decocms 2.297.0 → 2.297.1

package/dist/server/server.js

@@ -4818,7 +4818,7 @@ mkdir -p /app && chown deco:deco /app
 `);let Q=Y.pax;if(Q)for(let J in Q)G+=wM0(" "+J+"="+Q[J]+`
 `);return d9.from(G)};Im5.decodePax=function(Y){let G={};while(Y.length){let Q=0;while(Q<Y.length&&Y[Q]!==32)Q++;let J=parseInt(d9.toString(Y.subarray(0,Q)),10);if(!J)return G;let $=d9.toString(Y.subarray(Q+1,J-1)),Z=$.indexOf("=");if(Z===-1)return G;G[$.slice(0,Z)]=$.slice(Z+1),Y=Y.subarray(J)}return G};Im5.encode=function(Y){let G=d9.alloc(512),Q=Y.name,J="";if(Y.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(d9.byteLength(Q)!==Q.length)return null;while(d9.byteLength(Q)>100){let $=Q.indexOf("/");if($===-1)return null;J+=J?"/"+Q.slice(0,$):Q.slice(0,$),Q=Q.slice($+1)}if(d9.byteLength(Q)>100||d9.byteLength(J)>155)return null;if(Y.linkname&&d9.byteLength(Y.linkname)>100)return null;if(d9.write(G,Q),d9.write(G,HA(Y.mode&4095,6),100),d9.write(G,HA(Y.uid,6),108),d9.write(G,HA(Y.gid,6),116),qm5(Y.size,G,124),d9.write(G,HA(Y.mtime.getTime()/1000|0,11),136),G[156]=48+Em5(Y.type),Y.linkname)d9.write(G,Y.linkname,157);if(d9.copy(xs6,G,257),d9.copy(Nm5,G,263),Y.uname)d9.write(G,Y.uname,265);if(Y.gname)d9.write(G,Y.gname,297);if(d9.write(G,HA(Y.devmajor||0,6),329),d9.write(G,HA(Y.devminor||0,6),337),J)d9.write(G,J,345);return d9.write(G,HA(gs6(G),6),148),G};Im5.decode=function(Y,G,Q){let J=Y[156]===0?0:Y[156]-48,$=It(Y,0,100,G),Z=KA(Y,100,8),W=KA(Y,108,8),K=KA(Y,116,8),H=KA(Y,124,12),U=KA(Y,136,12),N=Lm5(J),B=Y[157]===0?null:It(Y,157,100,G),O=It(Y,265,32),z=It(Y,297,32),w=KA(Y,329,8),E=KA(Y,337,8),P=gs6(Y);if(P===256)return null;if(P!==KA(Y,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(zm5(Y)){if(Y[345])$=It(Y,345,155,G)+"/"+$}else if(Dm5(Y));else if(!Q)throw Error("Invalid tar header: unknown format.");if(J===0&&$&&$[$.length-1]==="/")J=5;return{name:$,mode:Z,uid:W,gid:K,size:H,mtime:new Date(1000*U),type:N,linkname:B,uname:O,gname:z,devmajor:w,devminor:E,pax:null}};function zm5(X){return d9.equals(xs6,X.subarray(257,263))}function Dm5(X){return d9.equals(Bm5,X.subarray(257,263))&&d9.equals(Om5,X.subarray(263,265))}function wm5(X,Y,G){if(typeof X!=="number")return G;if(X=~~X,X>=Y)return Y;if(X>=0)return X;if(X+=Y,X>=0)return X;return 0}function Lm5(X){switch(X){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Em5(X){switch(X){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function hs6(X,Y,G,Q){for(;G<Q;G++)if(X[G]===Y)return G;return Q}function gs6(X){let Y=256;for(let G=0;G<148;G++)Y+=X[G];for(let G=156;G<512;G++)Y+=X[G];return Y}function HA(X,Y){if(X=X.toString(8),X.length>Y)return"7777777777777777777".slice(0,Y)+" ";return"0000000000000000000".slice(0,Y-X.length)+X+" "}function Pm5(X,Y,G){Y[G]=128;for(let Q=11;Q>0;Q--)Y[G+Q]=X&255,X=Math.floor(X/256)}function qm5(X,Y,G){if(X.toString(8).length>11)Pm5(X,Y,G);else d9.write(Y,HA(X,11),G)}function Am5(X){let Y;if(X[0]===128)Y=!0;else if(X[0]===255)Y=!1;else return null;let G=[],Q;for(Q=X.length-1;Q>0;Q--){let Z=X[Q];if(Y)G.push(Z);else G.push(255-Z)}let J=0,$=G.length;for(Q=0;Q<$;Q++)J+=G[Q]*Math.pow(256,Q);return Y?J:-1*J}function KA(X,Y,G){if(X=X.subarray(Y,Y+G),Y=0,X[Y]&128)return Am5(X);else{while(Y<X.length&&X[Y]===32)Y++;let Q=wm5(hs6(X,32,Y,X.length),X.length,X.length);while(Y<Q&&X[Y]===0)Y++;if(Q===Y)return 0;return parseInt(d9.toString(X.subarray(Y,Q)),8)}}function It(X,Y,G,Q){return d9.toString(X.subarray(Y,hs6(X,0,Y,Y+G)),Q)}function wM0(X){let Y=d9.byteLength(X),G=Math.floor(Math.log(Y)/Math.log(10))+1;if(Y+G>=Math.pow(10,G))G++;return Y+G+X}});var ns6=k((x2G,ps6)=>{var{Writable:Sm5,Readable:km5,getStreamError:us6}=DM0(),Cm5=FM0(),ls6=At(),jt=LM0(),vm5=ls6.alloc(0);class ms6{constructor(){this.buffered=0,this.shifted=0,this.queue=new Cm5,this._offset=0}push(X){this.buffered+=X.byteLength,this.queue.push(X)}shiftFirst(X){return this._buffered===0?null:this._next(X)}shift(X){if(X>this.buffered)return null;if(X===0)return vm5;let Y=this._next(X);if(X===Y.byteLength)return Y;let G=[Y];while((X-=Y.byteLength)>0)Y=this._next(X),G.push(Y);return ls6.concat(G)}_next(X){let Y=this.queue.peek(),G=Y.byteLength-this._offset;if(X>=G){let Q=this._offset?Y.subarray(this._offset,Y.byteLength):Y;return this.queue.shift(),this._offset=0,this.buffered-=G,this.shifted+=G,Q}return this.buffered-=X,this.shifted+=X,Y.subarray(this._offset,this._offset+=X)}}class ds6 extends km5{constructor(X,Y,G){super();this.header=Y,this.offset=G,this._parent=X}_read(X){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();X(null)}_predestroy(){this._parent.destroy(us6(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=is6(this.header.size),this._parent._update()}_destroy(X){this._detach(),X(null)}}class cs6 extends Sm5{constructor(X){super(X);if(!X)X={};this._buffer=new ms6,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=EM0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=X.filenameEncoding||"utf-8",this._allowUnknownFormat=!!X.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(X){if(this._locked=!1,X){this.destroy(X),this._continueWrite(X);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=jt.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(X){return this._continueWrite(X),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(X){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=jt.decodeLongPath(X,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=jt.decodeLongPath(X,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=jt.decodePax(X);break;case"pax-header":this._pax=this._paxGlobal===null?jt.decodePax(X):Object.assign({},this._paxGlobal,jt.decodePax(X));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=is6(this._header.size);let X=this._buffer.shift(this._header.size);try{this._decodeLongHeader(X)}catch(Y){return this._continueWrite(Y),!1}return!0}_consumeStream(){let X=this._buffer.shiftFirst(this._missing);if(X===null)return!1;this._missing-=X.byteLength;let Y=this._stream.push(X);if(this._missing===0){if(this._stream.push(null),Y)this._stream._detach();return Y&&this._locked===!1}return Y}_createStream(){return new ds6(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let X=this._buffer.shiftFirst(this._missing);if(X!==null)this._missing-=X.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(X){let Y=this._callback;this._callback=EM0,Y(X)}_write(X,Y){this._callback=Y,this._buffer.push(X),this._update()}_final(X){this._finished=this._missing===0&&this._buffer.buffered===0,X(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(X){if(this._stream)this._stream.destroy(us6(this));X(null)}[Symbol.asyncIterator](){let X=null,Y=null,G=null,Q=null,J=null,$=this;return this.on("entry",K),this.on("error",(N)=>{X=N}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return U(null)},throw(N){return U(N)}};function Z(N){if(!J)return;let B=J;J=null,B(N)}function W(N,B){if(X)return B(X);if(Q){N({value:Q,done:!1}),Q=null;return}if(Y=N,G=B,Z(null),$._finished&&Y)Y({value:void 0,done:!0}),Y=G=null}function K(N,B,O){if(J=O,B.on("error",EM0),Y)Y({value:B,done:!1}),Y=G=null;else Q=B}function H(){if(Z(X),!Y)return;if(X)G(X);else Y({value:void 0,done:!0});Y=G=null}function U(N){return $.destroy(N),Z(N),new Promise((B,O)=>{if($.destroyed)return B({value:void 0,done:!0});$.once("close",function(){if(N)O(N);else B({value:void 0,done:!0})})})}}}ps6.exports=function(Y){return new cs6(Y)};function EM0(){}function is6(X){return X&=511,X&&512-X}});var as6=k((h2G,PM0)=>{var rs6={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{PM0.exports=_1("fs").constants||rs6}catch{PM0.exports=rs6}});var Ge6=k((g2G,Ye6)=>{var{Readable:_m5,Writable:fm5,getStreamError:ts6}=DM0(),ou=At(),Tt=as6(),Hu1=LM0(),os6=ou.alloc(1024);class ss6 extends fm5{constructor(X,Y,G){super({mapWritable:ym5,eagerOpen:!0});if(this.written=0,this.header=Y,this._callback=G,this._linkname=null,this._isLinkname=Y.type==="symlink"&&!Y.linkname,this._isVoid=Y.type!=="file"&&Y.type!=="contiguous-file",this._finished=!1,this._pack=X,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(X){if(this._openCallback=X,this._pack._stream===this)this._continueOpen()}_continuePack(X){if(this._callback===null)return;let Y=this._callback;this._callback=null,Y(X)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let X=this._openCallback;if(this._openCallback=null,X===null)return;if(this._pack.destroying)return X(Error("pack stream destroyed"));if(this._pack._finalized)return X(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);X(null)}_write(X,Y){if(this._isLinkname)return this._linkname=this._linkname?ou.concat([this._linkname,X]):X,Y(null);if(this._isVoid){if(X.byteLength>0)return Y(Error("No body allowed for this entry"));return Y()}if(this.written+=X.byteLength,this._pack.push(X))return Y();this._pack._drain=Y}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?ou.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);Xe6(this._pack,this.header.size),this._pack._done(this)}_final(X){if(this.written!==this.header.size)return X(Error("Size mismatch"));this._finish(),X(null)}_getError(){return ts6(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(X){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),X()}}class es6 extends _m5{constructor(X){super(X);this._drain=qM0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(X,Y,G){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Y==="function")G=Y,Y=null;if(!G)G=qM0;if(!X.size||X.type==="symlink")X.size=0;if(!X.type)X.type=bm5(X.mode);if(!X.mode)X.mode=X.type==="directory"?493:420;if(!X.uid)X.uid=0;if(!X.gid)X.gid=0;if(!X.mtime)X.mtime=new Date;if(typeof Y==="string")Y=ou.from(Y);let Q=new ss6(this,X,G);if(ou.isBuffer(Y))return X.size=Y.byteLength,Q.write(Y),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(os6),this.push(null)}_done(X){if(X!