connectionId:Y,error:O.message})}else{let O=new e5(Z.db,Z.vault),j=await RJ({connectionId:Y,connectionUrl:$.connection_url,tokenStorage:O});if(j.accessToken)N=j.accessToken;else if(j.state==="expired_without_refresh")console.warn(`[Proxy] Token expired for ${Y} with no refresh capability`)}if(!N&&$.connection_token)N=$.connection_token;if(N)F.Authorization=`Bearer ${N}`;if(W)v01(F,"token",W);return F}var YP1=8192,N05;var i41=L(()=>{Q81();tH();s3();xK();l40();vG();b01();N05=new Set(["authorization","x-caller-id","x-request-id",...Object.values(TK0),...Object.values(qK0)].map(($)=>$.toLowerCase()))});function Ef0(){let $=new Map;function Z(Y,X){let J=$.get(X);if(J)return J;let G=(async()=>{let W=await Y(),K=new u7({name:`outbound-client-${X}`,version:"1.0.0"},{capabilities:{tasks:{list:{},cancel:{},requests:{tool:{call:{}}}}},jsonSchemaValidator:SZ});K.onclose=()=>{$.delete(X)};try{await K.connect(W)}catch(H){throw await W.close?.().catch(()=>{}),H}return K})().catch((W)=>{throw $.delete(X),W});return $.set(X,G),G}return Object.assign(Z,{[Symbol.asyncDispose]:async()=>{let Y=[];for(let[X,J]of $)Y.push(J.then((G)=>G.close()).catch(()=>{}));await Promise.all(Y),$.clear()}})}var XP1=L(()=>{GN();NJ()});function aW8($){let Z=new e10({command:$.command,args:$.args,env:$.env,cwd:$.cwd,stderr:"pipe"}),Q=$.name||$.id,Y="\x1B[2m",X="\x1B[0m";return Z.stderr?.on("data",(J)=>{let G=J.toString().trimEnd();if(G)console.error(`${G} \x1B[2m[${Q}]\x1B[0m`)}),Z}var eW8=L(()=>{d41()});async function D05($,Z,Q){let Y=$.organization?.id;if(!$.boundAuth?.isApiKeyPrincipal||!Y||$.auth.permissionsOrganizationId!==Y)return!1;for(let[X,J]of Object.entries($.auth.permissions??{})){if(!J.includes("*")&&!J.includes(Q))continue;let G=await $.storage.virtualMcps.findById(X,Y);if(G?.organization_id!==Y||G.status!=="active")continue;let W=G.connections.find((K)=>K.connection_id===Z);if(W&&(W.selected_tools==null||W.selected_tools.includes(Q)))return!0}return!1}var Pf0;var $K8=L(()=>{TJ();JX();NJ();Pf0=class Pf0 extends Nd{options;constructor($,Z){super($);this.options=Z}toolsListPromise=null;fetchToolsFromServer(){if(!this.toolsListPromise)this.toolsListPromise=new Promise(($)=>{let Z=`auth-tools-${Date.now()}`,Q=this.innerTransport.onmessage,Y=(J)=>{clearTimeout(X),this.innerTransport.onmessage=Q,this.toolsListPromise=null,$(J)},X=setTimeout(()=>Y(null),qw);this.innerTransport.onmessage=(J)=>{if("id"in J&&J.id===Z)if("result"in J){let G=J.result?.tools??null;Y(G)}else Y(null);else Q?.(J)},this.innerTransport.send({jsonrpc:"2.0",id:Z,method:"tools/list",params:{}}).catch(()=>Y(null))});return this.toolsListPromise}async ensureToolsMap(){let $=this.options.cache??d9(),Z=await cN("tools",this.options.connection.id,async()=>{let Q=await this.fetchToolsFromServer();if(Q===null)throw Error("Failed to fetch tools list");return Q},$,(Q)=>this.options.ctx.pendingRevalidations.push(Q),mN);if(!Z)return new Map;return new Map(Z.map((Q)=>[Q.name,Q]))}async handleOutgoingMessage($){if(!this.isRequest($))return this.innerTransport.send($);let Z=$;if(Z.method==="tools/call")await this.authorizeToolCall(Z),this.stripMetaFromArguments(Z);return this.innerTransport.send($)}async authorizeToolCall($){if(this.options.superUser)return;let Q=$.params.name,{ctx:Y,connection:X}=this.options;if(await this.isPublicTool(Q))return;if(!Y.auth.user?.id&&!Y.auth.apiKey?.id)throw Error("Authentication required. Please provide a valid OAuth token or API key.");let J=async()=>{return(await this.ensureToolsMap()).get(Q)?._meta},G=new MT(Y.auth.user?.id??Y.auth.apiKey?.userId,Q,Y.boundAuth,Y.organization?.role??Y.auth.user?.role,X.id,J,Y.organization?.id,!1);try{await G.check(Q)}catch(W){if(W instanceof m6&&await D05(Y,X.id,Q))return;throw W}}async isPublicTool($){let Q=(await this.ensureToolsMap()).get($);if(!Q?._meta)return!1;return ZN(Q._meta)?.public_tool===!0}stripMetaFromArguments($){let Z=$.params;if(Z.arguments&&"_meta"in Z.arguments){let{_meta:Q,...Y}=Z.arguments;Z.arguments=Y}}}});function ZK8($){let{ctx:Z,organizationId:Q,connectionId:Y,toolName:X,durationMs:J,isError:G}=$;if(!Q||!Y||!X)return;let W={"tool.name":X,"organization.id":Q,"connection.id":Y,status:G?"error":"success","error.type":G?$.errorType||"Error":""};Z.meter.createHistogram("tool.execution.duration",{description:"Duration of tool executions in milliseconds",unit:"ms"}).record(J,W),Z.meter.createCounter("tool.execution.count",{description:"Number of tool executions"}).add(1,W)}function QK8($){if(!$||typeof $!=="object"||!$.isError)return;let Z=$.content;if(!Array.isArray(Z))return;for(let Q of Z)if(Q&&typeof Q==="object"&&"type"in Q&&Q.type==="text"&&"text"in Q&&typeof Q.text==="string")return Q.text;return}function YK8($){if(!$)return;let Z=$._meta;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z.properties;if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let Y={};for(let[X,J]of Object.entries(Q)){if(Object.keys(Y).length>=JP1)break;if(typeof J==="string"&&X.length<=I70&&J.length<=I70)Y[X]=J}return Object.keys(Y).length>0?Y:void 0}function XK8($,Z){if(!$&&!Z)return;if(!$)return Z;if(!Z)return $;return{...Z,...$}}var JK8=L(()=>{vF()});import{trace as L05,context as GK8}from"@opentelemetry/api";var O05=500,zf0;var WK8=L(()=>{NJ();ZL1();JK8();zf0=class zf0 extends Nd{options;inflightRequests=new Map;requestContext;constructor($,Z){super($);this.options=Z;this.requestContext=GK8.active()}async handleOutgoingMessage($){if(this.isRequest($)){let Z=$;this.onRequestStart(Z)}return this.innerTransport.send($)}handleIncomingMessage($){if(this.isResponse($)){let Z=$;this.onResponseEnd(Z)}this.onmessage?.($)}onRequestStart($){let{ctx:Z,connectionId:Q}=this.options,Y,X;if($.method==="tools/call"&&$.params){let G=$.params;Y=G.name,X=G.arguments}let J;if($.method==="tools/call"&&Y)J=Z.tracer.startSpan("mcp.proxy.callTool",{attributes:{"connection.id":Q,"tool.name":Y,"request.id":Z.metadata.requestId,"jsonrpc.id":$.id,"jsonrpc.method":$.method}},this.requestContext);if($.id!==null&&$.id!==void 0){if(!this.inflightRequests.has($.id)&&this.inflightRequests.size>=O05){let G=this.inflightRequests.keys().next().value;if(G!==void 0)this.inflightRequests.get(G)?.span?.end(),this.inflightRequests.delete(G)}this.inflightRequests.set($.id,{startTime:Date.now(),method:$.method,toolName:Y,toolArguments:X,span:J})}}onResponseEnd($){if($.id===null||$.id===void 0)return;let Z=this.inflightRequests.get($.id);if(!Z)return;let{ctx:Q,connectionId:Y}=this.options,{startTime:X,method:J,toolName:G,toolArguments:W,span:K}=Z,H=Date.now()-X;if(this.inflightRequests.delete($.id),J!=="tools/call"||!G)return;let F=Q.organization?.id??"",U="error"in $,N=U?$.error:$.result,B=U?{content:[{type:"text",text:$.error?.message||"Unknown error"}],isError:!0}:N,D=U||B?.isError===!0,O=U?$.error?.message:void 0,j=QK8(B)||null;if(Q.meter.createHistogram("connection.proxy.duration").record(H,{"connection.id":Y,"organization.id":F,"tool.name":G,status:D?"error":"success"}),D)Q.meter.createCounter("connection.proxy.errors").add(1,{"connection.id":Y,"organization.id":F,"tool.name":G,error:O??j??void 0});else Q.meter.createCounter("connection.proxy.requests").add(1,{"connection.id":Y,"organization.id":F,"tool.name":G,status:"success"});if(F)ZK8({ctx:Q,organizationId:F,connectionId:Y,toolName:G,durationMs:H,isError:D,errorType:U?"RemoteError":D?"ToolError":""});if(K){if(D)K.recordException(Error(O??j??"Tool error"));let w=YK8(W),E=XK8(Q.metadata.properties,w),P=L05.setSpan(GK8.active(),K);Gb0({organizationId:Q.organization?.id??"",connectionId:Y,toolName:G,toolArguments:W,result:B,duration:H,isError:D,errorMessage:j,userId:Q.auth.user?.id||Q.auth.apiKey?.userId||null,requestId:Q.metadata.requestId,userAgent:Q.metadata.userAgent||null,virtualMcpId:this.options.virtualMcpId||null,properties:E||null},P),K.end()}}async close(){for(let $ of this.inflightRequests.values())if($.span)$.span.setAttributes({"transport.closed":!0}),$.span.end();return this.inflightRequests.clear(),super.close()}}});var KK8=L(()=>{NJ();$K8();WK8()});function HK8($,Z){return MH0($,(Q)=>new Pf0(Q,{ctx:Z.ctx,connection:Z.connection,superUser:Z.superUser}),(Q)=>new zf0(Q,{ctx:Z.ctx,connectionId:Z.connectionId,virtualMcpId:Z.virtualMcpId}))}async function FK8($,Z,Q=!1){let Y=$.id,X=Z.connectionId&&Z.connectionId!==Y?Z.connectionId:void 0;switch($.connection_type){case"STDIO":{if(!B0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let J=$.connection_headers;if(!mU(J))throw Error("STDIO connection missing parameters");let G=aW8({id:Y,name:$.title,command:J.command,args:J.args,env:J.envVars,cwd:J.cwd});return G=HK8(G,{ctx:Z,connection:$,superUser:Q,connectionId:Y,virtualMcpId:X}),j05(()=>G,Y)}case"HTTP":case"Websocket":case"SSE":{if(!$.connection_url)throw Error(`${$.connection_type} connection missing URL`);let J=$.connection_url,G=$.connection_type==="SSE"?(W,K)=>new gT(W,{requestInit:{headers:K}}):(W,K)=>new WN(W,{requestInit:{headers:K}});return Z.getOrCreateClient(async()=>{let W=await rW8($,Z,Q),K=$.connection_headers;if(K&&"headers"in K)Object.assign(W,sF0(K.headers));let H=G(new URL(J),W);return H=HK8(H,{ctx:Z,connection:$,superUser:Q,connectionId:Y,virtualMcpId:X}),H},Y)}default:throw Error(`Unknown connection type: ${$.connection_type}`)}}var j05;var UK8=L(()=>{u1();dU();oH0();Md();i41();XP1();eW8();KK8();j05=Ef0()});var AT$={};O6(AT$,{clientFromConnection:()=>zY});async function zY($,Z,Q=!1){if($.connection_type==="VIRTUAL")return Wo$($,Z,Q);return FK8($,Z,Q)}var l80=L(()=>{UK8();Yt()});function GP1($){if($===null)return"null";if(Array.isArray($))return"array";return typeof $}function w05($,Z){if(Z==="integer")return typeof $==="number"&&Number.isInteger($);return GP1($)===Z}function E05($,Z){if(Z==="object"||Z==="array"){let Q;try{Q=JSON.parse($)}catch{return}return GP1(Q)===Z?Q:void 0}if(Z==="boolean"){if($==="true")return!0;if($==="false")return!1;return}if(Z==="number"||Z==="integer"){if($.trim()==="")return;let Q=Number($);if(!Number.isFinite(Q))return;if(Z==="integer"&&!Number.isInteger(Q))return;return Q}return}function NK8($,Z){if(!$?.properties||!Z)return null;let Q=!1,Y={...Z};for(let[X,J]of Object.entries(Z)){if(typeof J!=="string")continue;let G=$.properties[X]?.type;if(!G||G==="string")continue;let W=E05(J,G);if(W===void 0)continue;Y[X]=W,Q=!0}return Q?Y:null}function WP1($,Z,Q){let Y=Object.keys(Q??{}),X=Z?.required??[],J=X.filter((H)=>!Y.includes(H)),G=(H)=>{let F=Z?.properties?.[H]?.type;return F?`${H} (${F})`:H},W=Y.filter((H)=>{let F=Z?.properties?.[H]?.type;return F!=null&&!w05(Q?.[H],F)}).map((H)=>`${H} (expected ${Z?.properties?.[H]?.type}, got ${GP1(Q?.[H])})`);return[`Invalid arguments for "${$}".`,X.length?`Required: ${X.map(G).join(", ")}.`:"",`You sent: ${Y.length?Y.join(", "):"(none)"}.`,J.length?`Missing required: ${J.join(", ")}.`:"",W.length?`Wrong type: ${W.join(", ")}.`:""].filter(Boolean).join(" ")}function BK8($,Z,Q,Y){if(!($ instanceof x1)||$.code!==l1.InvalidParams)return $;if(!Z)return $;let X=WP1(Z,Q,Y),J=$.message.replace(/^MCP error -?\d+: /,"");return new x1(l1.InvalidParams,`${J}
 
 ${X}`,$.data)}function Af0($){let Z=$;if(!Z||Z.isError!==!0||!Array.isArray(Z.content))return null;let Q=Z.content.map((Y)=>Y?.type==="text"?Y.text:null).filter((Y)=>typeof Y==="string").join(`
 `);return/MCP error -32602|Input validation error/.test(Q)?Q:null}function DK8($,Z){let Q=$;return{...Q,content:(Q.content??[]).map((Y,X)=>X===0&&Y?.type==="text"?{...Y,text:`${Y.text}
@@ -4501,7 +4501,7 @@ ${X}`:`${Y}
 
 ${X}
 ${J.slice(Y.length).trimStart()}`}function mj8($){return $?.match(lK5)?.[1]?.toLowerCase()??null}async function iK5($,Z,Q){let[Y,X]=await Promise.all([$.client.listDecofileEntries(Z,$.packagePath),$.client.listDecofileEntries(Q,$.packagePath)]),J=new Map(hK(Y,$.packagePath).map((H)=>[H.path,H.sha])),G=hK(X,$.packagePath),W=new Set(G.map((H)=>H.path)),K=[];for(let H of G){if(J.get(H.path)===H.sha)continue;K.push({path:H.path,copyFromRef:Q})}for(let H of J.keys())if(!W.has(H))K.push({path:H,deleted:!0});return{changes:K,tree:Y,next:G.map((H)=>({stem:H.stem,sha:H.sha}))}}async function lj8($,Z){try{return await fQ0($.client,$.packagePath,Z)}catch(Q){if(Q instanceof Vs)return null;throw Q}}async function cj8($,Z,Q){let Y=PP($.packagePath),[X,J]=await Promise.all([$.client.getEntriesAtPaths(Z,[Y]),$.client.getEntriesAtPaths(Q,[Y])]);if(X.get(Y)?.sha===J.get(Y)?.sha)return!1;let[G,W]=await Promise.all([lj8($,Z),lj8($,Q)]);return G!==W}async function dj8($,Z){if(!AD0(Z))throw new nu;if(!await DT1($.store,$.site,Z))throw new nu}async function ij8($,Z){await dj8($,Z);let Q=await $9($.client,$.mainBranch);return cj8($,Q,Z)}async function pj8($,Z,Q={},Y={}){await dj8($,Z);let X=await $.client.readCommit(Z);if(!X)throw new nu;let J=await $9($.client,$.mainBranch),G=await iK5($,J,Z);if(G.changes.length===0)return{result:"up-to-date"};let W=await cj8($,J,Z);if(W)console.info("hosted reapply: schema differs",{site:$.site,target:Z,head:J});let K=await LT1($,J,G,dK5(X,Z,Q.coAuthor));return{result:"merged",sha:K,release:await wT1($,K,Y),schemaChanged:W}}var nu,gQ0="Reapply: ",hK5,uK5="Reapplied-From",lK5;var AT1=L(()=>{Gn();T5();fF();$B();yQ0();Tg0();nu=class nu extends Error{constructor(){super("This commit has no release");this.name="NotPublishedError"}};hK5=/^chore\(decofile\):/,lK5=/^Reapplied-From:\s*([0-9a-f]{40})\s*$/im});async function nj8($,Z,Q){let[Y,X,J]=await Promise.all([Vj8($.store,$.site),uq$($.store,$.site),Z.listCommits({ref:$.mainBranch,since:nK5,cursor:Q,limit:pK5})]),G=new Map(J.items.map((H)=>[H.sha,H.date])),W=J.items.map((H)=>mj8(H.body));await Promise.all([...new Set(W)].filter((H)=>H!