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(X){if(!X.pax){let Y=Hu1.encode(X);if(Y){this.push(Y);return}}this._encodePax(X)}_encodePax(X){let Y=Hu1.encodePax({name:X.name,linkname:X.linkname,pax:X.pax}),G={name:"PaxHeader",mode:X.mode,uid:X.uid,gid:X.gid,size:Y.byteLength,mtime:X.mtime,type:"pax-header",linkname:X.linkname&&"PaxHeader",uname:X.uname,gname:X.gname,devmajor:X.devmajor,devminor:X.devminor};this.push(Hu1.encode(G)),this.push(Y),Xe6(this,Y.byteLength),G.size=X.size,G.type=X.type,this.push(Hu1.encode(G))}_doDrain(){let X=this._drain;this._drain=qM0,X()}_predestroy(){let X=ts6(this);if(this._stream)this._stream.destroy(X);while(this._pending.length){let Y=this._pending.shift();Y.destroy(X),Y._continueOpen()}this._doDrain()}_read(X){this._doDrain(),X()}}Ye6.exports=function(Y){return new es6(Y)};function bm5(X){switch(X&Tt.S_IFMT){case Tt.S_IFBLK:return"block-device";case Tt.S_IFCHR:return"character-device";case Tt.S_IFDIR:return"directory";case Tt.S_IFIFO:return"fifo";case Tt.S_IFLNK:return"symlink"}return"file"}function qM0(){}function Xe6(X,Y){if(Y&=511,Y)X.push(os6.subarray(0,512-Y))}function ym5(X){return ou.isBuffer(X)?X:ou.from(X)}});var Qe6=k((xm5)=>{xm5.extract=ns6();xm5.pack=Ge6()});var $e6=k((l2G,Ze6)=>{Ze6.exports=Je6;function Je6(X,Y){if(X&&Y)return Je6(X)(Y);if(typeof X!=="function")throw TypeError("need wrapper function");return Object.keys(X).forEach(function(Q){G[Q]=X[Q]}),G;function G(){var Q=Array(arguments.length);for(var J=0;J<Q.length;J++)Q[J]=arguments[J];var $=X.apply(this,Q),Z=Q[Q.length-1];if(typeof $==="function"&&$!==Z)Object.keys(Z).forEach(function(W){$[W]=Z[W]});return $}}});var IM0=k((m2G,AM0)=>{var We6=$e6();AM0.exports=We6(Fu1);AM0.exports.strict=We6(Ke6);Fu1.proto=Fu1(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Fu1(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return Ke6(this)},configurable:!0})});function Fu1(X){var Y=function(){if(Y.called)return Y.value;return Y.called=!0,Y.value=X.apply(this,arguments)};return Y.called=!1,Y}function Ke6(X){var Y=function(){if(Y.called)throw Error(Y.onceError);return Y.called=!0,Y.value=X.apply(this,arguments)},G=X.name||"Function wrapped with `once`";return Y.onceError=G+" shouldn't be called more than once",Y.called=!1,Y}});var Ue6=k((d2G,Fe6)=>{var um5=IM0(),lm5=function(){},mm5=global.Bare?queueMicrotask:process.nextTick.bind(process),dm5=function(X){return X.setHeader&&typeof X.abort==="function"},cm5=function(X){return X.stdio&&Array.isArray(X.stdio)&&X.stdio.length===3},He6=function(X,Y,G){if(typeof Y==="function")return He6(X,null,Y);if(!Y)Y={};G=um5(G||lm5);var{_writableState:Q,_readableState:J}=X,$=Y.readable||Y.readable!==!1&&X.readable,Z=Y.writable||Y.writable!==!1&&X.writable,W=!1,K=function(){if(!X.writable)H()},H=function(){if(Z=!1,!$)G.call(X)},U=function(){if($=!1,!Z)G.call(X)},N=function(E){G.call(X,E?Error("exited with error code: "+E):null)},B=function(E){G.call(X,E)},O=function(){mm5(z)},z=function(){if(W)return;if($&&!(J&&(J.ended&&!J.destroyed)))return G.call(X,Error("premature close"));if(Z&&!(Q&&(Q.ended&&!Q.destroyed)))return G.call(X,Error("premature close"))},w=function(){X.req.on("finish",H)};if(dm5(X))if(X.on("complete",H),X.on("abort",O),X.req)w();else X.on("request",w);else if(Z&&!Q)X.on("end",K),X.on("close",K);if(cm5(X))X.on("exit",N);if(X.on("end",U),X.on("finish",H),Y.error!==!1)X.on("error",B);return X.on("close",O),function(){if(W=!0,X.removeListener("complete",H),X.removeListener("abort",O),X.removeListener("request",w),X.req)X.req.removeListener("finish",H);X.removeListener("end",K),X.removeListener("close",K),X.removeListener("finish",H),X.removeListener("exit",N),X.removeListener("end",U),X.removeListener("error",B),X.removeListener("close",O)}};Fe6.exports=He6});var Oe6=k((c2G,Be6)=>{var im5=IM0(),pm5=Ue6(),Uu1;try{Uu1=_1("fs")}catch(X){}var fQ1=function(){},nm5=typeof process>"u"?!1:/^v?\.0/.test(process.version),Nu1=function(X){return typeof X==="function"},rm5=function(X){if(!nm5)return!1;if(!Uu1)return!1;return(X instanceof(Uu1.ReadStream||fQ1)||X instanceof(Uu1.WriteStream||fQ1))&&Nu1(X.close)},am5=function(X){return X.setHeader&&Nu1(X.abort)},tm5=function(X,Y,G,Q){Q=im5(Q);var J=!1;X.on("close",function(){J=!0}),pm5(X,{readable:Y,writable:G},function(Z){if(Z)return Q(Z);J=!0,Q()});var $=!1;return function(Z){if(J)return;if($)return;if($=!0,rm5(X))return X.close(fQ1);if(am5(X))return X.abort();if(Nu1(X.destroy))return X.destroy();Q(Z||Error("stream was destroyed"))}},Ne6=function(X){X()},om5=function(X,Y){return X.pipe(Y)},sm5=function(){var X=Array.prototype.slice.call(arguments),Y=Nu1(X[X.length-1]||fQ1)&&X.pop()||fQ1;if(Array.isArray(X[0]))X=X[0];if(X.length<2)throw Error("pump requires two streams per minimum");var G,Q=X.map(function(J,$){var Z=$<X.length-1,W=$>0;return tm5(J,Z,W,function(K){if(!G)G=K;if(K)Q.forEach(Ne6);if(Z)return;Q.forEach(Ne6),Y(G)})});return X.reduce(om5)};Be6.exports=sm5});var Ie6=k((Gd5)=>{var ze6=Qe6(),De6=Oe6(),we6=_1("fs"),rY=_1("path"),bQ1=(global.Bare?global.Bare.platform:process.platform)==="win32";Gd5.pack=function(Y,G){if(!Y)Y=".";if(!G)G={};let Q=G.fs||we6,J=G.ignore||G.filter||yQ1,$=G.mapStream||qe6,Z=Yd5(Q,G.dereference?Q.stat:Q.lstat,Y,J,G.entries,G.sort),W=G.strict!==!1,K=typeof G.umask==="number"?~G.umask:~Le6(),H=G.pack||ze6.pack(),U=G.finish||yQ1,N=G.map||yQ1,B=typeof G.dmode==="number"?G.dmode:0,O=typeof G.fmode==="number"?G.fmode:0;if(G.strip)N=Ae6(N,G.strip);if(G.readable)B|=parseInt(555,8),O|=parseInt(444,8);if(G.writable)B|=parseInt(333,8),O|=parseInt(222,8);E();function z(P,q){Q.readlink(rY.join(Y,P),function(V,M){if(V)return H.destroy(V);q.linkname=jM0(M),H.entry(q,E)})}function w(P,q,V){if(H.destroyed)return;if(P)return H.destroy(P);if(!q){if(G.finalize!==!1)H.finalize();return U(H)}if(V.isSocket())return E();let M={name:jM0(q),mode:(V.mode|(V.isDirectory()?B:O))&K,mtime:V.mtime,size:V.size,type:"file",uid:V.uid,gid:V.gid};if(V.isDirectory())return M.size=0,M.type="directory",M=N(M)||M,H.entry(M,E);if(V.isSymbolicLink())return M.size=0,M.type="symlink",M=N(M)||M,z(q,M);if(M=N(M)||M,!V.isFile()){if(W)return H.destroy(Error("unsupported type for "+q));return E()}let T=H.entry(M,E),S=$(Q.createReadStream(rY.join(Y,q),{start:0,end:M.size>0?M.size-1:M.size}),M);S.on("error",function(C){T.destroy(C)}),De6(S,T)}function E(P){if(P)return H.destroy(P);Z(w)}return H};function em5(X){return X.length?X[X.length-1]:null}function Xd5(){return!global.Bare&&process.getuid?process.getuid():-1}function Le6(){return!global.Bare&&process.umask?process.umask():0}Gd5.extract=function(Y,G){if(!Y)Y=".";if(!G)G={};Y=rY.resolve(Y);let Q=G.fs||we6,J=G.ignore||G.filter||yQ1,$=G.mapStream||qe6,Z=G.chown!==!1&&!bQ1&&Xd5()===0,W=G.extract||ze6.extract(),K=[],H=new Date,U=typeof G.umask==="number"?~G.umask:~Le6(),N=G.strict!==!1,B=G.validateSymlinks!==!1,O=G.map||yQ1,z=typeof G.dmode==="number"?G.dmode:0,w=typeof G.fmode==="number"?G.fmode:0;if(G.strip)O=Ae6(O,G.strip);if(G.readable)z|=parseInt(555,8),w|=parseInt(444,8);if(G.writable)z|=parseInt(333,8),w|=parseInt(222,8);if(W.on("entry",E),G.finish)W.on("finish",G.finish);return W;function E(T,S,C){T=O(T)||T,T.name=jM0(T.name);let _=rY.join(Y,rY.join("/",T.name));if(J(_,T))return S.resume(),C();let v=rY.join(_,".")===rY.join(Y,".")?Y:rY.dirname(_);Pe6(Q,v,rY.join(Y,"."),function(m,e){if(m)return C(m);if(!e)return C(Error(v+" is not a valid path"));if(T.type==="directory")return K.push([_,T.mtime]),M(_,{fs:Q,own:Z,uid:T.uid,gid:T.gid,mode:T.mode},y);M(v,{fs:Q,own:Z,uid:T.uid,gid:T.gid,mode:493},function(s){if(s)return C(s);switch(T.type){case"file":return b();case"link":return i();case"symlink":return g()}if(N)return C(Error("unsupported type for "+_+" ("+T.type+")"));S.resume(),C()})});function y(m){if(m)return C(m);q(_,T,function(e){if(e)return C(e);if(bQ1)return C();V(_,T,C)})}function g(){if(bQ1)return C();Q.unlink(_,function(){let m=rY.resolve(rY.dirname(_),T.linkname);if(!n(m)&&B)return C(Error(_+" is not a valid symlink"));Ee6(Q,m,rY.join(Y,"."),function(e,s){if(e)return C(e);if(!s&&B)return C(Error(_+" is not a valid symlink"));Q.symlink(T.linkname,_,y)})})}function i(){if(bQ1)return C();Q.unlink(_,function(){let m=rY.join(Y,rY.join("/",T.linkname));Q.realpath(m,function(e,s){if(e||!n(s))return C(Error(_+" is not a valid hardlink"));Q.link(s,_,function(O1){if(O1&&O1.code==="EPERM"&&G.hardlinkAsFilesFallback)return S=Q.createReadStream(s),b();y(O1)})})})}function n(m){return m===Y||m.startsWith(Y+rY.sep)}function b(){let m=Q.createWriteStream(_),e=$(S,T);m.on("error",function(s){e.destroy(s)}),De6(e,m,function(s){if(s)return C(s);m.on("close",y)})}}function P(T,S){let C;while((C=em5(K))&&T.slice(0,C[0].length)!==C[0])K.pop();if(!C)return S();Q.utimes(C[0],H,C[1],S)}function q(T,S,C){if(G.utimes===!1)return C();if(S.type==="directory")return Q.utimes(T,H,S.mtime,C);if(S.type==="symlink")return P(T,C);Q.utimes(T,H,S.mtime,function(_){if(_)return C(_);P(T,C)})}function V(T,S,C){let _=S.type==="symlink",v=_?Q.lchmod:Q.chmod,y=_?Q.lchown:Q.chown;if(!v)return C();let g=(S.mode|(S.type==="directory"?z:w))&U;if(y&&Z)y.call(Q,T,S.uid,S.gid,i);else i(null);function i(n){if(n)return C(n);if(!v)return C();v.call(Q,T,g,C)}}function M(T,S,C){Q.stat(T,function(_){if(!_)return C(null);if(_.code!=="ENOENT")return C(_);Q.mkdir(T,{mode:S.mode,recursive:!0},function(v,y){if(v)return C(v);V(T,S,C)})})}};function Ee6(X,Y,G,Q){if(Y===G)return Q(null,!0);if(!Y.startsWith(G+rY.sep))return Q(null,!1);X.lstat(Y,function(J,$){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return Q(J);if(J||!$.isSymbolicLink())return Ee6(X,rY.join(Y,".."),G,Q);Q(null,!1)})}function Pe6(X,Y,G,Q){if(Y===G)return Q(null,!0);X.lstat(Y,function(J,$){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return Q(J);if(J||$.isDirectory())return Pe6(X,rY.join(Y,".."),G,Q);Q(null,!1)})}function yQ1(){}function qe6(X){return X}function jM0(X){return bQ1?X.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):X}function Yd5(X,Y,G,Q,J,$){if(!J)J=["."];let Z=J.slice(0);return function(K){if(!Z.length)return K(null);let H=Z.shift(),U=rY.join(G,H);Y.call(X,U,function(N,B){if(N)return K(J.indexOf(H)===-1&&N.code==="ENOENT"?null:N);if(!B.isDirectory())return K(null,H,B);X.readdir(U,function(O,z){if(O)return K(O);if($)z.sort();for(let w=0;w<z.length;w++)if(!Q(rY.join(G,H,z[w])))Z.push(rY.join(H,z[w]));K(null,H,B)})})}}function Ae6(X,Y){return function(G){G.name=G.name.split("/").slice(Y).join("/");let Q=G.linkname;if(Q&&(G.type==="link"||rY.isAbsolute(Q)))G.linkname=Q.split("/").slice(Y).join("/");return X(G)}}});var Zd5,$d5;var je6=D(()=>{KM0();Zd5=Y1(Us6(),1),$d5=Y1(Ie6(),1)});var Bu1=()=>{};var Te6=D(()=>{Mg1()});var Ve6=D(()=>{Xu1();eg1();Bu1()});var Me6=()=>{};var Re6=()=>{};var TM0=D(()=>{po6();$M0();Xu1();oo6();JM0();KM0();so6();eo6();Xs6();Ys6();ZM0();Gs6();je6();Bu1();Te6();Ve6();Me6();Re6();Bu1()});var FG,u7,Vt,xQ1;var hQ1=D(()=>{FG={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};u7=class u7 extends Error{cause;constructor(X,Y){super(X);if(this.name="SandboxError",this.cause=Y,Y instanceof Error&&Y.stack)this.stack=`${this.stack}
 Caused by: ${Y.stack}`}};Vt=class Vt extends u7{constructor(X,Y){super(X,Y);this.name="SandboxTimeoutError"}};xQ1=class xQ1 extends u7{constructor(X,Y){super(X,Y);this.name="SandboxAlreadyExistsError"}}});async function Wd5(X){let Y=X.getCurrentCluster();if(!Y)throw new u7("No active cluster in kubeconfig");let G={};await X.applyToHTTPSOptions(G);let Q={},J=G.headers??{};for(let[$,Z]of Object.entries(J))if(Array.isArray(Z))Q[$]=Z.join(", ");else if(Z!==void 0)Q[$]=String(Z);if(typeof G.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(G.auth).toString("base64")}`;return{server:Y.server.replace(/\/+$/,""),headers:Q,tls:{cert:VM0(G.cert),key:VM0(G.key),ca:VM0(G.ca),rejectUnauthorized:Y.skipTLSVerify?!1:void 0}}}function VM0(X){if(X==null)return;if(typeof X==="string")return X;if(Buffer.isBuffer(X))return X.toString("utf8");return String(X)}async function su(X,Y){let G=await Wd5(X),Q={...G.headers,...Y.headers};if(Y.method==="PATCH")Q["content-type"]=Y.patchType==="apply"?"application/apply-patch+yaml":Y.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Y.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let J={method:Y.method,headers:Q,body:Y.body===void 0?void 0:JSON.stringify(Y.body),signal:Y.signal,tls:G.tls};return fetch(`${G.server}${Y.path}`,J)}async function RM0(X){try{return await X.json()}catch{return null}}async function SM0(X,Y){if(X.ok)return;let G=await RM0(X),Q=G?.message??`${Y} failed: ${X.status} ${X.statusText}`;throw new MM0(X.status,G,Q)}async function gQ1(X,Y,G,Q,J="none"){try{let $=await su(X,Y);if($.status===404)return null;if(await SM0($,G),J==="json")return await $.json();return null}catch($){throw new u7(Q,$)}}async function uQ1(X,Y,G){let Q=`${Se6}/${encodeURIComponent(Y)}/${FG.CLAIM_PLURAL}`,J;try{J=await su(X,{method:"POST",path:Q,body:G})}catch(H){let U=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} transport error: ${U}`),new u7(`Failed to create SandboxClaim: ${G.metadata.name} (transport error: ${U})`,H)}if(J.ok)return;let $=await RM0(J),Z=$?.reason?` ${$.reason}`:"",W=$?.message??J.statusText,K=`Failed to create SandboxClaim: ${G.metadata.name} (${J.status}${Z}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} rejected: status=${J.status} reason=${$?.reason??"<none>"} message=${W}`),J.status===409)throw new xQ1(K);throw new u7(K)}async function Ou1(X,Y,G,Q=60000){let J=Date.now()+Q,$=500,Z;while(!0){let W=await Xl(X,Y,G).catch(()=>{return});if(!W)return;if(Z=W,Date.now()>=J){let K=Z.metadata?.finalizers??[],H=Z.metadata?.deletionTimestamp??"<unknown>";throw new Vt(`SandboxClaim ${G} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await new Promise((K)=>setTimeout(K,500))}}function kM0(X,Y){return`${Se6}/${encodeURIComponent(X)}/${FG.CLAIM_PLURAL}/${encodeURIComponent(Y)}`}async function ke6(X,Y,G,Q){await gQ1(X,{method:"PATCH",path:kM0(Y,G),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${G}`)}async function eu(X,Y,G){await gQ1(X,{method:"DELETE",path:kM0(Y,G)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${G}`)}async function Xl(X,Y,G){return await gQ1(X,{method:"GET",path:kM0(Y,G)},"getSandboxClaim",`Failed to get SandboxClaim: ${G}`,"json")??void 0}function fe6(X,Y){return`${_e6}/${encodeURIComponent(X)}/${CM0}/${encodeURIComponent(Y)}`}function Kd5(X){return`${_e6}/${encodeURIComponent(X)}/${CM0}`}async function zu1(X,Y,G){try{let Q=await su(X,{method:"POST",path:Kd5(Y),body:G});if(Q.status===409)return;await SM0(Q,"createHttpRoute")}catch(Q){if(Q instanceof MM0&&Q.status===409)return;throw new u7(`Failed to create HTTPRoute: ${G.metadata.name}`,Q)}}async function Du1(X,Y,G){await gQ1(X,{method:"DELETE",path:fe6(Y,G)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${G}`)}async function be6(X,Y,G){return await gQ1(X,{method:"GET",path:fe6(Y,G)},"getHttpRoute",`Failed to get HTTPRoute: ${G}`,"json")??void 0}async function ye6(X,Y,G,Q){let J={apiVersion:"v1",kind:"Service",metadata:{name:G},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},$=new URLSearchParams({fieldManager:Hd5,force:"true"}),Z=`/api/v1/namespaces/${encodeURIComponent(Y)}/services/${encodeURIComponent(G)}?${$}`;try{let W=await su(X,{method:"PATCH",path:Z,patchType:"apply",body:J});await SM0(W,"ensureServicePort")}catch(W){throw new u7(`Failed to apply Service ports: ${G}`,W)}}function wu1(X,Y,G,Q=180){let J=`/apis/${FG.SANDBOX_API_GROUP}/${FG.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Y)}/${FG.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`,{resolve:$,reject:Z,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,U=setTimeout(()=>{if(H)return;H=!0,K.abort(),Z(new Vt(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),N=(B)=>{if(H)return;H=!0,clearTimeout(U),K.abort(),B()};return(async()=>{let B;try{B=await su(X,{method:"GET",path:J,signal:K.signal,headers:{accept:"application/json"}})}catch(O){N(()=>Z(new u7("Failed to start watch for sandbox readiness",O)));return}if(!B.ok||!B.body){let O=await RM0(B).catch(()=>null);N(()=>Z(new u7(`Watch handshake failed (${B.status}): ${O?.message??B.statusText}`)));return}try{for await(let O of vM0(B.body)){if(H)return;if(O.type==="ERROR"){let q=O.object;N(()=>Z(new u7(`Watch stream error while waiting for sandbox: ${q.message??"unknown"}`)));return}if(O.type!=="ADDED"&&O.type!=="MODIFIED")continue;let z=O.object;if(!z.status?.conditions?.find((q)=>q.type==="Ready"&&q.status==="True"))continue;let E=z.metadata?.name;if(!E){N(()=>Z(new u7("Sandbox metadata or name is missing")));return}let P=z.metadata?.annotations?.[FG.POD_NAME_ANNOTATION]??E;N(()=>$({sandboxName:E,podName:P}));return}N(()=>Z(new u7("Watch stream closed before sandbox became ready")))}catch(O){if(H)return;if(O instanceof Error&&(O.name==="AbortError"||K.signal.aborted))return;N(()=>Z(new u7("Watch stream error while waiting for sandbox",O)))}})(),W}async function*vM0(X){let Y=X.getReader(),G=new TextDecoder,Q="";try{while(!0){let{value:$,done:Z}=await Y.read();if(Z)break;Q+=G.decode($,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let J=Q.trim();if(J)yield JSON.parse(J)}finally{Y.releaseLock()}}var MM0,Se6,Ce6="gateway.networking.k8s.io",ve6="v1",CM0="httproutes",_e6,lQ1,Hd5="mesh-sandbox-runner";var Lu1=D(()=>{hQ1();MM0=class MM0 extends Error{status;body;constructor(X,Y,G){super(G);this.status=X;this.body=Y;this.name="KubeHttpError"}};Se6=`/apis/${FG.CLAIM_API_GROUP}/${FG.CLAIM_API_VERSION}/namespaces`;_e6=`/apis/${Ce6}/${ve6}/namespaces`;lQ1={API_GROUP:Ce6,API_VERSION:ve6,PLURAL:CM0}});async function*ge6(X){let Y=X.now??(()=>Date.now()),G=Y(),Q=X.schedulingTimeoutMs??Nd5,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:G},$=[],Z=null,W=!1,K=(E)=>{if(W)return;if(Z){let P=Z;Z=null,P(E)}else $.push(E)},H=()=>{if($.length>0)return Promise.resolve($.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{Z=E})},U=()=>{if(W)return;if(W=!0,Z){let E=Z;Z=null,E(null)}},N=new AbortController,B=()=>{N.abort(),U()};if(X.signal)if(X.signal.aborted)N.abort(),U();else X.signal.addEventListener("abort",B,{once:!0});let O=Math.max(0,Q-(Y()-G)),z=setTimeout(()=>K("tick"),O+100),w=Promise.allSettled([Bd5(X.kc,X.namespace,X.claimName,N.signal,J,K,Y),zd5(X.kc,X.namespace,X.claimName,N.signal,J,K),Dd5(X.kc,X.namespace,X.claimName,N.signal,J,K,Y)]);try{let E=null,P=-1,q=xe6(J,Q,Y);if(E=fM0(q),!_M0(q))P=he6(q);if(yield q,_M0(q))return;while(!W){if(await H()===null)break;let M=xe6(J,Q,Y);if(_M0(M)){let C=fM0(M);if(C!==E)E=C,yield M;return}let T=he6(M);if(T<P)continue;let S=fM0(M);if(S!==E)E=S,P=T,yield M}}finally{if(clearTimeout(z),N.abort(),X.signal)X.signal.removeEventListener("abort",B);U(),await w.catch(()=>{})}}function xe6(X,Y,G){let{pod:Q,sandbox:J,events:$,startedAt:Z}=X;if(J.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&$.lastFailedSchedulingAt!==void 0&&G()-Z>Y)return{kind:"failed",reason:"scheduling-timeout",message:$.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Y/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:Z};if(W==="ContainerCreating"&&$.hasPulled)return{kind:"starting-container",since:Z};if($.hasPulling&&!$.hasPulled)return{kind:"pulling-image",since:Z};if(Q.scheduledFalseReason==="Unschedulable"||$.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:Z,message:$.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:$.nominatedNodeClaim};return{kind:"claiming",since:Z}}function _M0(X){return X.kind==="ready"||X.kind==="failed"}function he6(X){switch(X.