==null&&!G.has(H)).map(async(H)=>{let F=await $.client.readCommit(H).catch(()=>null);if(F)G.set(H,F.date)}));let K=J.items.map((H,F)=>{let U=W[F];return{sha:H.sha,date:H.date,message:H.message,author:H.author.name??H.author.login,hasRelease:X.has(H.sha),reapplyOf:U?{sha:U,date:G.get(U)??null}:null}});return{current:Y,commits:K,nextCursor:J.nextCursor}}async function tj8($){let Z=await $9($.client,$.mainBranch),Q=await OT1($,Z),Y={revision:Z,schemaHash:Q,publishedAt:new Date().toISOString()};return await jT1($,Y),Y}var pK5=50,nK5="1970-01-01T00:00:00Z";var oj8=L(()=>{T5();$B();yQ0();AT1()});function sj8($){return`site-tokens:${$}`}function tK5($){let Z=$?.tokens;if(!Array.isArray(Z))return[];return Z.filter((Q)=>typeof Q==="object"&&Q!==null&&typeof Q.kid==="string"&&typeof Q.iat==="number")}function rj8($){return crypto.subtle.importKey("pkcs8",Buffer.from($,"base64"),{name:"Ed25519"},!1,["sign"])}async function oK5($,Z){let Q=(J)=>TT1(new TextEncoder().encode(JSON.stringify(J))),Y=`${Q({alg:"EdDSA",typ:"JWT"})}.${Q({site:Z.site,kid:Z.kid,iat:Z.iat})}`,X=await crypto.subtle.sign({name:"Ed25519"},$,new TextEncoder().encode(Y));return`${Y}.${TT1(X)}`}function aj8($){let Z=async(Q,Y)=>tK5(await $.kv.get(Q,sj8(Y)));return{list:Z,async issue(Q,Y){let X=await Z(Q,Y),J={kid:TT1(crypto.getRandomValues(new Uint8Array(16))),iat:Math.floor(Date.now()/1000)},G=await oK5(await $.signingKey(),{site:Y,...J});return await $.kv.set(Q,sj8(Y),{tokens:[...X,J]}),{token:G,record:J}}}}var TT1=($)=>Buffer.from($ instanceof Uint8Array?$:new Uint8Array($)).toString("base64url");function rK5(){let $=Pp();return $?{store:$,purge:Pg0()}:null}async function Ig0($){let Z=$.var.delivery();if(!Z)return null;let Q=$.get("hostedProject"),Y=await $.var.repoClientFor($.var.studioContext,Q.organizationId,Q.repository);return{client:Y,packagePath:Q.packagePath,mainBranch:await Y.getDefaultBranch(),store:Z.store,purge:Z.purge,site:Q.site}}function ej8($){let Z=B0().siteTokenSigningKey;if(!Z)return null;return aj8({kv:$.var.studioContext.storage.kv,signingKey:()=>rj8(Z)})}function Ss($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof Vs)return $.json({error:Q},409);if(Z instanceof qg0)return console.error("hosted: latest.json update failed",{error:Q}),$.json({error:"latest-update-failed"},502);let Y=_G(Z);if(Y!==null)return $.json({error:Q},Y===404?404:502);return console.error("hosted: request failed",{error:Q}),$.json({error:Q},500)}function $w8($={}){let Z=new Z1,Q=$.repoClientFor??bG,Y=$.insightsFor??Zq$,X=$.delivery??rK5;return Z.use("*",async(J,G)=>{J.set("repoClientFor",Q),J.set("delivery",X),await G()}),Z.use("/:virtualMcpId/*",sK5),Z.get("/:virtualMcpId/releases",async(J)=>{try{let G=await Ig0(J);if(!G)return J.json(Vg0,503);let W=J.get("hostedProject"),K=await Y(J.var.studioContext,W.organizationId,W.repository);return J.json(await nj8(G,K,J.req.query("cursor")??null),200,{"Cache-Control":"no-store"})}catch(G){return Ss(J,G)}}),Z.post("/:virtualMcpId/releases/retry",async(J)=>{try{let G=await Ig0(J);if(!G)return J.json(Vg0,503);return J.json({current:await tj8(G)})}catch(G){return Ss(J,G)}}),Z.get("/:virtualMcpId/releases/:sha/reapply",async(J)=>{try{let G=await Ig0(J);if(!G)return J.json(Vg0,503);return J.json({schemaChanged:await ij8(G,J.req.param("sha"))})}catch(G){if(G instanceof nu)return J.json({error:G.message},404);return Ss(J,G)}}),Z.post("/:virtualMcpId/releases/:sha/reapply",async(J)=>{try{let G=await Ig0(J);if(!G)return J.json(Vg0,503);let W=await pj8(G,J.req.param("sha"),{coAuthor:QO(J.var.studioContext)});return J.json(W)}catch(G){if(G instanceof nu)return J.json({error:G.message},404);if(G instanceof Is)return J.json({error:"main-moved"},409);return Ss(J,G)}}),Z.get("/:virtualMcpId/site-tokens",async(J)=>{let G=J.get("hostedProject"),W=ej8(J);if(!W)return J.json({error:"site tokens not configured"},503);return J.json({site:G.site,tokens:await W.list(G.organizationId,G.site)})}),Z.post("/:virtualMcpId/site-tokens",async(J)=>{let G=J.get("hostedProject"),W=ej8(J);if(!W)return J.json({error:"site tokens not configured"},503);try{let K=await J.var.repoClientFor(J.var.studioContext,G.organizationId,G.repository),H=await QR(K,G.packagePath,await K.getDefaultBranch());if(await Tp(J.var.studioContext.storage.virtualMcps,{id:G.virtualMcpId,organizationId:G.organizationId,metadata:G.metadata},H,J.var.studioContext.auth?.user?.id??"system"),!H)return J.json({error:"not a Blocks v8 site"},409);return J.json(await W.issue(G.organizationId,G.site))}catch(K){return Ss(J,K)}}),Z}var sK5,Vg0;var Zw8=L(()=>{SF();H8();Xg0();IG();_F();T5();$B();BT1();yQ0();Tg0();oj8();AT1();s60();YR();Ap();u1();bR();sK5=Bs(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);if(!Q.auth?.user?.id)return $.json({error:"Unauthorized"},401);if(!await qQ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let X=$.req.param("virtualMcpId")??"",J=await Q.storage.virtualMcps.findById(X);if(!J||J.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);if(!VQ(await r7(Q),X))return $.json({error:"Virtual MCP not found"},404);let G=J.metadata??null,W=JW(G,J.connections?.map((H)=>H.connection_id)??[]);if(!W)return $.json({error:"Project has no repository"},404);try{let H=await $.var.repoClientFor(Q,Y.id,W);if(!await MD0({projects:Q.storage.virtualMcps,project:{id:X,organizationId:Y.id,metadata:G},by:Q.auth.user.id,client:H,mainBranch:await H.getDefaultBranch()}))return $.json({error:"Not found"},404)}catch(H){return Ss($,H)}let K=await RD0(Q.storage.orgSites,X,Y.id);if(!K)return $.json(zp,409);return $.set("hostedProject",{organizationId:Y.id,virtualMcpId:X,site:K,packagePath:ZB(G),repository:W,metadata:G}),Z()}),Vg0={error:"hosted delivery not configured"}});var Qw8=($)=>{let Z=new Z1;if(Z.use("*",yo),Z.use("*",RU8),Z.route("/",TU8($.voiceSessions)),Z.route("/",Fy0()),Z.route("/",WN8()),Z.route("/",EN8()),Z.route("/",QN8()),Z.route("/",TL8()),Z.route("/",RL8()),Z.route("/",LL8()),Z.route("/",zL8()),Z.route("/",jL8()),Z.route("/",Zg0()),Z.route("/tools",_L8()),Z.route("/",kL8()),Z.route("/",oD8({kvStorage:$.kvStorage})),Z.route("/",nD8()),Z.route("/fs",GL8({getConnection:$.getNatsConnection})),Z.route("/sandbox",Wj8()),Z.route("/decofile",hj8()),Z.route("/hosted",$w8()),Z.route("/",NL8()),Z.route("/",KL8()),Z.route("/deco-sites",Ny0()),Z.route("/hosting",fU8()),Z.route("/monitor",tU8()),Z.route("/order-monitor",aU8()),Z.route("/sso",Xy0()),Z.route("/",Qg0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",SU8()),$.mountDevAssets)Z.route("/dev-assets",Ey0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of PA1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",dW8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of PA1)Z.route(Q,FL8());return Z.route("/mcp",Xx0()),Z.route("/mcp/self",ry0()),Z.route("/mcp",Wx0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var Yw8=L(()=>{H8();qU8();MU8();nf0();_U8();nz1();yU8();oU8();eU8();Py0();E2();mz1();KN8();ez1();tD8();sD8();WL8();HL8();$70();vz1();Kx0();EA1();UL8();BL8();OL8();wL8();TA1();qL8();ML8();CL8();qA1();vL8();RA1();Jx0();Kj8();uj8();Zw8()});import{z as tu}from"zod";class qT1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new Gw8.Kvm(kg0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:kg0.StorageType.Memory,ttl:Ww8.nanos(zO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?Jw8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await J$(200);continue}let G=Xw8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await J$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,Xw8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new R1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?Jw8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var kg0,Gw8,Ww8,Xw8,Jw8;var Kw8=L(()=>{BG();kB();p$();kg0=_(xH(),1),Gw8=_(vq(),1),Ww8=_(s2(),1),Xw8=new TextEncoder,Jw8=tu.discriminatedUnion("state",[tu.object({state:tu.literal("ready"),agentId:tu.string()}),tu.object({state:tu.literal("creating"),expiresAt:tu.number()})])});import{z as _s}from"zod";function aK5($){return{model:$.model,instructions:`${gt$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class RT1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:aK5({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:_s.object({session:_s.object({id:_s.string().min(1)}),transport:_s.object({type:_s.literal("webrtc"),sdp:_s.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var Hw8=L(()=>{kB()});var Fw8;var Uw8=L(()=>{Fw8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function MT1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:ft$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:Fw8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:zO/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var Nw8=L(()=>{kB();Uw8()});import{z as pJ}from"zod";import{createHash as eK5,createHmac as $H5}from"crypto";class Cg0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=eK5("sha256").update(JSON.stringify(MT1($))).digest("hex"),this.conversationKey=$H5("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Cg0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=pJ.object({agents:pJ.array(pJ.object({agent_id:pJ.string(),name:pJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return pJ.object({platform_settings:pJ.object({auth:pJ.object({enable_auth:pJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...MT1(this.config)},AbortSignal.timeout(15000));return pJ.object({agent_id:pJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return pJ.object({token:pJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return pJ.object({token:pJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var Bw8=L(()=>{Nw8()});import{createHmac as ZH5,timingSafeEqual as QH5}from"crypto";import{z as vs}from"zod";function Lw8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return ZH5("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function Ow8($,Z){let Q=Buffer.from(JSON.stringify(Dw8.parse($))).toString("base64url");return`${Q}.${Lw8(Q,Z)}`}function jw8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(Lw8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!QH5(W,G))return null;try{let K=Dw8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+zO)return null;return K.data}catch{return null}}var Dw8;var ww8=L(()=>{kB();Dw8=vs.object({sessionId:vs.string().uuid(),organizationId:vs.string().min(1).max(256),userId:vs.string().min(1).max(256),threadId:vs.string().min(1).max(256),expiresAt:vs.number().int().positive()})});import{z as VT1}from"zod";function Ew8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return IT1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var IT1;var Pw8=L(()=>{IT1=VT1.object({provider:VT1.enum(["elevenlabs","openai"]),model:VT1.string().trim().min(1).max(128)})});import{createHash as YH5}from"crypto";import{z as bs}from"zod";function xs($){return`user.${YH5("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class CT1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new zw8.Kvm(_g0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:_g0.StorageType.Memory,ttl:Aw8.nanos(zO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=Ew8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+zO},W=Ow8(G,this.deps.secret),K=await this.kv(),H=xs(G),F=await K.get(H),U=F?.operation==="PUT"?Sg0.parse(F.json()):null,N=kT1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:xs($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=jw8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=xs(Q),J=await Y.get(X),G=J?.operation==="PUT"?Sg0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,kT1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=xs(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Sg0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,kT1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(xs($));if(Q?.operation==="PUT"&&Sg0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(xs($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var _g0,zw8,Aw8,Sg0,kT1;var Tw8=L(()=>{BG();kB();ww8();Pw8();_g0=_(xH(),1),zw8=_(vq(),1),Aw8=_(s2(),1),Sg0=bs.object({sessionId:bs.string().uuid(),expiresAt:bs.number(),connected:bs.boolean().optional(),conversation:IT1.optional(),characters:bs.number().int().nonnegative(),requests:bs.number().int().nonnegative()}),kT1=new TextEncoder});import{z as c1}from"zod";function YD($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function BH5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function DH5($,Z,Q){try{return JSON.parse($)}catch{throw new Mw8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function LH5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:DH5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function OH5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?qN(Q.function.parameters):qN({type:"object",properties:{}});return[Q.function.name,s$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function jH5($){if(!$)return;return{openai:{response_format:$}}}function wH5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function qw8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function Rw8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var XH5=256,JH5,GH5,WH5,KH5,HH5,FH5,UH5,NH5,Mw8,Vw8,Iw8;var kw8=L(()=>{l4();H8();Ns();FU();JH5=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),GH5=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),WH5=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(GH5).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),KH5=c1.object({type:c1.literal("text")}),HH5=c1.object({type:c1.literal("json_object")}),FH5=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),UH5=c1.union([KH5,HH5,FH5]),NH5=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(WH5),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(JH5).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:UH5.optional(),user:c1.string().optional()});Mw8=class Mw8 extends Error{constructor($){super($);this.name="MessageConversionError"}};Vw8=new Z1;Vw8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(YD("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(YD("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(YD("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=NH5.safeParse(Y);if(!X.success){let j=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(YD(`Invalid request: ${j.message}`,"invalid_request_error",j.path.length>0?j.path.join("."):null),400)}let J=X.data,G=BH5(J.model);if(!G)return $.json(YD("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let w=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>cA(E.providerId));if(!w)return $.json(YD("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=w.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(YD(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=LH5(J.messages),N=J.tools?OH5(J.tools):void 0,B=jH5(J.response_format),D=wH5(),O=Math.floor(Date.now()/1000);if(J.stream)return Bj($,async(j)=>{let w=qw8(F,U,N,J,B,$.req.raw.signal);try{let E=Nt(w),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let R=z;z="",await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:R},finish_reason:null}]})})};for await(let R of E.stream){if(!P&&(R.type==="text-delta"||R.type==="tool-call"))await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(R.type==="text-delta"){if(z+=R.text,z.length>=XH5)await A()}else if(R.type==="tool-call"){await A();let f=T++;await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:R.toolCallId,type:"function",function:{name:R.toolName,arguments:JSON.stringify(R.input)}}]},finish_reason:null}]})})}else if(R.type==="finish")await A(),await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:Rw8(R.finishReason)}],usage:R.totalUsage?{prompt_tokens:R.totalUsage.inputTokens??0,completion_tokens:R.totalUsage.outputTokens??0,total_tokens:R.totalUsage.totalTokens??0}:void 0})})}await A(),await j.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await j.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let j=qw8(F,U,N,J,B,$.req.raw.signal),w=await RO(j),E={role:"assistant",content:w.text||null};if(w.toolCalls&&w.toolCalls.length>0)E.tool_calls=w.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:Rw8(w.finishReason)}],usage:{prompt_tokens:w.usage?.inputTokens??0,completion_tokens:w.usage?.outputTokens??0,total_tokens:w.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(YD("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(YD(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(YD(X.message,"server_error"),500)}});Iw8=Vw8});function EH5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function Cw8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=S0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!_5(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||P9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(tA(U)!==J)continue;if(!EH5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Sw8=L(()=>{H8();$X()});var vg0;var ST1=L(()=>{vg0={name:"decocms",version:"4.513.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/blocks":"8.5.1","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function AH5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??zH5}}var _w8,zH5="https://ph.studio.decocms.com",vw8;var bw8=L(()=>{H8();R10();Qu();H9();u1();wo();jz1();ST1();_w8=new Z1;_w8.get("/",($)=>{let Z={version:vg0.version,theme:a3$(),...NF().logo&&{logo:NF().logo},...fO()&&{internalUrl:E$$()},...B0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!B0().controlplaneRestUrl&&!!B0().controlplaneServiceToken,hostingControlPlaneGa:B0().hostingControlPlaneGa,monitorEnabled:!!B0().clickhouseAnalyticsUrl&&!!B0().clickhouseAnalyticsPassword,monitorGa:B0().monitorGa,orderMonitorEnabled:!!B0().orderMonitorIngestUrl&&N2(),plansEnabled:B0().plansEnabled,auth:NF8(),posthog:AH5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:qU()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});vw8=_w8});import{z as R$}from"zod";var TH5,xw8;var fw8=L(()=>{TH5=R$.object({check_id:R$.string(),title:R$.string(),description:R$.string().optional(),impact:R$.string().optional(),why:R$.string().optional(),category:R$.string(),severity:R$.string(),value_band:R$.string().optional(),value_driver:R$.string().optional(),controllability:R$.string().optional(),pages:R$.array(R$.string()),tasks:R$.array(R$.string()),evidence:R$.string(),sample_scope:R$.string().optional(),sources:R$.array(R$.string())}),xw8=R$.object({domain:R$.string(),brand:R$.string(),favicon:R$.string().optional(),scanned_at:R$.string().nullable(),lang:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),totals:R$.object({measured:R$.number(),registry_total:R$.number(),passed:R$.number(),failed:R$.number(),blocked:R$.number()}),buckets:R$.array(R$.object({id:R$.enum(["critical","important","worth"]),label:R$.string(),items:R$.array(TH5)})),passing:R$.object({count:R$.number(),items:R$.array(R$.object({check_id:R$.string(),title:R$.string()}))}),not_measured:R$.object({count:R$.number(),groups:R$.array(R$.object({reason:R$.string(),label:R$.string(),count:R$.number(),checks:R$.array(R$.string())}))}),categories:R$.array(R$.object({key:R$.string(),label:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),pass:R$.number(),fail:R$.number()})),screenshots:R$.array(R$.object({url:R$.string(),page_type:R$.string().optional(),viewport:R$.enum(["desktop","mobile"]),image_url:R$.string()}))})});function yw8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${SK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function bg0($,Z={}){let Q=await fetch(yw8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return xw8.parse(await Q.json())}async function gw8($,Z={}){let Q=await fetch(yw8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var _T1=L(()=>{fw8();xL()});import{join as hw8}from"path";async function RH5($){try{let Z=await bg0($,{signal:AbortSignal.timeout(qH5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||pw1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function J3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function MH5($,Z){let Q=Ru($),Y=Z?.brand?.trim()||pw1(Q),X=gG8(Q,128),G=`${(B0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=hG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${J3(W)}</title>`,`<meta name="description" content="${J3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${J3(W)}" />`,`<meta property="og:description" content="${J3(K)}" />`,`<meta property="og:url" content="${J3(G)}" />`,`<meta property="og:image" content="${J3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${J3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${J3(W)}" />`,`<meta name="twitter:description" content="${J3(K)}" />`,`<meta name="twitter:image" content="${J3(H)}" />`,`<meta name="twitter:image:alt" content="${J3(F)}" />`,`<link rel="canonical" href="${J3(G)}" />`,`<link rel="alternate" type="text/markdown" href="${J3(G)}.md" />`,`<link rel="icon" href="${J3(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class RT1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:aK5({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:_s.object({session:_s.object({id:_s.string().min(1)}),transport:_s.object({type:_s.literal("webrtc"),sdp:_s.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var Hw8=L(()=>{kB()});var Fw8;var Uw8=L(()=>{Fw8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function MT1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:ft$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:Fw8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:zO/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var Nw8=L(()=>{kB();Uw8()});import{z as pJ}from"zod";import{createHash as eK5,createHmac as $H5}from"crypto";class Cg0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=eK5("sha256").update(JSON.stringify(MT1($))).digest("hex"),this.conversationKey=$H5("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Cg0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=pJ.object({agents:pJ.array(pJ.object({agent_id:pJ.string(),name:pJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return pJ.object({platform_settings:pJ.object({auth:pJ.object({enable_auth:pJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...MT1(this.config)},AbortSignal.timeout(15000));return pJ.object({agent_id:pJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return pJ.object({token:pJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return pJ.object({token:pJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var Bw8=L(()=>{Nw8()});import{createHmac as ZH5,timingSafeEqual as QH5}from"crypto";import{z as vs}from"zod";function Lw8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return ZH5("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function Ow8($,Z){let Q=Buffer.from(JSON.stringify(Dw8.parse($))).toString("base64url");return`${Q}.${Lw8(Q,Z)}`}function jw8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(Lw8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!QH5(W,G))return null;try{let K=Dw8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+zO)return null;return K.data}catch{return null}}var Dw8;var ww8=L(()=>{kB();Dw8=vs.object({sessionId:vs.string().uuid(),organizationId:vs.string().min(1).max(256),userId:vs.string().min(1).max(256),threadId:vs.string().min(1).max(256),expiresAt:vs.number().int().positive()})});import{z as VT1}from"zod";function Ew8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return IT1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var IT1;var Pw8=L(()=>{IT1=VT1.object({provider:VT1.enum(["elevenlabs","openai"]),model:VT1.string().trim().min(1).max(128)})});import{createHash as YH5}from"crypto";import{z as bs}from"zod";function xs($){return`user.${YH5("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class CT1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new zw8.Kvm(_g0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:_g0.StorageType.Memory,ttl:Aw8.nanos(zO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=Ew8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+zO},W=Ow8(G,this.deps.secret),K=await this.kv(),H=xs(G),F=await K.get(H),U=F?.operation==="PUT"?Sg0.parse(F.json()):null,N=kT1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:xs($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=jw8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=xs(Q),J=await Y.get(X),G=J?.operation==="PUT"?Sg0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,kT1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=xs(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Sg0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,kT1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(xs($));if(Q?.operation==="PUT"&&Sg0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(xs($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var _g0,zw8,Aw8,Sg0,kT1;var Tw8=L(()=>{BG();kB();ww8();Pw8();_g0=_(xH(),1),zw8=_(vq(),1),Aw8=_(s2(),1),Sg0=bs.object({sessionId:bs.string().uuid(),expiresAt:bs.number(),connected:bs.boolean().optional(),conversation:IT1.optional(),characters:bs.number().int().nonnegative(),requests:bs.number().int().nonnegative()}),kT1=new TextEncoder});import{z as c1}from"zod";function YD($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function BH5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function DH5($,Z,Q){try{return JSON.parse($)}catch{throw new Mw8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function LH5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:DH5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function OH5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?qN(Q.function.parameters):qN({type:"object",properties:{}});return[Q.function.name,s$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function jH5($){if(!$)return;return{openai:{response_format:$}}}function wH5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function qw8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function Rw8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var XH5=256,JH5,GH5,WH5,KH5,HH5,FH5,UH5,NH5,Mw8,Vw8,Iw8;var kw8=L(()=>{l4();H8();Ns();FU();JH5=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),GH5=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),WH5=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(GH5).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),KH5=c1.object({type:c1.literal("text")}),HH5=c1.object({type:c1.literal("json_object")}),FH5=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),UH5=c1.union([KH5,HH5,FH5]),NH5=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(WH5),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(JH5).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:UH5.optional(),user:c1.string().optional()});Mw8=class Mw8 extends Error{constructor($){super($);this.name="MessageConversionError"}};Vw8=new Z1;Vw8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(YD("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(YD("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(YD("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=NH5.safeParse(Y);if(!X.success){let j=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(YD(`Invalid request: ${j.message}`,"invalid_request_error",j.path.length>0?j.path.join("."):null),400)}let J=X.data,G=BH5(J.model);if(!G)return $.json(YD("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let w=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>cA(E.providerId));if(!w)return $.json(YD("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=w.