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function fM0(X){switch(X.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return X.kind;case"waiting-for-capacity":return`waiting-for-capacity:${X.message??""}:${X.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${X.reason}:${X.message}`}}async function Bd5(X,Y,G,Q,J,$,Z){let W=`/api/v1/namespaces/${encodeURIComponent(Y)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Fd5}=${G}`)}`;return bM0({kc:X,path:W,signal:Q,label:`pod/${G}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object;if(H.metadata?.name!==G)return;Od5(H,J,Z),$("pod")}})}function Od5(X,Y,G){let J=(X.status?.conditions??[]).find((Z)=>Z.type==="PodScheduled");if(J?.status==="True")Y.pod.scheduled=!0,Y.pod.scheduledFalseReason=void 0,Y.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")Y.pod.scheduled=!1,Y.pod.scheduledFalseReason=J.reason,Y.pod.scheduledFalseMessage=J.message;let $=(X.status?.containerStatuses??[]).find((Z)=>Z.name===Ud5);if($)Y.pod.containerWaitingReason=$.state?.waiting?.reason,Y.pod.containerRunning=!!$.state?.running,Y.pod.containerReady=$.ready===!0}async function zd5(X,Y,G,Q,J,$){let Z=`/apis/${FG.SANDBOX_API_GROUP}/${FG.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Y)}/${FG.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`;return bM0({kc:X,path:Z,signal:Q,label:`sandbox/${G}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((U)=>U.type==="Ready");if(!H)return;if(H.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=H.reason,J.sandbox.notReadyMessage=H.message;$("sandbox")}})}async function Dd5(X,Y,G,Q,J,$,Z){let W=`/api/v1/namespaces/${encodeURIComponent(Y)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${G},involvedObject.kind=Pod`)}`;return bM0({kc:X,path:W,signal:Q,label:`events/${G}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object,U=H.reason;if(!U)return;switch(U){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=Z(),J.events.failedSchedulingMessage=H.message;break;case"Nominated":{let N=H.message?.match(/nodeclaim\/([\w-]+)/);if(N)J.events.nominatedNodeClaim=N[1];break}default:return}$("event")}})}async function bM0(X){let{kc:Y,path:G,signal:Q,label:J,onEvent:$}=X,Z=0;while(!Q.aborted){try{let K=await su(Y,{method:"GET",path:G,signal:Q,headers:{accept:"application/json"}});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}Z=0;for await(let H of vM0(K.body)){if(Q.aborted)return;try{$(H)}catch(U){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${U instanceof Error?U.message:String(U)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${J} watch ended: ${H}`)}if(Q.aborted)return;let W=Math.min(250*2**Z,5000);Z+=1,await wd5(W,Q)}}function wd5(X,Y){return new Promise((G)=>{if(Y.aborted){G();return}let Q=setTimeout(()=>{Y.removeEventListener("abort",J),G()},X),J=()=>{clearTimeout(Q),G()};Y.addEventListener("abort",J,{once:!0})})}var Fd5="studio.decocms.com/sandbox-handle",Ud5="sandbox",Nd5=300000;var ue6=D(()=>{hQ1();Lu1()});import{createHash as Ld5,randomBytes as Ed5,randomUUID as Pd5}from"crypto";import*as ie6 from"net";import{PassThrough as qd5}from"stream";class lM0{kind=YO;records=new Map;inflight=new aq;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;closed=!1;constructor(X={}){this.stateStore=X.stateStore??null,this.previewUrlPattern=X.previewUrlPattern??null,this.kubeConfig=X.kubeConfig??Cd5(),this.portForward=new HM0(this.kubeConfig),this.namespace=X.namespace??Ad5,this.sandboxTemplateName=X.sandboxTemplateName??Id5,this.envName=xd5(X.envName),this.tokenGenerator=X.tokenGenerator??(()=>Ed5(Td5).toString("hex")),this.idleTtlMs=X.idleTtlMs??Md5,this.metrics=X.meter?kd5(X.meter):null,this.previewGateway=X.previewGateway&&X.previewUrlPattern?{...X.previewGateway}:null}async ensure(X,Y={}){let G=this.computeHandle(X,Y.repo?.branch??null);return this.inflight.run(G,()=>PM(this.stateStore,X,YO,(Q)=>this.ensureLocked(X,G,Y,Q)))}async exec(X,Y){let G=await this.requireRecord(X);return sa(G.daemonUrl,G.token,Y)}async delete(X){let Y=await this.getRecord(X);if(this.records.delete(X),Y)this.closeForwarder(Y.daemonForward),this.metrics?.active.add(-1,gM0(Y.tenant));if(await this.deleteHttpRouteIfManaged(X).catch((G)=>{console.warn(`[${PW}] HTTPRoute delete failed for ${X}: ${G instanceof Error?G.message:String(G)}`)}),await eu(this.kubeConfig,this.namespace,X),this.stateStore)if(Y)await this.stateStore.delete(Y.id,YO);else await this.stateStore.deleteByHandle(YO,X)}async alive(X){return await Xl(this.kubeConfig,this.namespace,X)!==void 0}watchClaimLifecycle(X,Y){return ge6({kc:this.kubeConfig,namespace:this.namespace,claimName:X,signal:Y})}async getPreviewUrl(X){let Y=await this.getRecord(X);if(!Y)return null;return this.composePreviewUrl(Y)}async proxyDaemonRequest(X,Y,G){let Q=await this.getRecord(X);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=performance.now(),$=0;try{let Z=await ea(Q.daemonUrl,Q.token,Y,G);return $=Z.status,Z}finally{this.recordProxyDuration("daemon",$,Q,performance.now()-J)}}async resolvePreviewUpstreamUrl(X){if(this.previewUrlPattern)return`http://${X}.${this.namespace}.svc.cluster.local:${Yl}`;let Y=await this.getRecord(X);if(Y)return Y.daemonUrl;let G=await this.resurrectByHandle(X);return G?G.daemonUrl:null}async proxyPreviewRequest(X,Y){let G=performance.now(),Q=this.records.get(X)??null,J=0;try{let $=await this.resolvePreviewUpstreamUrl(X);if(!$)return J=404,xM0(404,{error:"sandbox not found"});let Z=new URL(Y.url);if((Z.pathname==="/_decopilot_vm"||Z.pathname.startsWith("/_decopilot_vm/"))&&Y.method!=="GET")return J=404,xM0(404,{error:"not found"});let K=(z)=>`${z}${Z.pathname}${Z.search}`,H=new Headers(Y.headers);for(let z of Rd5)H.delete(z);let U=Y.method!=="GET"&&Y.method!=="HEAD",N={method:Y.method,headers:H,body:U?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:U?"half":void 0},B;try{B=await fetch(K($),N)}catch(z){let w=`${$}${Z.pathname}`;if(console.warn(`[${PW}] preview fetch to ${w} failed: ${z instanceof Error?z.message:String(z)}`),Y.method==="GET"||Y.method==="HEAD"){if(this.invalidateRecord(X),await this.resurrectByHandle(X).catch(()=>null)){let P=await this.resolvePreviewUpstreamUrl(X);if(P)try{B=await fetch(K(P),N);let q=new Headers;for(let[V,M]of B.headers.entries())if(!le6.includes(V.toLowerCase()))q.set(V,M);return J=B.status,new Response(B.body,{status:B.status,statusText:B.statusText,headers:q})}catch(q){console.warn(`[${PW}] preview fetch retry to ${w} failed: ${q instanceof Error?q.message:String(q)}`)}}}else this.invalidateRecord(X);return J=502,xM0(502,{error:"sandbox daemon unreachable"})}let O=new Headers;for(let[z,w]of B.headers.entries())if(!le6.includes(z.toLowerCase()))O.set(z,w);return J=B.status,new Response(B.body,{status:B.status,statusText:B.statusText,headers:O})}finally{this.recordProxyDuration("preview",J,Q,performance.now()-G,X)}}async ensureLocked(X,Y,G,Q){if(G.image)console.warn(`[${PW}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${G.image}`);if(Q){let Z=await Q.get(X,YO);if(Z){let W=await this.rehydrate(X,Y,Z);if(W)return this.finish(W,Q,!1,!0,"resume");await Q.delete(X,YO)}}let J=await Xl(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await Ou1(this.kubeConfig,this.namespace,Y).catch((Z)=>{console.warn(`[${PW}] wait for terminating claim ${Y} failed: ${Z instanceof Error?Z.message:String(Z)}`)});else{let Z=await this.adopt(X,Y,J).catch((W)=>{return console.warn(`[${PW}] adopt ${Y} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(Z)return this.finish(Z,Q,!0,!0,"adopt");await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),await Ou1(this.kubeConfig,this.namespace,Y).catch((W)=>{console.warn(`[${PW}] wait for deleted claim ${Y} failed: ${W instanceof Error?W.message:String(W)}`)})}let $=await this.provision(X,Y,G);return this.finish($,Q,!0,!1,"fresh")}async finish(X,Y,G,Q,J){let $=this.records.has(X.handle);if(this.records.set(X.handle,X),G)await this.persist(Y,X);if(Q)await ke6(this.kubeConfig,this.namespace,X.handle,this.computeShutdownTime()).catch((Z)=>console.warn(`[${PW}] TTL refresh failed for ${X.handle}: ${Z instanceof Error?Z.message:String(Z)}`));if(this.metrics){let Z=gM0(X.tenant);if(this.metrics.ensureOutcome.add(1,{...Z,outcome:J}),!$)this.metrics.active.add(1,Z)}return this.toSandbox(X)}buildEnvMap(X,Y){let G={},Q=[];for(let[Z,W]of Object.entries(X.env??{}))if(Vd5.has(Z))Q.push(Z);else G[Z]=W;if(Q.length>0)console.warn(`[${PW}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);let J=X.repo,$=J?J.displayName??ld5(J.cloneUrl):null;return{...G,DAEMON_TOKEN:Y.token,DAEMON_BOOT_ID:Y.daemonBootId,APP_ROOT:Y.workdir,PROXY_PORT:String(Yl),DEV_PORT:String(X.workload?.devPort??jd5),RUNTIME:X.workload?.runtime??"node",...J?{CLONE_URL:J.cloneUrl,REPO_NAME:$??"",BRANCH:J.branch??"",GIT_USER_NAME:J.userName,GIT_USER_EMAIL:J.userEmail}:{},...X.workload?.packageManager?{PACKAGE_MANAGER:X.workload.packageManager}:{}}}buildClaim(X,Y,G){let Q=this.buildEnvMap(Y,G);return{apiVersion:`${FG.CLAIM_API_GROUP}/${FG.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:X,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[AU.env]:this.envName}:{},...hM0(Y.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:hM0(Y.tenant,{[AU.role]:"claimed",[AU.sandboxHandle]:X,...this.envName?{[AU.env]:this.envName}:{}})},env:Object.entries(Q).sort(([J],[$])=>J<$?