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(YD(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=LH5(J.messages),N=J.tools?OH5(J.tools):void 0,B=jH5(J.response_format),D=wH5(),O=Math.floor(Date.now()/1000);if(J.stream)return Bj($,async(j)=>{let w=qw8(F,U,N,J,B,$.req.raw.signal);try{let E=Nt(w),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let R=z;z="",await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:R},finish_reason:null}]})})};for await(let R of E.stream){if(!P&&(R.type==="text-delta"||R.type==="tool-call"))await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(R.type==="text-delta"){if(z+=R.text,z.length>=XH5)await A()}else if(R.type==="tool-call"){await A();let f=T++;await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:R.toolCallId,type:"function",function:{name:R.toolName,arguments:JSON.stringify(R.input)}}]},finish_reason:null}]})})}else if(R.type==="finish")await A(),await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:Rw8(R.finishReason)}],usage:R.totalUsage?{prompt_tokens:R.totalUsage.inputTokens??0,completion_tokens:R.totalUsage.outputTokens??0,total_tokens:R.totalUsage.totalTokens??0}:void 0})})}await A(),await j.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await j.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let j=qw8(F,U,N,J,B,$.req.raw.signal),w=await RO(j),E={role:"assistant",content:w.text||null};if(w.toolCalls&&w.toolCalls.length>0)E.tool_calls=w.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:Rw8(w.finishReason)}],usage:{prompt_tokens:w.usage?.inputTokens??0,completion_tokens:w.usage?.outputTokens??0,total_tokens:w.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(YD("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(YD(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(YD(X.message,"server_error"),500)}});Iw8=Vw8});function EH5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function Cw8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=S0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!_5(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||P9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(tA(U)!==J)continue;if(!EH5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Sw8=L(()=>{H8();$X()});var vg0;var ST1=L(()=>{vg0={name:"decocms",version:"4.513.4",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/blocks":"8.5.1","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function AH5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??zH5}}var _w8,zH5="https://ph.studio.decocms.com",vw8;var bw8=L(()=>{H8();R10();Qu();H9();u1();wo();jz1();ST1();_w8=new Z1;_w8.get("/",($)=>{let Z={version:vg0.version,theme:a3$(),...NF().logo&&{logo:NF().logo},...fO()&&{internalUrl:E$$()},...B0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!B0().controlplaneRestUrl&&!!B0().controlplaneServiceToken,hostingControlPlaneGa:B0().hostingControlPlaneGa,monitorEnabled:!!B0().clickhouseAnalyticsUrl&&!!B0().clickhouseAnalyticsPassword,monitorGa:B0().monitorGa,orderMonitorEnabled:!!B0().orderMonitorIngestUrl&&N2(),plansEnabled:B0().plansEnabled,auth:NF8(),posthog:AH5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:qU()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});vw8=_w8});import{z as R$}from"zod";var TH5,xw8;var fw8=L(()=>{TH5=R$.object({check_id:R$.string(),title:R$.string(),description:R$.string().optional(),impact:R$.string().optional(),why:R$.string().optional(),category:R$.string(),severity:R$.string(),value_band:R$.string().optional(),value_driver:R$.string().optional(),controllability:R$.string().optional(),pages:R$.array(R$.string()),tasks:R$.array(R$.string()),evidence:R$.string(),sample_scope:R$.string().optional(),sources:R$.array(R$.string())}),xw8=R$.object({domain:R$.string(),brand:R$.string(),favicon:R$.string().optional(),scanned_at:R$.string().nullable(),lang:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),totals:R$.object({measured:R$.number(),registry_total:R$.number(),passed:R$.number(),failed:R$.number(),blocked:R$.number()}),buckets:R$.array(R$.object({id:R$.enum(["critical","important","worth"]),label:R$.string(),items:R$.array(TH5)})),passing:R$.object({count:R$.number(),items:R$.array(R$.object({check_id:R$.string(),title:R$.string()}))}),not_measured:R$.object({count:R$.number(),groups:R$.array(R$.object({reason:R$.string(),label:R$.string(),count:R$.number(),checks:R$.array(R$.string())}))}),categories:R$.array(R$.object({key:R$.string(),label:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),pass:R$.number(),fail:R$.number()})),screenshots:R$.array(R$.object({url:R$.string(),page_type:R$.string().optional(),viewport:R$.enum(["desktop","mobile"]),image_url:R$.string()}))})});function yw8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${SK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function bg0($,Z={}){let Q=await fetch(yw8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return xw8.parse(await Q.json())}async function gw8($,Z={}){let Q=await fetch(yw8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var _T1=L(()=>{fw8();xL()});import{join as hw8}from"path";async function RH5($){try{let Z=await bg0($,{signal:AbortSignal.timeout(qH5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||pw1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function J3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function MH5($,Z){let Q=Ru($),Y=Z?.brand?.trim()||pw1(Q),X=gG8(Q,128),G=`${(B0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=hG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${J3(W)}</title>`,`<meta name="description" content="${J3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${J3(W)}" />`,`<meta property="og:description" content="${J3(K)}" />`,`<meta property="og:url" content="${J3(G)}" />`,`<meta property="og:image" content="${J3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${J3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${J3(W)}" />`,`<meta name="twitter:description" content="${J3(K)}" />`,`<meta name="twitter:image" content="${J3(H)}" />`,`<meta name="twitter:image:alt" content="${J3(F)}" />`,`<link rel="canonical" href="${J3(G)}" />`,`<link rel="alternate" type="text/markdown" href="${J3(G)}.md" />`,`<link rel="icon" href="${J3(X)}" sizes="any" />`].join(`
     `)}function VH5($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function uw8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Ru(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(hw8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${SK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(IH5)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=Ru(Q.req.param("file").replace(/\.md$/,""));try{let X=await gw8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(kH5)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?hw8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await RH5(Ru(Y)),K=MH5(Y,W);return Q.html(VH5(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var qH5=2500,IH5=1e4,kH5=1e4;var lw8=L(()=>{H8();xL();_T1();u1()});function xg0($,Z){return fetch(`${SK({})}${$}`,Z)}async function CH5($,Z){let Q=await bg0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function vH5($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var SH5,_H5=8192,Lj,mw8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},cw8;var dw8=L(()=>{H8();Q3();nK();xL();_T1();SH5=new Set(["complete","errored","terminated","unknown"]);Lj=new Z1;Lj.use("*",async($,Z)=>{let Q=await B4.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});Lj.use("/link-token/*",mw8);Lj.use("/suggest",mw8);Lj.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await CH5(Z,Q))}catch{return $.json({error:"report read failed"},502)}});Lj.post("/run",C6({maxSize:_H5,onError:($)=>$.json({error:"request body too large"},413)}),async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=vH5(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await xg0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${HP({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});Lj.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await xg0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${HP({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:SH5.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});Lj.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await xg0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});Lj.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await xg0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});cw8=Lj});var bH5=1048576,vT1;var iw8=L(()=>{H8();Q3();u1();Qz1();vT1=new Z1;vT1.post("/webhook",C6({maxSize:bH5,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=B0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!RH8(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=MH8(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await VH8(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as xH5}from"crypto";function gH5($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return xH5(Buffer.from(X),Buffer.from(Y))}function hH5($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function pw8($){let Z=new Z1;return Z.post("/webhook",C6({maxSize:fH5,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!gH5(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!yH5.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return p50().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=hH5(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await uH5($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function uH5($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await G48(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var fH5=5242880,yH5;var nw8=L(()=>{H8();Q3();SX();hQ();yH5=new Set(["check_suite","issue_comment"])});import{DBOS as xT1,SchedulerMode as lH5}from"@dbos-inc/dbos-sdk";async function cH5(){try{return await dH5()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function dH5(){if(!i50())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (XF1(),YF1)),Promise.resolve().then(() => (QF1(),ZF1))]),Q=await p50(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=E8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=Dp$({sandboxes:J,pools:G,records:await Lp$(X,J,G),legacyPools:rC0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await Op$(K,Ej0(X,new GJ(B0().encryptionKey)),{now:W,orgFsLifetimeMs:$S0}),U=0,N=0,B=0;for(let D of H)try{let O=await Y.pushCredentials(D);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function iH5($,Z){let Q=await xT1.runStep(cH5,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function tw8(){if(bT1)return;if(!B0().agentSandboxEnabled||!i50())return;bT1=xT1.registerWorkflow(iH5,{name:"sandboxCredentialPushWorkflow"}),xT1.registerScheduled(bT1,{name:"sandboxCredentialPushWorkflow",crontab:mH5,mode:lH5.ExactlyOncePerIntervalWhenActive})}var mH5="1,11,21,31,41,51 * * * *",bT1=null;var ow8=L(()=>{S3();Nw();i31();ZS0();aC0();SX();u1()});function sw8($){let Z=new aO($.db,new GJ($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=F$8(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new ZQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var rw8=L(()=>{H8();Nw();CN1();MO()});function fg0(){try{return B0().jiraSettleSeconds*1000}catch{return $2}}function aw8($,Z){let Q=Z.windowMs??$2,Y=$.at(-1);if(!Y)return null;if(Z.changeId!==void 0&&Y.id!==Z.changeId)return{kind:"superseded"};if(Z.now!==void 0&&Z.now-Y.at<Q)return{kind:"moving"};let X=pH5($,Q);if((X.id&&Y.toId?X.id===Y.toId:!1)||!X.id&&X.name===Y.to)return{kind:"returned",change:Y};return{kind:"moved",change:Y,from:X}}function pH5($,Z){for(let Y=$.length-2;Y>=0;Y--){let X=$[Y],J=$[Y+1];if(X&&J&&J.at-X.at>=Z)return{id:X.toId,name:X.to}}let Q=$[0];return{id:Q?.fromId??null,name:Q?.from??null}}var fT1=L(()=>{gO();u1()});function ew8($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,Y=Z.issue?.key,X=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof Y!=="string"||typeof X!=="string"&&typeof X!=="number")return null;let J=Z.changelog?.items?.find((G)=>G.field==="status");if(!J||typeof J.toString!=="string")return null;return{issueId:String(Q),issueKey:Y,toStatus:J.toString,changelogId:String(X)}}async function yT1($,Z,Q){if(!Z.enabled)return"disabled";let Y=Z.organizationId,X=new ZQ(Z.siteUrl,Z.email,Z.apiToken),J=aw8(await X.listStatusChanges(Q.issueId),{changeId:Q.changelogId,now:Q.now,windowMs:fg0()});if(!J)return"no_rule";if(J.kind!=="moved")return J.kind;let{change:G,from:W}=J,K=(await $.storage.automations.listJiraTransitionTriggers(Y,{jiraStatus:G.to,activeOnly:!0})).map((N)=>({...N,from:ez(N)})),H=e98(K)&&Z.boardId?a98(await X.getBoardColumnStatusIds(Z.boardId),W.id,G.toId):null,F=r98(K,W.name,H);if(!F)return"no_rule";if(!await $.storage.jiraIntegrations.claimTrigger(Y,Q.issueId,G.id))return"duplicate";return await XH({automationId:F.automation_id,organizationId:Y,triggerId:F.id,target:{kind:"jira",issues:[Q.issueId],move:{toStatus:G.to,fromStatus:W.name,movedBy:G.by,movedAt:new Date(G.at).toISOString()},eventKey:G.id}},{idempotencyKey:`jira:${F.id}:${G.id}`}),"fired"}var gT1=L(()=>{KU();MO();ot();fT1()});import{DBOS as k2,SchedulerMode as nH5}from"@dbos-inc/dbos-sdk";function $E8($){uT1=$}function mT1(){if(!uT1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return uT1}function cT1(){let $=mT1();return new aO($.db,new GJ($.encryptionKey))}async function aH5($){try{let Z=await cT1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,fired:0};let Q=await hJ(mT1().db,Z.organizationId);if(!Q)return{integrationId:$,fired:0};if((await Q.storage.automations.listJiraTransitionTriggers(Z.organizationId,{activeOnly:!0})).length===0)return{integrationId:$,fired:0};let X=new ZQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${oH5}m"`,W=0,K;for(let H=0;H<sH5;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await yT1(Q,Z,{issueId:U.id,now:Date.now()})==="fired")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,fired:W}}catch(Z){return{integrationId:$,fired:0,error:Z instanceof Error?Z.message:String(Z)}}}async function eH5($,Z){let Q=await k2.runStep(()=>cT1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>k2.runStep(()=>aH5(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.fired>0)console.log(`[jira-trigger] integration ${X.integrationId} fired ${X.fired} automation(s) the webhook missed`)}async function $F5($,Z){try{let Q=await cT1().getById($);if(!Q?.enabled)return"disabled";let Y=await hJ(mT1().db,Q.organizationId);if(!Y)return"disabled";let X=await yT1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="fired")console.log(`[jira-trigger] fired an automation for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no fire`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function ZF5($,Z){await k2.sleep(fg0()+rH5),await k2.runStep(()=>$F5($,Z),{name:"settleJiraMove"})}async function ZE8($,Z){if(!lT1)throw Error("[jira-trigger] settle workflow is not registered");await k2.startWorkflow(lT1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function QE8(){if(hT1)return;lT1=k2.registerWorkflow(ZF5,{name:"jiraSettleWorkflow"}),hT1=k2.registerWorkflow(eH5,{name:"jiraTriggerSweepWorkflow"}),k2.registerScheduled(hT1,{name:"jiraTriggerSweepWorkflow",crontab:tH5,mode:nH5.ExactlyOncePerIntervalWhenActive})}var tH5="*/5 * * * *",oH5=20,sH5=5,rH5=5000,uT1=null,lT1=null,hT1=null;var dT1=L(()=>{Nw();nz();MO();fT1();gT1()});function YE8($){let Z=new aO($.db,new GJ($.encryptionKey)),Q=ZE($.db);async function Y(J,G){let W=ew8(G);if(!W)return;let K=await Z.getByWebhookSecret(J);if(!K?.enabled)return;if((await Q.listJiraTransitionTriggers(K.organizationId,{activeOnly:!0})).length===0)return;await ZE8(K.id,W)}let X=new Z1;return X.post("/webhook/:secret",C6({maxSize:QF5}),async(J)=>{let G=J.req.param("secret");if(!await Z.getByWebhookSecret(G))return J.json({error:"Unknown webhook"},404);let K;try{K=await J.req.json()}catch{return J.json({error:"Body must be JSON"},400)}return Y(G,K).catch((H)=>{console.error("[jira-webhook] trigger failed",H)}),J.body(null,202)}),X}var QF5=1048576;var XE8=L(()=>{H8();Q3();Nw();dT1();gT1();V00()});function JE8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var GE8,YF5,XF5,WE8;var KE8=L(()=>{H8();BG();ft();pi();GE8=new Z1,YF5=["range","if-none-match","if-modified-since"],XF5=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];GE8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(fo($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new R1(401,{message:"Authentication required"})}if(!Q)throw new R1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new R1(400,{message:"Missing file key"});let X=await VZ0(Y,Z);if(!X)throw new R1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&bK()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new R1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return JE8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of YF5){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new R1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new R1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of XF5){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),JE8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});WE8=GE8});var hQ0=y((ou)=>{var JF5=ou&&ou.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),GF5=ou&&ou.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))JF5(Z,$,Q)};Object.defineProperty(ou,"__esModule",{value:!0});GF5(B3(),ou)});var UE8=y((HE8)=>{Object.defineProperty(HE8,"__esModule",{value:!0});HE8.version=void 0;HE8.version="3.4.0"});var DE8=y((XD)=>{var WF5=XD&&XD.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(XD,"__esModule",{value:!0});XD.NodeTransport=XD.VERSION=void 0;XD.nodeResolveHost=BF5;var J9=hQ0(),KF5=V0("net"),iT1=V0("tls"),HF5=V0("path"),NE8=V0("fs"),FF5=WF5(V0("dns")),UF5=UE8();XD.VERSION=UF5.version;var NF5="nats.js";class BE8{socket;version;lang;yields=[];signal=(0,J9.deferred)();closedNotification=(0,J9.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=NF5,this.version=XD.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,J9.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw J9.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new J9.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new J9.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,J9.deferred)(),Q,Y=(0,KF5.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,J9.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=J9.DataBuffer.concat(...this.yields),X=(0,J9.extractProtocolMessage)(Y);if(X!=="")try{let J=J9.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,J9.deferred)();try{if($=(0,HF5.resolve)($),!(0,NE8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,NE8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,J9.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new J9.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,J9.deferred)();try{let X=(0,iT1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new J9.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,J9.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new J9.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,J9.deferred)();try{let Y=(0,iT1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new J9.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,J9.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,J9.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof iT1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,J9.render)($)}`);let Z=(0,J9.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,J9.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,J9.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}XD.NodeTransport=BE8;function BF5($){let Z=(0,J9.deferred)();return FF5.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var EE8=y((wE8)=>{Object.defineProperty(wE8,"__esModule",{value:!0});wE8.connect=DF5;var LE8=DE8(),OE8=hQ0(),jE8=hQ0();function DF5($={}){if((0,jE8.hasWsProtocol)($))return Promise.reject(jE8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,OE8.setTransportFactory)({factory:()=>{return new LE8.NodeTransport},dnsResolveFn:LE8.nodeResolveHost}),OE8.NatsConnectionImpl.connect($)}});var PE8=y((Oj)=>{var OF5=Oj&&Oj.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),jF5=Oj&&Oj.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))OF5(Z,$,Q)};Object.defineProperty(Oj,"__esModule",{value:!0});Oj.connect=void 0;var wF5=EE8();Object.defineProperty(Oj,"connect",{enumerable:!0,get:function(){return wF5.connect}});jF5(hQ0(),Oj)});function TE8($){let Z=$?.connectFn??AF5,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:zF5,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let O=k7(PF5,EF5,D-1,2,0.5);await J$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?yg0.credsAuthenticator(new TextEncoder().encode(B.creds)):B?.user?yg0.usernamePasswordAuthenticator(B.user,B.password):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=AE8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function AF5($){return zE8.connect($)}var yg0,zE8,AE8,EF5=100,PF5=3000,zF5=3000;var qE8=L(()=>{p$();yg0=_(s2(),1),zE8=_(PE8(),1),AE8=_(xH(),1)});function gg0($,Z){return`${$}.${Z}`}class pT1{cache;constructor($){this.cache=eN({ttlMs:$?.ttlMs??TF5,maxSize:$?.maxSize??qF5})}async get($,Z){return this.cache.get(gg0($,Z))??null}async set($,Z,Q){this.cache.set(gg0($,Z),Q)}async invalidate($,Z){this.cache.delete(gg0($,Z)),this.cache.delete(gg0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var TF5=600000,qF5=5000;var RE8=()=>{};function hg0($,Z){return`${$}:${Z}`}function nT1($){let Z=eN({ttlMs:$?.ttlMs??RF5,maxSize:$?.maxSize??MF5}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(ME8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(hg0(K,H))},set(K,H,F){Z.set(hg0(K,H),F)},invalidate(K,H){Z.delete(hg0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(ME8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(hg0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var ME8="studio.ai-provider-keys.invalidate",RF5=30000,MF5=5000;var VE8=()=>{};class tT1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var IE8=($)=>{let Z;return()=>Z??=$()},oT1,sT1;var kE8=L(()=>{b6();oT1=IE8(()=>G$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),sT1=IE8(()=>G$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function vF5($=_E8){return{name:hB,subjects:[`${EL1}.>`],storage:zU.StorageType.File,max_age:kF5,max_bytes:SF5,max_msgs_per_subject:_F5,discard:zU.DiscardPolicy.Old,retention:zU.RetentionPolicy.Limits,duplicate_window:CF5,num_replicas:$}}class vE8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function CE8($){let Z=SE8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function yF5($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,IF5().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function gF5($,Z){return $.info?.cluster?Z:1}function hF5($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class rT1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=vF5(X);try{await Y.streams.info(hB),await Y.streams.update(hB,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(hB,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(hB),await Y.streams.add(J);else throw G}},Q=await e$(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await zU.jetstreamManager($),X=gF5($,_E8);try{await Z(Y,X)}catch(J){if(X<=1||!hF5(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:tt});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=yF5(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=M98(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=zL1(H,{runId:Z}),N=performance.now()-F;oT1().record(N),sT1().add(1,{"org.id":Y??"unknown"}),fF5?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?CE8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),xF5)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await e$(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:CE8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:tt}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=zL1(Z,{runId:$,dedup:Q});oT1().record(performance.now()-X),sT1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=R98({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?zU.DeliverPolicy.New:zU.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=az($),W;try{W=await e$(async()=>{return(await Y.consumers.get(hB,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:tt})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=Ab0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(wb0()).pipeThrough(Eb0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:j,value:w}=await F.read();if(j){D(),O.close();return}let E=w;if(E.kind==="done"){if(J){D(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(hB,{filter:az($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var zU,SE8,VF5=($)=>{let Z;return()=>Z??=$()},IF5,kF5=86400000000000,CF5=120000000000,SF5=4294967296,_E8,_F5=500000,bF5,xF5,fF5;var bE8=L(()=>{p$();AL1();Tb0();Pb0();b6();kE8();zU=_(xH(),1),SE8=_(s2(),1),IF5=VF5(()=>G$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),_E8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);bF5=process.env.STREAM_ENCODE_TRACE==="1",xF5=process.env.DECOPILOT_STREAM_TRACE==="1";fF5=bF5?new vE8:null});function ug0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,cU(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var xE8=L(()=>{q8()});class aT1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function uF5($,Z,Q={}){let Y=$.startsWith("thread:")?eF($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function eT1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await VB($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await IB($,{threadId:X,runBranch:G?.branch}),K=await d40($,Q,HD0(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=uF5(W,await qS0($,X),{flat:Vh(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await wW(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var fE8=L(()=>{T5();gQ();hQ()});async function yE8($,Z,Q){let Y=Z.organizationId;if(!uJ(Z))return!1;if(!eh(Q))return!1;if(!await hd($,Y,p10))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=K1.shipped,J=await $.storage.taskBoard.update(Z.id,Y,{status:X},Z.updatedBy);return await Q9($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:X,reason:"pr_merged"}}),J8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${X}`),!0}var gE8=L(()=>{jG();v8();fX();It();GU();m5()});function nF5($){return $ instanceof RX}function hE8($,Z){return Z-$>=iF5}class $q1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??lF5;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??cF5,Q=this.options.itemIntervalMs??mF5,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-TN1),tB1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-pF5));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await pB1(this.taskBoard,X,Y),await nB1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==K1.progress||uJ(W)||W.assigneeId!