-1:J>$?1:0).map(([J,$])=>({name:J,value:$})),warmpool:"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(X,Y,G){let Q=this.tokenGenerator(),J=Pd5(),$=yM0,Z=this.buildClaim(Y,G,{token:Q,daemonBootId:J,workdir:$});try{await uQ1(this.kubeConfig,this.namespace,Z)}catch(U){if(U instanceof xQ1)await Ou1(this.kubeConfig,this.namespace,Y),await uQ1(this.kubeConfig,this.namespace,Z);else throw U}let{podName:W}=await wu1(this.kubeConfig,this.namespace,Y);try{await this.ensureServicePortForHandle(Y),await this.ensureHttpRouteForHandle(Y,G.tenant??null)}catch(U){throw await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),U}let K=await this.openForwarder(W,Yl,Y),H=`http://127.0.0.1:${K.localPort}`;try{await fV1(H)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Y).catch(()=>{}),await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),U}return{id:X,handle:Y,podName:W,token:Q,workdir:$,daemonUrl:H,daemonForward:K,workload:G.workload??null,daemonBootId:J,tenant:G.tenant??null,ensureOpts:gd5(G)}}async ensureServicePortForHandle(X){if(!this.previewGateway||!this.previewUrlPattern)return;await ye6(this.kubeConfig,this.namespace,X,{name:"daemon",port:Yl,targetPort:Yl})}async ensureHttpRouteForHandle(X,Y){if(!this.previewGateway||!this.previewUrlPattern)return;let G=ud5(this.previewUrlPattern,X);if(!G)throw new u7(`Unable to derive preview hostname for ${X} from pattern: ${this.previewUrlPattern}`);let Q={apiVersion:`${lQ1.API_GROUP}/${lQ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:X,namespace:this.namespace,labels:hM0(Y??void 0,{[AU.role]:"claimed",[AU.sandboxHandle]:X,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[AU.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[G],rules:[{backendRefs:[{group:"",kind:"Service",name:X,port:Yl}]}]}};await zu1(this.kubeConfig,this.namespace,Q)}async deleteHttpRouteIfManaged(X){if(!this.previewGateway)return;await Du1(this.kubeConfig,this.namespace,X)}async rehydrate(X,Y,G){let Q=G.state;if(!Q.podName||!Q.token)return null;let J=await Xl(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(!J||!me6(J))return null;let $=de6(J)??Q.podName,Z=await this.openAndProbeDaemon($,Y);if(!Z)return null;if(Q.daemonBootId&&Q.daemonBootId!==Z.bootId)console.warn(`[${PW}] daemon restart detected (handle=${Y}): stored bootId=${Q.daemonBootId} live bootId=${Z.bootId}`);return{id:X,handle:Y,podName:$,token:Q.token,workdir:Q.workdir??yM0,daemonUrl:Z.daemonUrl,daemonForward:Z.daemonForward,workload:Q.workload??null,daemonBootId:Z.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt(X,Y,G){if(!me6(G))return null;let Q=de6(G);if(!Q)return null;let J=vd5(G);if(!J)return null;let $=await this.openAndProbeDaemon(Q,Y);if(!$)return null;let Z=hd5(G);if(this.previewGateway)await this.ensureServicePortForHandle(Y).catch((W)=>{console.warn(`[${PW}] Service port backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Y,Z).catch((W)=>{console.warn(`[${PW}] HTTPRoute backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)});return{id:X,handle:Y,podName:Q,token:J,workdir:yM0,daemonUrl:$.daemonUrl,daemonForward:$.daemonForward,workload:null,daemonBootId:$.bootId,tenant:Z,ensureOpts:null}}async openAndProbeDaemon(X,Y){let G=await this.openForwarder(X,Yl,Y).catch(()=>null);if(!G)return null;let Q=`http://127.0.0.1:${G.localPort}`,J=await rq(Q);if(!J)return this.closeForwarder(G),null;return{daemonForward:G,daemonUrl:Q,bootId:J.bootId}}async getRecord(X){let Y=this.records.get(X);if(Y)return Y;if(!this.stateStore)return null;let G=await this.stateStore.getByHandle(YO,X);if(!G)return null;let Q=await this.rehydrate(G.id,X,G);if(Q)this.records.set(X,Q);return Q}async resurrectByHandle(X){if(!this.stateStore)return null;let Y=await this.stateStore.getByHandle(YO,X);if(!Y)return null;let G=Y.state.ensureOpts;if(!G)return null;return await this.ensure(Y.id,G),this.records.get(X)??null}async requireRecord(X){let Y=await this.getRecord(X);if(Y)return Y;let G=await this.resurrectByHandle(X);if(G)return G;throw Error(`unknown sandbox handle ${X}`)}invalidateRecord(X){let Y=this.records.get(X);if(!Y)return;this.records.delete(X),this.closeForwarder(Y.daemonForward)}recordProxyDuration(X,Y,G,Q,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...gM0(G?.tenant??null),source:X,sandbox_handle:G?.handle??J??"",status_code:Y||0})}computeHandle(X,Y){return f3(X,Y)}composePreviewUrl(X){if(this.previewUrlPattern)return nB(this.previewUrlPattern,X.handle);return`http://127.0.0.1:${X.daemonForward.localPort}/`}toSandbox(X){return{handle:X.handle,workdir:X.workdir,previewUrl:this.composePreviewUrl(X)}}async persist(X,Y){if(!X)return;let G={podName:Y.podName,token:Y.token,workdir:Y.workdir,workload:Y.workload,daemonBootId:Y.daemonBootId,tenant:Y.tenant,...Y.ensureOpts?{ensureOpts:Y.ensureOpts}:{}};await X.put(Y.id,YO,{handle:Y.handle,state:G})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(X,Y,G=X){let Q=_d5(G,Y);return new Promise((J,$)=>{let Z=(W,K)=>{let H=ie6.createServer((U)=>this.handleForwardedConnection(U,X,Y,G));H.once("error",(U)=>{if(U.code==="EADDRINUSE"&&K<Sd5){try{H.close()}catch{}let N=uM0+(W-uM0+1)%pe6;Z(N,K+1);return}$(U)}),H.listen(W,"127.0.0.1",()=>{let U=H.address();if(!U||typeof U==="string"){H.close(),$(Error("port-forward listener failed to bind"));return}J({server:H,localPort:U.port})})};Z(Q,0)})}handleForwardedConnection(X,Y,G,Q){let J=new qd5,$=null,Z=!1,W=()=>{if(Z)return;if(Z=!0,J.destroy(),$)try{$.close()}catch{}if(!X.destroyed)X.destroy()};X.pipe(J),X.on("error",W),X.on("close",W),this.portForward.portForward(this.namespace,Y,[G],X,null,J).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if($=H,$.on("close",W),$.on("error",()=>{this.invalidateRecord(Q),W()}),Z)try{$.close()}catch{}}).catch((K)=>{console.warn(`[${PW}] port-forward to ${Y}:${G} failed: ${K instanceof Error?K.message:String(K)}`),this.invalidateRecord(Q),W()})}closeForwarder(X){X.server.close((Y)=>{if(Y)console.warn(`[${PW}] port-forward close on :${X.localPort} errored: ${Y instanceof Error?Y.message:String(Y)}`)})}close(){if(this.closed)return;this.closed=!0;for(let X of this.records.values())this.closeForwarder(X.daemonForward);this.records.clear()}}function kd5(X){return{active:X.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:X.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:X.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Cd5(){let X=new qt;return X.loadFromDefault(),X}function me6(X){return Boolean(X.status?.conditions?.some((Y)=>Y.type==="Ready"&&Y.status==="True"))}function vd5(X){let Y=X.spec?.env;if(!Y)return null;for(let G of Y)if(G.name==="DAEMON_TOKEN"&&G.value)return G.value;return null}function de6(X){return X.metadata?.annotations?.[FG.POD_NAME_ANNOTATION]??X.metadata?.name??null}function _d5(X,Y){let G=Ld5("sha256").update(`${X}:${Y}`).digest();return uM0+G.readUInt32BE(0)%pe6}function xM0(X,Y){return new Response(JSON.stringify(Y),{status:X,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function ce6(X){let Y=X.slice(0,bd5);return fd5.test(Y)?Y:""}function xd5(X){if(X===void 0)return null;let Y=X.trim();if(Y==="")return null;if(!yd5.test(Y))throw Error(`AgentSandboxRunner: envName=${JSON.stringify(Y)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return Y}function hM0(X,Y={}){let G={...Y};if(X){let Q=ce6(X.orgId),J=ce6(X.userId);if(Q)G[AU.orgId]=Q;if(J)G[AU.userId]=J}return G}function hd5(X){let Y=X.metadata?.labels;if(!Y)return null;let G=Y[AU.orgId],Q=Y[AU.userId];if(!G||!Q)return null;return{orgId:G,userId:Q}}function gM0(X){return{org_id:X?.orgId??"",user_id:X?.userId??"",runner_kind:YO}}function gd5(X){let Y={};if(X.repo)Y.repo=X.repo;if(X.workload)Y.workload=X.workload;if(X.env&&Object.keys(X.env).length>0)Y.env=X.env;if(X.tenant)Y.tenant=X.tenant;return Object.keys(Y).length>0?Y:null}function ud5(X,Y){try{return new URL(nB(X,Y)).hostname||null}catch{return null}}function ld5(X){try{let Y=new URL(X);return Y.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Y.hostname}catch{return X}}var YO="agent-sandbox",PW="AgentSandboxRunner",Ad5="agent-sandbox-system",Id5="studio-sandbox",Yl=9000,jd5=3000,yM0="/app",Td5=32,Vd5,Md5=900000,Rd5,le6,uM0=40000,pe6=1e4,Sd5=256,AU,fd5,bd5=63,yd5;var ne6=D(()=>{TM0();bV1();Gt();Lu1();hQ1();ue6();Vd5=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT","DEV_PORT","RUNTIME","CLONE_URL","REPO_NAME","BRANCH","GIT_USER_NAME","GIT_USER_EMAIL","PACKAGE_MANAGER"]),Rd5=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],le6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];AU={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},fd5=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;yd5=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var re6={};h6(re6,{waitForSandboxReady:()=>wu1,getSandboxClaim:()=>Xl,getHttpRoute:()=>be6,deleteSandboxClaim:()=>eu,deleteHttpRoute:()=>Du1,createSandboxClaim:()=>uQ1,createHttpRoute:()=>zu1,SandboxTimeoutError:()=>Vt,SandboxError:()=>u7,KubeConfig:()=>qt,K8S_CONSTANTS:()=>FG,HTTPROUTE_CONSTANTS:()=>lQ1,AgentSandboxRunner:()=>lM0});var ae6=D(()=>{TM0();hQ1();Lu1();ne6()});var aM0={};h6(aM0,{subscribeLifecycle:()=>rM0,getSharedRunnerIfInit:()=>iM0,getSharedRunner:()=>Gl,getRunnerByKind:()=>Mt,getOrInitSharedRunner:()=>cM0,asLifecycleWatchable:()=>nM0,asDockerRunner:()=>pM0,__resetSharedLifecyclesForTesting:()=>rd5});function oe6(X,Y){let G=dM0[X];if(G)return Promise.resolve(G);let Q=mM0[X];if(Q)return Q;let J=Y().then(($)=>{return dM0[X]=$,$}).finally(()=>{delete mM0[X]});return mM0[X]=J,J}function md5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return X&&X.trim()!==""?X:void 0}function dd5(){let X=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return X&&X.trim()!==""?X:void 0}function cd5(){let X=process.env.STUDIO_ENV;return X&&X.trim()!