==o$)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await eT1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!hE8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceFromProgress(X,J,K1.review,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:K1.progress,to:K1.review,reason:H}}).catch(()=>{}),J8(J,F),await WU(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==K1.progress||G.assigneeId!==o$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await _O(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),nF5(G)){await this.returnToBacklog(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+dF5)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToBacklog($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==K1.progress)return;let X=await this.taskBoard.returnToBacklogAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:K1.progress,to:K1.intake,reason:Q,retriesSpent:Y.retryAttempts}}).catch(()=>{}),J8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to backlog failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!hE8(BL(Q,Z.reviewCycleStartedAt),Date.now()))return;await WU($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!uJ(Y))return!1;let X=Y.assigneeId===o$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await eT1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await St(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await yE8(G,Y,W))return!0;if(!X)return!1;if(await A48(G,Y))return!0;if(!mB1(W))return!1;return await Ct(G,Y,{previewMatchesHead:cB1(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var lF5=60000,mF5=300000,cF5=50,dF5=60000,iF5=900000,pF5=120000;var uE8=L(()=>{v8();wv0();fE8();vO();xt();GU();gE8();m5();WW();oB1();hQ();a90()});async function lE8($,Z,Q=$2){return await cE8($,Z,Q,{})}async function mE8($,Z,Q,Y=$2){return await cE8($,Q,Y,{activityId:Z})}async function cE8($,Z,Q,Y){let X=await $.automations.findActiveBoardColumnTriggers();if(X.length===0)return 0;let J=new Map;for(let K of X){let H=K.automation.organization_id;J.set(H,[...J.get(H)??[],K])}let G=await $.taskBoard.listSettledTransitions({organizationIds:[...J.keys()],since:new Date(Z-tF5),settledBefore:new Date(Z-Q),limit:oF5,...Y}),W=0;for(let K of G)try{let H=(J.get(K.organizationId)??[]).filter((U)=>U.column_key===K.to&&Date.parse(U.created_at)<Date.parse(K.occurredAt));if(H.length===0)continue;let F=await sF5($.taskBoard,K,Q);for(let U of H){if(!ZZ8(U,{from:F,to:K.to}))continue;if(!await $.automations.claimTriggerFire(U.id,K.activityId))continue;await $.fire({automationId:U.automation_id,organizationId:K.organizationId,triggerId:U.id,target:{kind:"card",itemId:K.itemId,columnKey:K.to,eventKey:K.activityId,movedBy:K.actorId}},{idempotencyKey:`board:${U.id}:${K.activityId}`}),W++}}catch(H){console.error(`[automations] board transition ${K.activityId} failed`,H)}return W}async function sF5($,Z,Q){let X=(await $.listActivity(Z.itemId,Z.organizationId)).flatMap((J)=>{let G=J.data;if(J.action!=="status_changed"||typeof G?.to!=="string")return[];let W=typeof G.from==="string"?G.from:null;return W===G.to?[]:[{from:W,to:G.to,occurredAt:J.occurredAt}]});return X.length>0?QZ8(X,Q):Z.from}var tF5=1800000,oF5=200;var dE8=L(()=>{gO()});import{DBOS as C2,DBOSClient as rF5,SchedulerMode as aF5}from"@dbos-inc/dbos-sdk";function iE8($){jj=$}async function ZU5($){if(!jj)return 0;try{return await mE8(jj,$,Date.now(),jj.settleMs)}catch(Z){return console.error(`[automations] settling board move ${$} failed`,Z),0}}async function QU5(){if(!jj)return 0;try{return await lE8(jj,Date.now(),jj.settleMs)}catch($){return console.error("[automations] board transition sweep failed",$),0}}async function YU5($){await C2.sleep((jj?.settleMs??$2)+$U5),await C2.runStep(()=>ZU5($),{name:"settleBoardMove"})}async function XU5($,Z){let Q=await C2.runStep(()=>QU5(),{name:"sweepBoardMoves"});if(Q>0)console.log(`[automations] board transition sweep fired ${Q} trigger(s) the settle wait missed`)}async function nE8($){let Z=jj;if(!Z||!Qq1)return;if(!await Z.automations.hasActiveBoardColumnTrigger($.taskBoardItemId,$.to))return;let Q=`board-settle:${$.activityId}`;if(!C2.isWithinWorkflow()){await C2.startWorkflow(Qq1,{workflowID:Q,queueName:y2})($.activityId);return}let Y=await rF5.create({systemDatabaseUrl:Z.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:1});try{await Y.enqueue({workflowName:pE8,queueName:y2,workflowID:Q},$.activityId)}finally{await Y.destroy()}}function tE8(){if(Zq1)return;Qq1=C2.registerWorkflow(YU5,{name:pE8}),Zq1=C2.registerWorkflow(XU5,{name:"boardTransitionSweepWorkflow"}),C2.registerScheduled(Zq1,{name:"boardTransitionSweepWorkflow",crontab:eF5,mode:aF5.ExactlyOncePerIntervalWhenActive})}var eF5="*/5 * * * *",$U5=2000,jj=null,pE8="boardTransitionSettleWorkflow",Qq1=null,Zq1=null;var oE8=L(()=>{gO();dE8()});import{readdir as JU5,rm as lg0}from"fs/promises";import{join as mg0}from"path";async function cg0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-GU5),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await su($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await sE8($,X,Z);else if(!X.startsWith(".")){let J=mg0($,X),G=await su(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await sE8(J,K,Z)}if((await su(J)).length===0)await lg0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function sE8($,Z,Q){let Y=0,X=mg0($,Z),J=await su(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=mg0(X,W),H=await su(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=mg0(K,U);await lg0(B,{recursive:!0,force:!0}),Y++}}if((await su(K)).length===0)await lg0(K,{recursive:!0,force:!0})}if((await su(X)).length===0)await lg0(X,{recursive:!0,force:!0});return Y}async function su($){try{return(await JU5($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var GU5=30;var Yq1=()=>{};import{DBOS as Xq1,SchedulerMode as WU5}from"@dbos-inc/dbos-sdk";async function HU5(){let $=[VH(),Jl(),ND()],Z=0;for(let Q of $)try{Z+=await cg0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function FU5($,Z){await Xq1.runStep(()=>HU5(),{name:"monitoringRetention"})}function aE8(){if(rE8)return;rE8=!0;let $=Xq1.registerWorkflow(FU5,{name:"monitoringRetentionWorkflow"});Xq1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:KU5,mode:WU5.ExactlyOncePerIntervalWhenActive})}var KU5="23 4 * * *",rE8=!1;var eE8=L(()=>{mW();Yq1()});function $P8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await xY.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await EP($.db,Z,Y.role);return X.boundAuth=kP1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new MT(Q,void 0,X.boundAuth,Y.role,"self"),tz(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var ZP8=L(()=>{JX();vF()});function QP8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=uQ0(N.params.name),D=N.params.arguments||{},O=Object.keys(D).map((w)=>uQ0(w)),j=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${L9.tool}${B}${L9.dim}(${j})${L9.reset}`}else if(N.method)J=`${L9.dim}${uQ0(N.method)}${L9.reset}`}}catch{}}let W=uQ0(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${L9.mcp}${uQ0(F.slice(0,12))}\u2026${L9.reset}`}else if(X==="/mcp")W=`${L9.mcp}/mcp${L9.reset}`;else if(X==="/mcp/registry")W=`${L9.mcp}/mcp/registry${L9.reset}`;let K=NU5(Y),H=G?"\u25C0":"\u2190";console.log(`${L9.dim}${H}${L9.reset} ${K}${Y}${L9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=UU5(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";console.log(`${L9.dim}${D}${L9.reset} ${K}${Y}${L9.reset} ${W}${J?` ${J}`:""} ${N}${U}${L9.reset} ${L9.duration}${B}${L9.reset}`)}}}var L9,UU5=($)=>{if($>=500)return L9.serverError;if($>=400)return L9.clientError;if($>=300)return L9.redirect;return L9.ok},NU5=($)=>{return L9[$]||L9.reset},uQ0=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var YP8=L(()=>{L9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as WP8}from"crypto";import{mkdir as BU5,readdir as DU5,rm as XP8,stat as KP8}from"fs/promises";import{join as Gq1,relative as LU5}from"path";import{z as G8}from"zod";function FP8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return Gq1(OU5,Z)}function UP8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function Jq1($,Z){let Q=FP8($),Y=UP8(Z);return Gq1(Q,Y)}function jU5($,Z,Q,Y){let X=B0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return WP8("sha256",X).update(J).digest("hex")}function GP8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=jU5(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${UP8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function NP8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${WP8("md5","etag").update(Y).digest("hex")}"`}async function BP8($,Z,Q,Y,X){try{let J=await DU5($,{withFileTypes:!0});for(let G of J){let W=Gq1($,G.name),H=LU5(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await BP8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await KP8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:NP8(W,F.mtime,F.size)})}catch{}}}}catch{}}function DP8($,Z){let Y=Q0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:G8.object({prefix:G8.string().optional(),maxKeys:G8.number().optional().default(1000),continuationToken:G8.string().optional(),delimiter:G8.string().optional()}),outputSchema:G8.object({objects:G8.array(G8.object({key:G8.string(),size:G8.number(),lastModified:G8.string(),etag:G8.string()})),nextContinuationToken:G8.string().optional(),isTruncated:G8.boolean(),commonPrefixes:G8.array(G8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=FP8(Y);await BU5(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await BP8(F,F,G,K,U),U.objects.sort((j,w)=>j.key.localeCompare(w.key));let N=0;if(H){if(N=U.objects.findIndex((j)=>j.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,O=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:G8.object({key:G8.string()}),outputSchema:G8.object({contentType:G8.string().optional(),contentLength:G8.number(),lastModified:G8.string(),etag:G8.string(),metadata:G8.record(G8.string(),G8.string()).optional()}),handler:async(X)=>{let J=X,G=Jq1(Y,J.key),W=await KP8(G);return{contentType:rz1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:NP8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:G8.object({key:G8.string(),expiresIn:G8.number().optional()}),outputSchema:G8.object({url:G8.string(),expiresIn:G8.number()}),handler:async(X)=>{let J=X,G=iO(J.expiresIn,JP8);return{url:GP8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:G8.object({key:G8.string(),expiresIn:G8.number().optional(),contentType:G8.string().optional()}),outputSchema:G8.object({url:G8.string(),expiresIn:G8.number()}),handler:async(X)=>{let J=X,G=iO(J.expiresIn,JP8);return{url:GP8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:G8.object({key:G8.string()}),outputSchema:G8.object({success:G8.boolean(),key:G8.string()}),handler:async(X)=>{let J=X,G=Jq1(Y,J.key);try{return await XP8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:G8.object({keys:G8.array(G8.string()).max(1000)}),outputSchema:G8.object({deleted:G8.array(G8.string()),errors:G8.array(G8.object({key:G8.string(),message:G8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=Jq1(Y,K);try{await XP8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function Wq1($,Z,Q){let Y=DP8(Z,Q),X=new OE({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:SZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:G8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:G8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new qW({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),BH(X,J,$,"mcp:dev-assets")}async function LP8($,Z,Q,Y){let J=DP8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var OU5="./data/assets",JP8=3600,HP8,OP8;var jP8=L(()=>{u1();Jo();H8();VH0();Xo();NJ();pO();Py0();HP8=new Z1;HP8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return Wq1($.req.raw,Z,Y)});OP8=HP8});var wP8={};O6(wP8,{mountDevRoutes:()=>wU5});function wU5($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return Wq1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await LP8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",OP8);let Q=new Z1;Q.use("*",jU({mountPath:"/api/dev-assets"})),Q.route("/",Ey0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var EP8=L(()=>{H8();cz1();Py0();jP8()});var kP8={};O6(kP8,{watchHandler:()=>IP8,resolveVoiceSigningSecret:()=>RP8,resolveCorsOrigin:()=>MP8,isSsoExemptPath:()=>qP8,isAllowedOAuthRedirectUri:()=>VP8,createApp:()=>kU5});import{readFileSync as EU5}from"fs";import{randomBytes as PU5}from"crypto";import{PrometheusSerializer as zU5}from"@opentelemetry/exporter-prometheus";import{DBOS as JD}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as qU5,oAuthProtectedResourceMetadata as RU5}from"better-auth/plugins";async function AU5($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,zP8(PP8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),zP8(PP8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function zP8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function qP8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${Zy0}/`)||$.startsWith(`${of0}/`)}function RP8($){let Z=$.studioJwtSecret||$.betterAuthSecret;if(Z)return Z;return console.warn("STUDIO_JWT_SECRET/BETTER_AUTH_SECRET not set - generating a random secret for voice sessions (not persistent across restarts)"),PU5(32).toString("base64")}function MP8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function VP8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"}async function kU5($={}){let Z=$.database??E8(),Q=!1;I6.stop().catch((F0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",F0)});let Y,X,J,G,W=new pT1,K,H,F,U=null;if($.disableNats)K=nT1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new eZ0,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(F0)=>{return(async()=>{let G0=F0.getReader();try{while(!0){let{done:P0}=await G0.read();if(P0)break}}catch{}finally{G0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=TE8();let F0=B0().natsCredsPath,G0;if(F0)try{G0=EU5(F0,"utf8")}catch(B8){console.error(`[app] failed to read NATS_CREDS at ${F0}; connecting anonymously`,B8)}U.init(B0().natsUrls,{creds:G0,user:B0().natsUser,password:B0().natsPassword});let P0=sZ1()?new bZ1({getJetStream:()=>U.getJetStream(),selfListVersion:vg0.version}):null;P0?.init().catch(()=>{}),Y=P0;let z0=new P71({getJetStream:()=>U.getJetStream()});z0.init().catch(()=>{}),X=z0;let j1=new $u(fB1,{getJetStream:()=>U.getJetStream()}),b$=new $u(e90,{getJetStream:()=>U.getJetStream()});j1.init().catch(()=>{}),b$.init().catch(()=>{}),J={reads:j1,cards:b$};let r$=new Jj1({getJetStream:()=>U.getJetStream()});r$.init().catch(()=>{}),G=r$,K=nT1({getConnection:()=>U.getConnection()}),H=new tT1({getConnection:()=>U.getConnection()}),F=new rT1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),nH8(U),U.onReady(()=>{P0?.init().catch((B8)=>{console.error("[McpListCache] Deferred init failed:",B8)}),z0.init().catch((B8)=>{console.error("[SkillCatalogCache] Deferred init failed:",B8)}),j1.init().catch((B8)=>{console.error("[PrReadCache] Deferred init failed:",B8)}),b$.init().catch((B8)=>{console.error("[PrCardCache] Deferred init failed:",B8)}),r$.init().catch((B8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",B8)}),K.start(),m2$(()=>U.getConnection()),F.init().catch((B8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",B8)})})}if(S2)await S2();xZ1(Y),A71(X),q71(()=>U?.getConnection()??null),yB1(J),Gj1(G);let B={storage:new tm(Z.db),sseHub:I6,onThreadFinished:async(F0,G0)=>vt(new jW(Z.db),F0,G0,new C3(Z.db))},D=new uD1(B),O=new k70(Z.db),j=new aT1(O);j.start(),HZ8(H),H.start((F0)=>{Kb0(F0),D.execute({type:"CANCEL",taskId:F0}).catch((G0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",G0)})}).catch((F0)=>{console.error("[Decopilot] CancelBroadcast start failed:",F0)}),U?.onReady(()=>{H.start().catch((F0)=>{console.error("[CancelBroadcast] Deferred start failed:",F0)})});let w=()=>U?.getConnection()??null;yz1(w),U?.onReady(()=>yz1(w)),uj1(w),U?.onReady(()=>uj1(w)),F.init().catch((F0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",F0)}),S2=async()=>{await D.stopAll(),D.dispose(),j.dispose(),H.stop().catch(()=>{}),BU8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),c2$(),G.teardown(),xZ1(null),A71(null),q71(null),yB1(null),Gj1(null)};let E=new Z1;if(E.use("*",Qj1({enabled:(F0)=>xo(F0,"debug")==="1"})),E.use("*",Uh0),E.use("/*",mH8({origin:(F0,G0)=>MP8(F0,{baseUrl:B0().baseUrl,requestOrigin:new URL(G0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(F0,G0)=>{if(await G0(),F0.req.path.includes("/files/"))return;if(F0.req.path.includes("/fs/")&&F0.req.path.endsWith("/read"))return;F0.header("X-Frame-Options","DENY"),F0.header("Content-Security-Policy","frame-ancestors 'none'")}),B0().nodeEnv==="development")E.use("*",QP8());E.use("*",async(F0,G0)=>{if(await G0(),is(F0.req.path))return;if(F0.res.status>=500){let z0=await F0.res.clone().text();console.error(`[5xx Response] ${F0.req.method} ${F0.req.path} - ${F0.res.status}:`,z0)}}),E.get(tX.HEALTH,(F0)=>{if(Q)return F0.json({status:"shutting_down"},503);return F0.json({status:"ok"})}),E.get(tX.HEALTH_LIVE,(F0)=>{return F0.json({status:"ok"})}),E.get(tX.HEALTH_READY,async(F0)=>{if(Q)return F0.json({status:"shutting_down"},503);let G0={};if(G0.postgres={status:await AU5(Z.pool)?"up":"down"},U)G0.nats=U.isConnected()?{status:"up"}:{status:"down"};else G0.nats={status:"down"};let P0=G0.postgres.status==="up",z0=P0?200:503;return F0.json({status:P0?"ready":"not_ready",services:G0},z0)}),E.get(tX.METRICS,async(F0)=>{try{let G0=await Lh0.collect(),P0=TU5.serialize(G0.resourceMetrics);return F0.text(P0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(G0){return console.error("Failed to collect metrics:",G0),F0.text("# Error collecting metrics",500)}});let P=1800000;E.get(`${tX.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(F0)=>{let G0=F0.req.param("queueName");if(!MU5.has(G0))return F0.json({error:`Unknown queue: ${G0}`},404);let[P0,z0]=await Promise.all([JD.listQueuedWorkflows({queueName:G0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),JD.listQueuedWorkflows({queueName:G0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-P).toISOString()})]);return F0.json({queue_length:P0.length,in_flight:z0.length})}),E.route("/api/config",vw8),E.route("/api/_reports",cw8),E.route("/api/_stripe",vT1),E.route("/api/_github",pw8({taskBoard:()=>l,contextFactory:()=>b})),E.route("/api/_git",oo);let T={db:Z.db,encryptionKey:B0().encryptionKey};E.route("/api/_jira",YE8(T)),E.route("/api/_jira",sw8(T)),E.route("/report",uw8($.clientDir)),E.route("/api/auth/custom",BF8),E.all("/api/auth/admin/*",$U8),E.all("/api/auth/*",async(F0)=>{return await B4.handler(F0.req.raw)});let z=cW8();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",d70),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",d70),E.route("/",z),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",R70),E.route("/",tW8()),E.use("/oauth-proxy/:connectionId/*",d70),E.all("/oauth-proxy/:connectionId/*",AP8);let A=async(F0)=>{let P0=await VU5()(F0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",d70),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let R=async(F0)=>{let P0=await IU5()(F0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",R);let f=dH8({ttlMs:120000}),S=await mK8({db:Z.db,auth:B4,encryption:{key:B0().encryptionKey},observability:{tracer:Rj,meter:G$},modelListCache:W,providerKeyCache:K,memberRoleCache:f});xY.set(S),G$$({db:Z.db,baseUrl:B5()}),cK8({db:Z.db}),nK8({db:Z.db}),PH8({db:Z.db}),IH8({db:Z.db}),$E8({db:Z.db,encryptionKey:B0().encryptionKey}),D88({db:Z.db}),bH8({db:Z.db}),p88({db:Z.db});let V=ZE(Z.db),v=new I00(Z.db),b=$P8({db:Z.db});rL1({storage:V,studioContextFactory:b,orgContextFactory:(F0)=>hJ(Z.db,F0),systemDatabaseUrl:g10(B0().databaseUrl,B0().databasePgSsl)}),bL1({systemDatabaseUrl:g10(B0().databaseUrl,B0().databasePgSsl),studioContextFactory:b,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:I6}}),IL1({dispatchRunFn:w98,studioContextFactory:b,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:I6}});let h=new tm(Z.db),l=new jW(Z.db),d=new C3(Z.db),W0=new $q1(l,b,d);if(B0().taskBoardReviewSweeperEnabled){W0.start();let F0=S2;S2=async()=>{await F0?.(),W0.dispose()}}iE8({automations:V,taskBoard:l,fire:XH,systemDatabaseUrl:g10(B0().databaseUrl,B0().databasePgSsl),settleMs:B0().boardTransitionSettleSeconds*1000}),T88(nE8),h98({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let F0=U?.getConnection();return F0?await TP8.jetstreamManager(F0):null},messageParts:h.messageParts(),resolveRun:async(F0)=>{let G0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",F0).executeTakeFirst();return G0?{orgId:G0.organization_id,createdBy:G0.created_by,version:G0.message_storage_version??1,status:G0.status,runFenceToken:G0.run_fence_token,title:G0.title??null}:null},completeRunIfNotCompleted:async(F0,G0)=>{let P0=await h.completeRunIfNotCompleted(F0,G0);if(ug0(I6,G0,F0,P0),P0)await vt(l,F0,G0,d);return P0},markRunRequiresAction:async(F0,G0)=>{let P0=await h.requiresActionIfInProgress(F0,G0);return ug0(I6,G0,F0,P0),P0},markRunFailed:async(F0,G0,P0,z0)=>{let j1=await h.markRunFailed(F0,G0,P0,z0);if(ug0(I6,G0,F0,j1),j1)await vt(l,F0,G0,d);return j1},clearSynthesizedError:async(F0,G0)=>{await h.messageParts().replaceMessageParts(F0,rz(F0,G0),[])},persistTitle:(F0,G0,P0)=>h.update(F0,G0,{title:P0}),onTitleUpdated:async({runId:F0,orgId:G0,title:P0})=>{let z0=await h.get(F0,G0).catch(()=>null);I6.emit(G0,cU(F0,z0?.status??"in_progress",{title:P0,virtualMcpId:z0?.virtual_mcp_id??void 0,createdBy:z0?.created_by,triggerId:z0?.trigger_id,branch:z0?.branch??null,harnessId:z0?.harness_id??void 0,createdAt:z0?.created_at,updatedAt:z0?.updated_at}))},bumpProgress:async({runId:F0,orgId:G0})=>{await h.bumpProgress(F0,G0)},recordCompleted:async({runId:F0,orgId:G0,distinctId:P0,usage:z0})=>{m1.capture({distinctId:P0,event:"chat_message_completed",groups:{organization:G0},properties:{organization_id:G0,thread_id:F0,transport:"projector",input_tokens:z0.inputTokens,output_tokens:z0.outputTokens,total_tokens:z0.totalTokens}})},recordFailed:async({runId:F0,orgId:G0,distinctId:P0,reason:z0,kind:j1})=>{m1.capture({distinctId:P0,event:"chat_message_failed",groups:{organization:G0},properties:{organization_id:G0,thread_id:F0,transport:"projector",error_category:j1,error_message:z0}})},purgeRun:async(F0)=>{F.purge(F0)}}),l58({studioContextFactory:b,systemDatabaseUrl:g10(B0().databaseUrl,B0().databasePgSsl),streamBuffer:F}),aE8(),W$$(),iK8(),oK8(),AH8(),CH8(),QE8(),tE8(),E88(),fH8(),n88(),tw8();let I0=async(F0,G0,P0)=>{let z0=await V.findById(F0,G0);if(!z0)throw Error("Automation not found");return QO1({automationId:z0.id,organizationId:z0.organization_id,triggerId:null})},J0=new mo(V,({automation:F0,trigger:G0,contextMessages:P0,idempotencyKey:z0})=>XH({automationId:F0.id,organizationId:F0.organization_id,triggerId:G0.id,contextMessages:P0},{idempotencyKey:z0})),U0=[VH(),Jl(),ND()];for(let F0 of U0)cg0(F0).then(()=>{}).catch((G0)=>console.error("[monitoring] Retention cleanup failed:",G0));let o=()=>B4.api.deleteAllExpiredApiKeys().catch((F0)=>console.error("[auth] Expired API key cleanup failed:",F0));o(),setInterval(o,86400000).unref(),E.use("*",async(F0,G0)=>{if(Hh0(F0.req.path))return G0();let P0={measure:async(j1,b$)=>{NH(F0,j1);try{return await b$()}finally{RW(F0,j1)}}},z0=await xY.create(F0.req.raw,{timings:P0});z0.automationRunner=I0,F0.set("studioContext",z0);try{await G0()}finally{let j1=z0.pendingRevalidations;if(j1.length>0)Promise.race([Promise.allSettled(j1),J$(30000)]).catch((r$)=>console.error("[studio] revalidation cleanup error:",r$))}}),E.use("/api/:org/decopilot/*",yo),E.use("/api/:org/v1/*",yo),E.use("/api/:org/files/*",yo),E.use("*",async(F0,G0)=>{if(qP8(F0.req.path))return G0();let P0=F0.get("studioContext");if(!P0?.organization?.id||!P0?.auth?.user?.id)return G0();if(!(await P0.storage.orgSsoConfig.getByOrgId(P0.organization.id))?.enforced)return G0();if(!await P0.storage.orgSsoSessions.isValid(P0.auth.user.id,P0.organization.id))return F0.json({error:"SSO authentication required for this organization"},403);return G0()});let t=new Z1;t.use("*",jU({mountPath:"/api/org-sso"})),t.route("/",Xy0()),E.route("/api/org-sso",t),E.get("/api/tools/management",(F0)=>{return F0.json({tools:v00,grouped:qT()})}),E.use("/mcp/*",async(F0,G0)=>{NH(F0,"mcp");try{return await G0()}finally{RW(F0,"mcp")}});let r=async(F0,G0)=>{let P0=F0.var.studioContext;if(!P0.auth.user?.id&&!P0.auth.apiKey?.id){let z0=new URL(F0.req.url),j1=F0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),b$=j1?`${j1}://${z0.host}`:z0.origin;return F0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${b$}${z0.pathname}/.well-known/oauth-protected-resource"`}})}return await G0()};if(E.use("/mcp/:connectionId?",r),E.use("/mcp/gateway/:virtualMcpId?",r),E.use("/mcp/virtual-mcp/:virtualMcpId?",r),E.use("/mcp/self",r),bK()){let{mountDevRoutes:F0}=(EP8(),rg0(wP8));F0(E,r)}let $0=new Z1;$0.use("*",jU({mountPath:"/mcp"})),$0.route("/",Xx0()),E.route("/mcp",$0);let X0=new Z1;X0.use("*",jU({mountPath:"/mcp/self"})),X0.route("/",ry0()),E.route("/mcp/self",X0);let h0=new Z1;h0.use("*",jU({mountPath:"/mcp"})),h0.route("/",Wx0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(F0,G0)=>{NH(F0,"llm_models");try{return await G0()}finally{RW(F0,"llm_models")}});let C0=EU8({cancelBroadcast:H,streamBuffer:F,runRegistry:D});E.route("/api",C0),E.route("/api",WE8);let H1=new Z1;H1.use("*",jU({mountPath:"/api"})),H1.route("/",Zg0()),E.route("/api",H1),E.route("/api",Iw8);let m0=new Z1;m0.use("*",jU({mountPath:"/api"})),m0.route("/",Qg0({tokenStorage:v,automationEventDispatcher:J0})),E.route("/api",m0);let j0=new k00(Z.db),E0=new Z1;E0.use("*",jU({mountPath:"/api"})),E0.route("/",Fy0()),E.route("/api",E0),E.route("/api/deco-sites",bU8());let n0=new Z1;n0.use("*",jU({mountPath:"/api/deco-sites"})),n0.route("/",Ny0()),E.route("/api/deco-sites",n0),E.route(Zy0,ZU8()),E.route(EL8,AL8()),E.route("/api/_editor-resolve",Cw8()),E.route(EF8,PF8()),E.route(of0,xF8());let O1=B0(),o0=O1.elevenlabsApiKey?new Cg0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,x0={openai:O1.openaiLiveApiKey?new RT1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:o0?new qT1(o0,()=>U?.getConnection()??null):null},d0=new CT1({adapter:o0,conversationAdapters:x0,defaults:O1,secret:RP8(O1),getConnection:()=>U?.getConnection()??null}),i0=Qw8({voiceSessions:d0,kvStorage:j0,runRegistry:D,streamBuffer:F,sseHub:I6,cancelBroadcast:H,tokenStorage:v,automationEventDispatcher:J0,mountDevAssets:bK(),mcpAuth:r,oauthProxyHandler:AP8,watchHandler:IP8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((F0)=>{return F0.json({error:"Not Found",path:F0.req.path},404)}),E.onError(zU8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([I6.stop(),S2?Promise.resolve(S2()).finally(()=>{S2=null}):Promise.resolve()]),U)await U.drain().catch((F0)=>console.error("[shutdown] NATS drain error:",F0));console.log("[shutdown] Flushing telemetry..."),await tJ().catch((F0)=>console.error("[shutdown] Telemetry flush error:",F0)),console.log("[shutdown] Closing database..."),await DH$(Z).catch((F0)=>console.error("[shutdown] Database close error:",F0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await JD.registerQueue(H3,{partitionQueue:!0,concurrency:tL1,minPollingIntervalMs:oL1}),await JD.registerQueue(uW,{partitionQueue:!0,concurrency:_L1,priorityEnabled:!0}),await JD.registerQueue(FD,{workerConcurrency:B0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await JD.registerQueue(UD,{workerConcurrency:B0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await JD.registerQueue(qj,{partitionQueue:!0,concurrency:u58}),await JD.registerQueue(f2,i88),await JD.registerQueue(y2),await dz1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((F0)=>JD.deleteQueue(F0))),await sL1(Z.pool),rN$().catch((F0)=>{console.error("[studio-pack-backfill] failed:",F0)}),gd(Z.db).catch((F0)=>{console.error("[automations] built-in seed failed:",F0)}),K$$().catch((F0)=>{console.error("[org-fs] public-sets boot sync kick failed:",F0)})}})}var TP8,PP8=5000,S2=null,AP8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await xY.