==""?X:void 0}function id5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Y=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!X&&!Y)return;if(!X||!Y)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:X,namespace:Y}}async function se6(X,Y){let G=new UQ1(Y),Q=md5();switch(X){case"host":{let{HostSandboxRunner:J}=await Promise.resolve().then(() => (aB(),AM)),{getSettings:$}=await Promise.resolve().then(() => (f5(),fS0));return new J({homeDir:$().dataDir,stateStore:G,previewUrlPattern:Q})}case"docker":return new wU({stateStore:G,previewUrlPattern:Q});case"freestyle":{let{FreestyleSandboxRunner:J}=await Promise.resolve().then(() => (Jn6(),Qn6));return new J({stateStore:G})}case"agent-sandbox":{let{AgentSandboxRunner:J}=await Promise.resolve().then(() => (ae6(),re6));return new J({stateStore:G,previewUrlPattern:Q,sandboxTemplateName:dd5(),envName:cd5(),previewGateway:id5(),meter:uH})}default:throw Error(`Unknown runner kind: ${String(X)}`)}}function Gl(X){return Mt(X,rB())}function Mt(X,Y){return oe6(Y,()=>se6(Y,X.db))}async function cM0(){let X;try{X=rB()}catch(Y){return console.warn("[lifecycle] cannot resolve sandbox runner:",Y instanceof Error?Y.message:String(Y)),null}return oe6(X,()=>se6(X,uY().db))}function iM0(){let X;try{X=rB()}catch{return null}return dM0[X]??null}function pM0(X){return X instanceof wU?X:null}function nM0(X){if(!X)return null;if(X.kind!=="agent-sandbox")return null;if(typeof X.watchClaimLifecycle!=="function")return null;return X}function rM0(X,Y,G){let Q=FA.get(Y);if(Q){if(Q.terminated){if(Q.lastPhase)try{G(Q.lastPhase)}catch{}return{unsubscribe:pd5}}if(Q.listeners.add(G),Q.lastPhase)try{G(Q.lastPhase)}catch{}return te6(Y,Q,G)}let J=new AbortController,$={lastPhase:null,terminated:!1,listeners:new Set([G]),abort:J};return FA.set(Y,$),nd5(X,Y,$),te6(Y,$,G)}function pd5(){}function te6(X,Y,G){return{unsubscribe(){if(FA.get(X)!==Y)return;if(Y.listeners.delete(G),Y.listeners.size===0)FA.delete(X),Y.abort.abort()}}}async function nd5(X,Y,G){let Q=null;try{for await(let J of X.watchClaimLifecycle(Y,G.abort.signal)){if(G.abort.signal.aborted)break;let $=J;G.lastPhase=$;let Z=$.kind==="ready"||$.kind==="failed";if(Z)G.terminated=!0;let W=Array.from(G.listeners);for(let K of W)try{K($)}catch{}if(Z)break}}catch(J){Q=J}finally{if(!G.terminated&&!G.abort.signal.aborted&&G.listeners.size>0){let J={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};G.lastPhase=J,G.terminated=!0;for(let $ of Array.from(G.listeners))try{$(J)}catch{}}if(FA.get(Y)===G)FA.delete(Y)}}function rd5(){for(let X of FA.values())X.abort.abort();FA.clear()}var dM0,mM0,FA;var qw=D(()=>{aB();tE();AW();eT0();dM0={},mM0={};FA=new Map});async function ee6(X,Y){U0(Y);let G=s1(Y),Q=B6(Y);if(!Q)throw Error("User ID required");let J=await Y.storage.virtualMcps.findById(X.virtualMcpId);if(!J||J.organization_id!==G.id)throw Error("Virtual MCP not found");let $=J.metadata??{},Z=Jt(tq($),Q,X.branch),W=rB();if(Z&&(Z.runnerKind??"freestyle")===W)return Z;await X18(Y,Z,W);let K=$.githubRepo??null,{entry:H}=await Y18({ctx:Y,userId:Q,orgId:G.id,virtualMcpId:X.virtualMcpId,branch:X.branch,metadata:$,githubRepo:K,existing:Z});return H}async function X18(X,Y,G){if(!Y)return;let Q=Y.runnerKind??"freestyle";if(Q===G)return;if(Q==="freestyle")return;try{await(await Mt(X,Q)).delete(Y.vmId)}catch(J){console.error(`[VM_START] stale ${Q} ${Y.vmId}: ${J instanceof Error?J.message:String(J)}`)}}async function Y18(X){let{ctx:Y,userId:G,orgId:Q,virtualMcpId:J,branch:$,metadata:Z,githubRepo:W,existing:K}=X;if(W&&!W.connectionId)throw Error("GitHub connection id missing on virtual MCP metadata");let{runtime:H,packageManager:U,port:N}=$f6(Z),B;if(W){let{cloneUrl:T,gitUserName:S,gitUserEmail:C}=await Wf6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(!U){let _=await Uf6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(_)U=_.packageManager,H=FQ1[_.packageManager].runtime,N=_.devPort??N,await ad5(Y,J,G,_.packageManager,_.devPort)}B={cloneUrl:T,userName:S,userEmail:C,branch:$,displayName:`${W.owner}/${W.name}`}}let O=H&&U?{runtime:H,packageManager:U,devPort:Number(N)}:void 0,z=Qt({orgId:Q,virtualMcpId:J,branch:$}),w=await Gl(Y),E=await w.ensure({userId:G,projectRef:z},{repo:B,workload:O,tenant:{orgId:Q,userId:G}}),q=!!K&&K.vmId===E.handle&&K?.createdAt?K.createdAt:Date.now(),V={vmId:E.handle,previewUrl:E.previewUrl,runnerKind:w.kind,createdAt:q};await Jf6(Y.storage.virtualMcps,J,G,G,$,V);let M=!K||K.vmId!==E.handle;return{entry:V,isNewVm:M}}async function ad5(X,Y,G,Q,J){let $=await X.storage.virtualMcps.findById(Y);if(!$)return;let Z=$.metadata??{};await X.storage.virtualMcps.update(Y,G,{metadata:{...Z,runtime:{selected:Q,port:J}}})}var tM0;var oM0=D(()=>{H0();aB();b0();sT0();Kf6();Nf6();pA0();oT0();qw();tM0=l1({name:"VM_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID"),branch:F.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it.")}),outputSchema:F.object({previewUrl:F.string().nullable(),vmId:F.string(),branch:F.string(),isNewVm:F.boolean(),runnerKind:F.enum(["host","docker","freestyle","agent-sandbox"])}),handler:async(X,Y)=>{let G=X.branch??mT1(),{metadata:Q,userId:J,organization:$,entry:Z}=await lV1({virtualMcpId:X.virtualMcpId,branch:G},Y),W=Q.githubRepo;if(!W)throw Error("No GitHub repo connected");let K=rB();await X18(Y,Z,K);let{entry:H,isNewVm:U}=await Y18({ctx:Y,userId:J,orgId:$.id,virtualMcpId:X.virtualMcpId,branch:G,metadata:Q,githubRepo:W,existing:Z});return{...H,branch:G,isNewVm:U,runnerKind:K}}})});var sM0;var G18=D(()=>{H0();b0();sT0();qw();sM0=l1({name:"VM_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID that owns this VM"),branch:F.string().min(1).describe("Branch whose vm should be deleted (vmMap[userId][branch])")}),outputSchema:F.object({success:F.boolean()}),handler:async(X,Y)=>{let G;try{G=await lV1(X,Y)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Q,userId:J}=G;if(!Q)return{success:!0};await Zf6(Y.storage.virtualMcps,X.virtualMcpId,J,J,X.branch);let $=Q.runnerKind??"freestyle";return await(await Mt(Y,$)).delete(Q.vmId).catch((W)=>console.error(`[VM_DELETE] ${$} ${Q.vmId}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var Q18=D(()=>{oM0();G18()});var od5="https://api.github.com",eM0;var J18=D(()=>{H0();b0();cE1();XM();eM0=l1({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({connectionId:F.string().describe("ID of the mcp-github connection to use")}),outputSchema:F.object({installations:F.array(F.object({installationId:F.number(),login:F.string(),avatarUrl:F.string(),type:F.string()})),appSlug:F.string().optional()}),handler:async(X,Y)=>{await Y.access.check();let G=new Y$(Y.db,Y.vault),Q=await G.get(X.connectionId);if(!Q)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=Q.accessToken;if(R51(Q)&&G.isExpired(Q,dE1)){let U=await S51(Q,G);if(!U)throw Error(PV);J=U,Q=await G.get(X.connectionId)??Q}let $=[],Z,W=1,K=100,H=async(U)=>fetch(`${od5}/user/installations?per_page=${K}&page=${W}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let U=await H(J);if(U.status===401){let B=await G.get(X.connectionId);if(!B||!R51(B))throw Error(PV);let O=await S51(B,G);if(!O)throw Error(PV);if(J=O,U=await H(J),U.status===401)throw Error(PV)}if(!U.ok)throw Error(`GitHub /user/installations failed: ${U.status}`);let N=await U.json();for(let B of N.installations){if(!Z)Z=B.app_slug??B.app?.slug;$.push({installationId:B.id,login:B.account.login,avatarUrl:B.account.avatar_url,type:B.account.type})}if(N.installations.length<K)break;W++}return{installations:$,...Z?{appSlug:Z}:{}}}})});var Z18=D(()=>{J18()});var gT1={};h6(gT1,{managementMCP:()=>_a,listManagementTools:()=>Yc5,ALL_TOOLS:()=>$18});async function Yc5(X){let Y=await _a(X),[G,Q]=d91.createLinkedPair();await Y.connect(Q);let J=new A7({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(G),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var ed5,Xc5,$18,_a=async(X)=>{let Y=null;if(X.organization){let Z=await X.storage.organizationSettings.get(X.organization.id),W=await X.storage.virtualMcps.list(X.organization.id),K=new Set(Z?.enabled_plugins??[]);for(let H of W){let U=H.metadata?.enabled_plugins;if(U&&Array.isArray(U))for(let N of U)K.add(N)}Y=K.size>0?[...K]:null}let G=cd4($18,Y),Q=new oO({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let Z of G){let W=Z.inputSchema&&typeof Z.inputSchema==="object"&&"shape"in Z.inputSchema?Z.inputSchema:F.object({}),K=Z.outputSchema&&typeof Z.outputSchema==="object"&&"shape"in Z.outputSchema?Z.outputSchema:void 0,H=W.shape,U=K?.shape;Q.registerTool(Z.name,{description:Z.description??"",inputSchema:H,outputSchema:U,annotations:Z.annotations,_meta:Z._meta},async(N)=>{X.access.setToolName(Z.name);try{let B=await Z.execute(N,X);return{content:[{type:"text",text:JSON.stringify(B)}],structuredContent:B}}catch(B){return{content:[{type:"text",text:`Error: ${B.message}`}],isError:!0}}})}let J=MT6();for(let Z of J)Q.registerPrompt(Z.name,{title:Z.title,description:Z.description},()=>({messages:[{role:"user",content:{type:"text",text:Z.text}}]}));if(X.organization?.id){let Z=await X.storage.brandContext.list(X.organization.id),W=new Set;for(let K of Z){let H=K.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),U=H?`brand-${H}`:`brand-${K.id}`;if(W.has(U))U=`${U}-${K.id.slice(0,8)}`;W.add(U);let N=[`# Brand: ${K.name}`,"",`**Domain:** ${K.domain}`,"","## Overview",K.overview];if(K.colors){let O=Object.entries(K.colors).filter(([,z])=>z);if(O.length>0){N.push("","## Colors");for(let[z,w]of O)N.push(`- **${z}:** ${w}`)}}if(K.fonts){let O=Object.entries(K.fonts).filter(([,z])=>z);if(O.length>0){N.push("","## Fonts");for(let[z,w]of O)N.push(`- ${w} (${z})`)}}if(K.logo)N.push("",`**Logo:** ${K.logo}`);if(K.favicon)N.push(`**Favicon:** ${K.favicon}`);if(K.ogImage)N.push(`**OG Image:** ${K.ogImage}`);if(K.images&&K.images.length>0){N.push("","## Images");for(let O of K.images){let z=Object.entries(O).map(([w,E])=>`${w}: ${E}`).join(", ");N.push(`- ${z}`)}}let B=N.join(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let J=Q.trim();if(J)yield JSON.parse(J)}finally{Y.releaseLock()}}var MM0,Se6,Ce6="gateway.networking.k8s.io",ve6="v1",CM0="httproutes",_e6,lQ1,Hd5="mesh-sandbox-runner";var Lu1=D(()=>{hQ1();MM0=class MM0 extends Error{status;body;constructor(X,Y,G){super(G);this.status=X;this.body=Y;this.name="KubeHttpError"}};Se6=`/apis/${FG.CLAIM_API_GROUP}/${FG.CLAIM_API_VERSION}/namespaces`;_e6=`/apis/${Ce6}/${ve6}/namespaces`;lQ1={API_GROUP:Ce6,API_VERSION:ve6,PLURAL:CM0}});async function*ge6(X){let Y=X.now??