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let v=await $.req.json().catch(()=>({}));return $.json({...typeof v==="object"&&v!==null?v:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await ko(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=rE1(await W.json());if(!K)K=H.origin;let N=await M70(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),D;if(Y==="authorize")D=B.authorization_endpoint;else if(Y==="token")D=B.token_endpoint;else if(Y==="register")D=B.registration_endpoint;if(!D)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=nW8(D);if(O)return O;let j=new URL(D),w=new URL($.req.url);if(j.search=w.search,Y==="authorize"){let v=j.searchParams.get("redirect_uri");if(v){let b=B0().baseUrl??w.origin;try{if(!VP8(new URL(v),b))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}j.searchParams.set("redirect_uri",v)}if(j.searchParams.has("resource"))j.searchParams.set("resource",U);if(gH8(G.connection_url))j.searchParams.set("auto_personal","true"),j.searchParams.set("force_new","true");return $.redirect(j.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},P=$.req.header("Content-Type");if(P)E["Content-Type"]=P;let T=$.req.header("Authorization");if(T)E.Authorization=T;let z,A=null,R=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&P?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let d=atob(T.slice(6).trim()),W0=d.indexOf(":");if(W0!==-1){let I0=decodeURIComponent(d.slice(0,W0)),J0=decodeURIComponent(d.slice(W0+1));A=I0||null,R=J0||null}}catch{}let v=await $.req.formData();if(v.has("resource"))v.set("resource",U);let b=v.get("client_id"),h=v.get("client_secret");if(typeof b==="string"&&b)A=b;if(typeof h==="string"&&h)R=h;let l=new URLSearchParams;for(let[d,W0]of v.entries())l.append(d,W0.toString());z=l.toString()}else if(Y==="register"&&P?.toLowerCase().includes("application/json")){let v=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),b=await $.req.text(),h={};try{h=b?JSON.parse(b):{}}catch{z=b}let l=typeof h==="object"&&h!==null&&!Array.isArray(h);if(z===void 0&&!l)z=b;if(z===void 0){let d=h,W0=d.metadata&&typeof d.metadata==="object"?d.metadata:{};d.metadata={...W0,organization_id:G.organization_id,...v?.slug?{organization_slug:v.slug}:{},...v?.name?{organization_name:v.name}:{}},z=JSON.stringify(d),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let f=await fetch(j.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),S=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[v,b]of f.headers.entries())if(!V.includes(v.toLowerCase()))S.set(v,b);if(Y==="token"&&f.ok){let v=await f.text();try{let b=JSON.parse(v);if(typeof b.access_token==="string"&&b.access_token){let h=typeof b.expires_in==="number"?new Date(Date.now()+b.expires_in*1000):null,l=null;try{l=await L2(G.connection_url)??D}catch{l=D}let d={connectionId:Z,accessToken:b.access_token,refreshToken:typeof b.refresh_token==="string"?b.refresh_token:null,scope:typeof b.scope==="string"?b.scope:null,expiresAt:h,clientId:A,clientSecret:R,tokenEndpoint:l};await new e5(X.db,X.vault).upsert(d)}}catch(b){console.error("[oauth-proxy] failed to persist downstream token:",b)}return new Response(v,{status:f.status,statusText:f.statusText,headers:S})}return new Response(f.body,{status:f.status,statusText:f.statusText,headers:S})},IP8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!xB(Y)||!await fB(Z)))return $.json({error:"forbidden"},403);let W=G?Xv0:Y;if(G)SO({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return Bj($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!I6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{I6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),I6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),I6.remove(W,K),N()})})})},TU5,MU5,VU5=()=>RU5(B4),IU5=()=>qU5(B4);var CP8=L(()=>{p$();u1();H$$();pK8();sK8();TH8();SH8();G70();OB1();yH8();a90();H9();pi();q8();H8();if0();cH8();Yj1();nK();vF();Fz1();S3();b6();Q6();jz1();zF8();fF8();qz1();QU8();vz1();lz1();mz1();xK();V70();cz1();AU8();nf0();Yw8();Kw8();Hw8();Bw8();Tw8();nz1();Jx0();$70();kw8();Kx0();RA1();Sw8();TA1();bw8();lw8();dw8();iw8();nw8();ow8();rw8();XE8();dT1();ez1();KE8();qA1();EA1();ZY0();qE8();ST1();TJ();vB0();B40();hB1();W40();H40();Kj1();RE8();VE8();gz1();bE8();rv0();xE8();He();_00();CO();m5();BP1();uE8();oE8();jG();nz();eE8();eF0();Yq1();mW();iz1();IO();ML1();eF0();bZ0();V00();j01();ZP8();QE();YP8();Ns();Fz1();Mt();it();Hb0();TP8=_(xH(),1);TU5=new zU5,MU5=new Set([H3,uW,FD,UD,qj,f2])});var bP8={};O6(bP8,{resolveClientDir:()=>fU5,resolveAssetPathWithTraversalCheck:()=>vP8,isPathWithinDirectory:()=>_P8,createAssetHandler:()=>yU5});import{resolve as lQ0,dirname as CU5,join as SU5,extname as _U5,basename as vU5,sep as SP8}from"path";function bU5($,Z){if($===Z||vU5($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${SP8}assets${SP8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function _P8($,Z){let Q=lQ0(Z),Y=lQ0($);return Y===Q||Y.startsWith(Q+"/")}function vP8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=lQ0(Z,Q);if(!_P8(Y,Z))return null;return Y}function fU5($,Z="../client"){let Q=new URL($),Y=CU5(Q.pathname);return lQ0(Y,Z)}function yU5($={}){let{env:Z="production",clientDir:Q=xU5,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=vP8({requestPath:W,clientDir:Q});if(!K)return null;let H=SU5(K,"index.html"),F=lQ0(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(_U5(K))?[H,F]:[];for(let D of[K,...B])try{let O=Bun.file(D);if(await O.exists())return new Response(O,{headers:bU5(D,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var xU5="./dist/client";var xP8=()=>{};var fP8={};O6(fP8,{tryUpgradePreviewWs:()=>dU5,tryHandlePreviewHttp:()=>cU5,previewWebSocketHandler:()=>iU5,parsePreviewBaseDomain:()=>mU5,isPreviewWsData:()=>dg0,extractHandleFromHost:()=>Kq1});function uU5($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function lU5(){return new Response(hU5,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function mU5($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function Kq1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function cU5($,Z){let Q=Kq1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return cQ0(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(_n)&&uU5($))return lU5();return X.headers.delete(_n),X}function cQ0($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function dg0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function dU5($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=Kq1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return cQ0(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return cQ0(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return cQ0(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return cQ0(426,"upgrade failed");return}function mQ0($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var gU5=256,hU5='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',iU5;var yP8=L(()=>{g50();iU5={open($){let Z=$.data;if(!dg0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),mQ0($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{mQ0($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{mQ0($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!dg0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=gU5){mQ0($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!dg0(Z))return;mQ0($,Z,1000,"")}}});p$();var zq1="14";function Aq1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:zq1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}p$();import Zz8 from"pg";var Tq1=8314027461559302n,Qz8=600000,Yz8=500;async function qq1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=Qz8}=$,X=$.log??((K)=>console.log(K)),J=new Zz8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[Tq1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await J$(Yz8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[Tq1.toString()])}catch{}await J.end().catch(()=>{})}}u1();Zh0();b6();function Z28(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function wh0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function GR1(){let $=Z28();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:wh0($,"--cpu-prof-dir")??process.cwd(),name:wh0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(wh0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}zh0();var XY0;function LR1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=u2();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),XY0=setInterval(()=>void Z().catch(()=>{}),$),XY0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(XY0)clearInterval(XY0)}}import*as X28 from"bun:jsc";var{startSamplingProfiler:J28,samplingProfilerStackTraces:G28}=X28;function OR1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{J28()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=G28()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function jR1(){GR1();let $=[LR1(),DR1(),OR1()];return()=>{for(let Z of $)Z()}}import{existsSync as eU5}from"fs";var gW=B0();YR1();var{DBOS:dQ0,DBOSClient:pU5}=await import("@dbos-inc/dbos-sdk");function Dq1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var nU5=[H3,uW,FD,UD,qj,f2,y2],tU5=gW.dispatchRole==="worker"?nU5:gW.dispatchRole==="api"?[]:void 0;dQ0.setConfig(Aq1({systemDatabaseUrl:Dq1(gW.databaseUrl,gW.databasePgSsl),poolSize:gW.dbosPoolSize,executorID:gW.podName,listenQueues:tU5}));var{createApp:oU5}=await Promise.resolve().then(() => (CP8(),kP8)),{isServerPath:sU5}=await Promise.resolve().then(() => (ZY0(),uq1)),{createAssetHandler:rU5,resolveClientDir:mP8}=await Promise.resolve().then(() => (xP8(),bP8)),aU5=gW.port,gP8=mP8(import.meta.url,"../client"),cP8=eU5(gP8)?gP8:mP8(import.meta.url,"../dist/client"),$N5=rU5({clientDir:cP8,isServerPath:sU5}),ZN5={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function QN5($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(ZN5))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:YN5,tryHandlePreviewHttp:XN5,tryUpgradePreviewWs:JN5,previewWebSocketHandler:Hq1,isPreviewWsData:Fq1}=await Promise.resolve().then(() => (yP8(),fP8)),{getOrInitSharedRunner:dP8}=await Promise.resolve().then(() => (SX(),Sn$)),iP8=YN5(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),hP8={baseDomain:iP8??"",getRunner:dP8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())dP8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var ig0=await oU5({clientDir:cP8}),Uq1=process.env.DBOS_CONDUCTOR_KEY?.trim(),uP8=process.env.DBOS_CONDUCTOR_URL?.trim();await qq1({databaseUrl:Dq1(gW.databaseUrl,gW.databasePgSsl)},()=>dQ0.launch({...Uq1?{conductorKey:Uq1}:{},...Uq1&&uP8?{conductorURL:uP8}:{}}));console.log(`[dbos] application version: ${dQ0.applicationVersion}`);var Nq1=5,Bq1=0;await e$(async()=>{Bq1++;try{return await ig0.initDbos()}catch($){let Z=Bq1>=Nq1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${Bq1}/${Nq1} failed, ${Z}`,$),$}},{maxAttempts:Nq1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});var GN5=Bun.serve({idleTimeout:0,port:aU5,hostname:"0.0.0.0",fetch:async($,Z)=>{if(iP8){let Y=await JN5($,Z,hP8);if(Y===void 0)return;if(Y)return Y;let X=await XN5($,hP8);if(X)return X}let Q=await $N5($);if(Q)return QN5(Q);return ig0.fetch($,{server:Z})},websocket:{open($){if(Fq1($.data))Hq1.open($)},message($,Z){if(Fq1($.data))Hq1.message($,Z)},close($){if(Fq1($.data))Hq1.close($)}},development:!1}),WN5=jR1();if(gW.localMode)Promise.resolve().then(() => (Qu(),dv0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (Qu(),dv0));Z()}catch{}});var lP8=!1;async function KN5($){let Z;try{Z=await pU5.create({systemDatabaseUrl:Dq1(gW.databaseUrl,gW.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:uW,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:uW}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function pg0($){if(lP8)return;lP8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{WN5(),ig0.markShuttingDown();let J=Rq1(gW.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await J$(J),await GN5.stop(!0);let G=dQ0.executorID;await dQ0.shutdown(),await KN5(G),await ig0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>pg0("SIGTERM"));process.on("SIGINT",()=>pg0("SIGINT"));process.on("SIGHUP",()=>pg0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),pg0("uncaughtException")});