(()=>Date.now()),G=Y(),Q=X.schedulingTimeoutMs??Nd5,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:G},$=[],Z=null,W=!1,K=(E)=>{if(W)return;if(Z){let P=Z;Z=null,P(E)}else $.push(E)},H=()=>{if($.length>0)return Promise.resolve($.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{Z=E})},U=()=>{if(W)return;if(W=!0,Z){let E=Z;Z=null,E(null)}},N=new AbortController,B=()=>{N.abort(),U()};if(X.signal)if(X.signal.aborted)N.abort(),U();else X.signal.addEventListener("abort",B,{once:!0});let O=Math.max(0,Q-(Y()-G)),z=setTimeout(()=>K("tick"),O+100),w=Promise.allSettled([Bd5(X.kc,X.namespace,X.claimName,N.signal,J,K,Y),zd5(X.kc,X.namespace,X.claimName,N.signal,J,K),Dd5(X.kc,X.namespace,X.claimName,N.signal,J,K,Y)]);try{let E=null,P=-1,q=xe6(J,Q,Y);if(E=fM0(q),!_M0(q))P=he6(q);if(yield q,_M0(q))return;while(!W){if(await H()===null)break;let M=xe6(J,Q,Y);if(_M0(M)){let C=fM0(M);if(C!==E)E=C,yield M;return}let T=he6(M);if(T<P)continue;let S=fM0(M);if(S!==E)E=S,P=T,yield M}}finally{if(clearTimeout(z),N.abort(),X.signal)X.signal.removeEventListener("abort",B);U(),await w.catch(()=>{})}}function xe6(X,Y,G){let{pod:Q,sandbox:J,events:$,startedAt:Z}=X;if(J.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&$.lastFailedSchedulingAt!==void 0&&G()-Z>Y)return{kind:"failed",reason:"scheduling-timeout",message:$.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Y/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:Z};if($.hasPulling&&!$.hasPulled)return{kind:"pulling-image",since:Z};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:Z};if(Q.scheduledFalseReason==="Unschedulable"||$.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:Z,message:$.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:$.nominatedNodeClaim};return{kind:"claiming",since:Z}}function _M0(X){return X.kind==="ready"||X.kind==="failed"}function he6(X){switch(X.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function fM0(X){switch(X.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return X.kind;case"waiting-for-capacity":return`waiting-for-capacity:${X.message??""}:${X.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${X.reason}:${X.message}`}}async function Bd5(X,Y,G,Q,J,$,Z){let W=`/api/v1/namespaces/${encodeURIComponent(Y)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Fd5}=${G}`)}`;return bM0({kc:X,path:W,signal:Q,label:`pod/${G}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object;if(H.metadata?.name!==G)return;Od5(H,J,Z),$("pod")}})}function Od5(X,Y,G){let J=(X.status?.conditions??[]).find((Z)=>Z.type==="PodScheduled");if(J?.status==="True")Y.pod.scheduled=!0,Y.pod.scheduledFalseReason=void 0,Y.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")Y.pod.scheduled=!1,Y.pod.scheduledFalseReason=J.reason,Y.pod.scheduledFalseMessage=J.message;let $=(X.status?.containerStatuses??[]).find((Z)=>Z.name===Ud5);if($)Y.pod.containerWaitingReason=$.state?.waiting?.reason,Y.pod.containerRunning=!!$.state?.running,Y.pod.containerReady=$.ready===!0}async function zd5(X,Y,G,Q,J,$){let Z=`/apis/${FG.SANDBOX_API_GROUP}/${FG.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Y)}/${FG.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`;return bM0({kc:X,path:Z,signal:Q,label:`sandbox/${G}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((U)=>U.type==="Ready");if(!H)return;if(H.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=H.reason,J.sandbox.notReadyMessage=H.message;$("sandbox")}})}async function Dd5(X,Y,G,Q,J,$,Z){let W=`/api/v1/namespaces/${encodeURIComponent(Y)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${G},involvedObject.kind=Pod`)}`;return bM0({kc:X,path:W,signal:Q,label:`events/${G}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object,U=H.reason;if(!U)return;switch(U){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=Z(),J.events.failedSchedulingMessage=H.message;break;case"Nominated":{let N=H.message?.match(/nodeclaim\/([\w-]+)/);if(N)J.events.nominatedNodeClaim=N[1];break}default:return}$("event")}})}async function bM0(X){let{kc:Y,path:G,signal:Q,label:J,onEvent:$}=X,Z=0;while(!Q.aborted){try{let K=await su(Y,{method:"GET",path:G,signal:Q,headers:{accept:"application/json"}});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}Z=0;for await(let H of vM0(K.body)){if(Q.aborted)return;try{$(H)}catch(U){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${U instanceof Error?U.message:String(U)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${J} watch ended: ${H}`)}if(Q.aborted)return;let W=Math.min(250*2**Z,5000);Z+=1,await wd5(W,Q)}}function wd5(X,Y){return new Promise((G)=>{if(Y.aborted){G();return}let Q=setTimeout(()=>{Y.removeEventListener("abort",J),G()},X),J=()=>{clearTimeout(Q),G()};Y.addEventListener("abort",J,{once:!0})})}var Fd5="studio.decocms.com/sandbox-handle",Ud5="sandbox",Nd5=300000;var ue6=D(()=>{hQ1();Lu1()});import{createHash as Ld5,randomBytes as Ed5,randomUUID as Pd5}from"crypto";import*as ie6 from"net";import{PassThrough as qd5}from"stream";class lM0{kind=YO;records=new Map;inflight=new aq;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;closed=!1;constructor(X={}){this.stateStore=X.stateStore??null,this.previewUrlPattern=X.previewUrlPattern??null,this.kubeConfig=X.kubeConfig??Cd5(),this.portForward=new HM0(this.kubeConfig),this.namespace=X.namespace??Ad5,this.sandboxTemplateName=X.sandboxTemplateName??Id5,this.envName=xd5(X.envName),this.tokenGenerator=X.tokenGenerator??(()=>Ed5(Td5).toString("hex")),this.idleTtlMs=X.idleTtlMs??Md5,this.metrics=X.meter?kd5(X.meter):null,this.previewGateway=X.previewGateway&&X.previewUrlPattern?{...X.previewGateway}:null}async ensure(X,Y={}){let G=this.computeHandle(X,Y.repo?.branch??null);return this.inflight.run(G,()=>PM(this.stateStore,X,YO,(Q)=>this.ensureLocked(X,G,Y,Q)))}async exec(X,Y){let G=await this.requireRecord(X);return sa(G.daemonUrl,G.token,Y)}async delete(X){let Y=await this.getRecord(X);if(this.records.delete(X),Y)this.closeForwarder(Y.daemonForward),this.metrics?.active.add(-1,gM0(Y.tenant));if(await this.deleteHttpRouteIfManaged(X).catch((G)=>{console.warn(`[${PW}] HTTPRoute delete failed for ${X}: ${G instanceof Error?G.message:String(G)}`)}),await eu(this.kubeConfig,this.namespace,X),this.stateStore)if(Y)await this.stateStore.delete(Y.id,YO);else await this.stateStore.deleteByHandle(YO,X)}async alive(X){return await Xl(this.kubeConfig,this.namespace,X)!==void 0}watchClaimLifecycle(X,Y){return ge6({kc:this.kubeConfig,namespace:this.namespace,claimName:X,signal:Y})}async getPreviewUrl(X){let Y=await this.getRecord(X);if(!Y)return null;return this.composePreviewUrl(Y)}async proxyDaemonRequest(X,Y,G){let Q=await this.getRecord(X);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=performance.now(),$=0;try{let Z=await ea(Q.daemonUrl,Q.token,Y,G);return $=Z.status,Z}finally{this.recordProxyDuration("daemon",$,Q,performance.now()-J)}}async resolvePreviewUpstreamUrl(X){if(this.previewUrlPattern)return`http://${X}.${this.namespace}.svc.cluster.local:${Yl}`;let Y=await this.getRecord(X);if(Y)return Y.daemonUrl;let G=await this.resurrectByHandle(X);return G?G.daemonUrl:null}async proxyPreviewRequest(X,Y){let G=performance.now(),Q=this.records.get(X)??null,J=0;try{let $=await this.resolvePreviewUpstreamUrl(X);if(!$)return J=404,xM0(404,{error:"sandbox not found"});let Z=new URL(Y.url);if((Z.pathname==="/_decopilot_vm"||Z.pathname.startsWith("/_decopilot_vm/"))&&Y.method!=="GET")return J=404,xM0(404,{error:"not found"});let K=(z)=>`${z}${Z.pathname}${Z.search}`,H=new Headers(Y.headers);for(let z of Rd5)H.delete(z);let U=Y.method!=="GET"&&Y.method!=="HEAD",N={method:Y.method,headers:H,body:U?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:U?"half":void 0},B;try{B=await fetch(K($),N)}catch(z){let w=`${$}${Z.pathname}`;if(console.warn(`[${PW}] preview fetch to ${w} failed: ${z instanceof Error?z.message:String(z)}`),Y.method==="GET"||Y.method==="HEAD"){if(this.invalidateRecord(X),await this.resurrectByHandle(X).catch(()=>null)){let P=await this.resolvePreviewUpstreamUrl(X);if(P)try{B=await fetch(K(P),N);let q=new Headers;for(let[V,M]of B.headers.entries())if(!le6.includes(V.toLowerCase()))q.set(V,M);return J=B.status,new Response(B.body,{status:B.status,statusText:B.statusText,headers:q})}catch(q){console.warn(`[${PW}] preview fetch retry to ${w} failed: ${q instanceof Error?q.message:String(q)}`)}}}else this.invalidateRecord(X);return J=502,xM0(502,{error:"sandbox daemon unreachable"})}let O=new Headers;for(let[z,w]of B.headers.entries())if(!le6.includes(z.toLowerCase()))O.set(z,w);return J=B.status,new Response(B.body,{status:B.status,statusText:B.statusText,headers:O})}finally{this.recordProxyDuration("preview",J,Q,performance.now()-G,X)}}async ensureLocked(X,Y,G,Q){if(G.image)console.warn(`[${PW}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${G.image}`);if(Q){let Z=await Q.get(X,YO);if(Z){let W=await this.rehydrate(X,Y,Z);if(W)return this.finish(W,Q,!1,!0,"resume");await Q.delete(X,YO)}}let J=await Xl(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await Ou1(this.kubeConfig,this.namespace,Y).catch((Z)=>{console.warn(`[${PW}] wait for terminating claim ${Y} failed: ${Z instanceof Error?Z.message:String(Z)}`)});else{let Z=await this.adopt(X,Y,J).catch((W)=>{return console.warn(`[${PW}] adopt ${Y} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(Z)return this.finish(Z,Q,!0,!0,"adopt");await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),await Ou1(this.kubeConfig,this.namespace,Y).catch((W)=>{console.warn(`[${PW}] wait for deleted claim ${Y} failed: ${W instanceof Error?W.message:String(W)}`)})}let $=await this.provision(X,Y,G);return this.finish($,Q,!0,!1,"fresh")}async finish(X,Y,G,Q,J){let $=this.records.has(X.handle);if(this.records.set(X.handle,X),G)await this.persist(Y,X);if(Q)await ke6(this.kubeConfig,this.namespace,X.handle,this.computeShutdownTime()).catch((Z)=>console.warn(`[${PW}] TTL refresh failed for ${X.handle}: ${Z instanceof Error?Z.message:String(Z)}`));if(this.metrics){let Z=gM0(X.tenant);if(this.metrics.ensureOutcome.add(1,{...Z,outcome:J}),!$)this.metrics.active.add(1,Z)}return this.toSandbox(X)}buildEnvMap(X,Y){let G={},Q=[];for(let[Z,W]of Object.entries(X.env??{}))if(Vd5.has(Z))Q.push(Z);else G[Z]=W;if(Q.length>0)console.warn(`[${PW}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);let J=X.repo,$=J?J.displayName??ld5(J.cloneUrl):null;return{...G,DAEMON_TOKEN:Y.token,DAEMON_BOOT_ID:Y.daemonBootId,APP_ROOT:Y.workdir,PROXY_PORT:String(Yl),DEV_PORT:String(X.workload?.devPort??jd5),RUNTIME:X.workload?.runtime??"node",...J?{CLONE_URL:J.cloneUrl,REPO_NAME:$??"",BRANCH:J.branch??"",GIT_USER_NAME:J.userName,GIT_USER_EMAIL:J.userEmail}:{},...X.workload?.packageManager?{PACKAGE_MANAGER:X.workload.packageManager}:{}}}buildClaim(X,Y,G){let Q=this.buildEnvMap(Y,G);return{apiVersion:`${FG.CLAIM_API_GROUP}/${FG.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:X,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[AU.env]:this.envName}:{},...hM0(Y.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:hM0(Y.tenant,{[AU.role]:"claimed",[AU.sandboxHandle]:X,...this.envName?{[AU.env]:this.envName}:{}})},env:Object.entries(Q).sort(([J],[$])=>J<$?-1:J>$?1:0).map(([J,$])=>({name:J,value:$})),warmpool:"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(X,Y,G){let Q=this.tokenGenerator(),J=Pd5(),$=yM0,Z=this.buildClaim(Y,G,{token:Q,daemonBootId:J,workdir:$});try{await uQ1(this.kubeConfig,this.namespace,Z)}catch(U){if(U instanceof xQ1)await Ou1(this.kubeConfig,this.namespace,Y),await uQ1(this.kubeConfig,this.namespace,Z);else throw U}let{podName:W}=await wu1(this.kubeConfig,this.namespace,Y);try{await this.ensureServicePortForHandle(Y),await this.ensureHttpRouteForHandle(Y,G.tenant??null)}catch(U){throw await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),U}let K=await this.openForwarder(W,Yl,Y),H=`http://127.0.0.1:${K.localPort}`;try{await fV1(H)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Y).catch(()=>{}),await eu(this.kubeConfig,this.namespace,Y).catch(()=>{}),U}return{id:X,handle:Y,podName:W,token:Q,workdir:$,daemonUrl:H,daemonForward:K,workload:G.workload??null,daemonBootId:J,tenant:G.tenant??null,ensureOpts:gd5(G)}}async ensureServicePortForHandle(X){if(!this.previewGateway||!this.previewUrlPattern)return;await ye6(this.kubeConfig,this.namespace,X,{name:"daemon",port:Yl,targetPort:Yl})}async ensureHttpRouteForHandle(X,Y){if(!this.previewGateway||!this.previewUrlPattern)return;let G=ud5(this.previewUrlPattern,X);if(!G)throw new u7(`Unable to derive preview hostname for ${X} from pattern: ${this.previewUrlPattern}`);let Q={apiVersion:`${lQ1.API_GROUP}/${lQ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:X,namespace:this.namespace,labels:hM0(Y??void 0,{[AU.role]:"claimed",[AU.sandboxHandle]:X,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[AU.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[G],rules:[{backendRefs:[{group:"",kind:"Service",name:X,port:Yl}]}]}};await zu1(this.kubeConfig,this.namespace,Q)}async deleteHttpRouteIfManaged(X){if(!this.previewGateway)return;await Du1(this.kubeConfig,this.namespace,X)}async rehydrate(X,Y,G){let Q=G.state;if(!Q.podName||!Q.token)return null;let J=await Xl(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(!J||!me6(J))return null;let $=de6(J)??Q.podName,Z=await this.openAndProbeDaemon($,Y);if(!Z)return null;if(Q.daemonBootId&&Q.daemonBootId!==Z.bootId)console.warn(`[${PW}] daemon restart detected (handle=${Y}): stored bootId=${Q.daemonBootId} live bootId=${Z.bootId}`);return{id:X,handle:Y,podName:$,token:Q.token,workdir:Q.workdir??yM0,daemonUrl:Z.daemonUrl,daemonForward:Z.daemonForward,workload:Q.workload??null,daemonBootId:Z.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt(X,Y,G){if(!me6(G))return null;let Q=de6(G);if(!Q)return null;let J=vd5(G);if(!J)return null;let $=await this.openAndProbeDaemon(Q,Y);if(!$)return null;let Z=hd5(G);if(this.previewGateway)await this.ensureServicePortForHandle(Y).catch((W)=>{console.warn(`[${PW}] Service port backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Y,Z).catch((W)=>{console.warn(`[${PW}] HTTPRoute backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)});return{id:X,handle:Y,podName:Q,token:J,workdir:yM0,daemonUrl:$.daemonUrl,daemonForward:$.daemonForward,workload:null,daemonBootId:$.bootId,tenant:Z,ensureOpts:null}}async openAndProbeDaemon(X,Y){let G=await this.openForwarder(X,Yl,Y).catch(()=>null);if(!G)return null;let Q=`http://127.0.0.1:${G.localPort}`,J=await rq(Q);if(!J)return this.closeForwarder(G),null;return{daemonForward:G,daemonUrl:Q,bootId:J.bootId}}async getRecord(X){let Y=this.records.get(X);if(Y)return Y;if(!this.stateStore)return null;let G=await this.stateStore.getByHandle(YO,X);if(!G)return null;let Q=await this.rehydrate(G.id,X,G);if(Q)this.records.set(X,Q);return Q}async resurrectByHandle(X){if(!this.stateStore)return null;let Y=await this.stateStore.getByHandle(YO,X);if(!Y)return null;let G=Y.state.ensureOpts;if(!G)return null;return await this.ensure(Y.id,G),this.records.get(X)??null}async requireRecord(X){let Y=await this.getRecord(X);if(Y)return Y;let G=await this.resurrectByHandle(X);if(G)return G;throw Error(`unknown sandbox handle ${X}`)}invalidateRecord(X){let Y=this.records.get(X);if(!Y)return;this.records.delete(X),this.closeForwarder(Y.daemonForward)}recordProxyDuration(X,Y,G,Q,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...gM0(G?.tenant??null),source:X,sandbox_handle:G?.handle??J??"",status_code:Y||0})}computeHandle(X,Y){return f3(X,Y)}composePreviewUrl(X){if(this.previewUrlPattern)return nB(this.previewUrlPattern,X.handle);return`http://127.0.0.1:${X.daemonForward.localPort}/`}toSandbox(X){return{handle:X.handle,workdir:X.workdir,previewUrl:this.composePreviewUrl(X)}}async persist(X,Y){if(!X)return;let G={podName:Y.podName,token:Y.token,workdir:Y.workdir,workload:Y.workload,daemonBootId:Y.daemonBootId,tenant:Y.tenant,...Y.ensureOpts?{ensureOpts:Y.ensureOpts}:{}};await X.put(Y.id,YO,{handle:Y.handle,state:G})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(X,Y,G=X){let Q=_d5(G,Y);return new Promise((J,$)=>{let Z=(W,K)=>{let H=ie6.createServer((U)=>this.handleForwardedConnection(U,X,Y,G));H.once("error",(U)=>{if(U.code==="EADDRINUSE"&&K<Sd5){try{H.close()}catch{}let N=uM0+(W-uM0+1)%pe6;Z(N,K+1);return}$(U)}),H.listen(W,"127.0.0.1",()=>{let U=H.address();if(!U||typeof U==="string"){H.close(),$(Error("port-forward listener failed to bind"));return}J({server:H,localPort:U.port})})};Z(Q,0)})}handleForwardedConnection(X,Y,G,Q){let J=new qd5,$=null,Z=!1,W=()=>{if(Z)return;if(Z=!0,J.destroy(),$)try{$.close()}catch{}if(!X.destroyed)X.destroy()};X.pipe(J),X.on("error",W),X.on("close",W),this.portForward.portForward(this.namespace,Y,[G],X,null,J).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if($=H,$.on("close",W),$.on("error",()=>{this.invalidateRecord(Q),W()}),Z)try{$.close()}catch{}}).catch((K)=>{console.warn(`[${PW}] port-forward to ${Y}:${G} failed: ${K instanceof Error?K.message:String(K)}`),this.invalidateRecord(Q),W()})}closeForwarder(X){X.server.close((Y)=>{if(Y)console.warn(`[${PW}] port-forward close on :${X.localPort} errored: ${Y instanceof Error?Y.message:String(Y)}`)})}close(){if(this.closed)return;this.closed=!0;for(let X of this.records.values())this.closeForwarder(X.daemonForward);this.records.clear()}}function kd5(X){return{active:X.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:X.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:X.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Cd5(){let X=new qt;return X.loadFromDefault(),X}function me6(X){return Boolean(X.status?.conditions?.some((Y)=>Y.type==="Ready"&&Y.status==="True"))}function vd5(X){let Y=X.spec?.env;if(!Y)return null;for(let G of Y)if(G.name==="DAEMON_TOKEN"&&G.value)return G.value;return null}function de6(X){return X.metadata?.annotations?.[FG.POD_NAME_ANNOTATION]??X.metadata?.name??null}function _d5(X,Y){let G=Ld5("sha256").update(`${X}:${Y}`).digest();return uM0+G.readUInt32BE(0)%pe6}function xM0(X,Y){return new Response(JSON.stringify(Y),{status:X,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function ce6(X){let Y=X.slice(0,bd5);return fd5.test(Y)?Y:""}function xd5(X){if(X===void 0)return null;let Y=X.trim();if(Y==="")return null;if(!yd5.test(Y))throw Error(`AgentSandboxRunner: envName=${JSON.stringify(Y)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return Y}function hM0(X,Y={}){let G={...Y};if(X){let Q=ce6(X.orgId),J=ce6(X.userId);if(Q)G[AU.orgId]=Q;if(J)G[AU.userId]=J}return G}function hd5(X){let Y=X.metadata?.labels;if(!Y)return null;let G=Y[AU.orgId],Q=Y[AU.userId];if(!G||!Q)return null;return{orgId:G,userId:Q}}function gM0(X){return{org_id:X?.orgId??"",user_id:X?.userId??"",runner_kind:YO}}function gd5(X){let Y={};if(X.repo)Y.repo=X.repo;if(X.workload)Y.workload=X.workload;if(X.env&&Object.keys(X.env).length>0)Y.env=X.env;if(X.tenant)Y.tenant=X.tenant;return Object.keys(Y).length>0?Y:null}function ud5(X,Y){try{return new URL(nB(X,Y)).hostname||null}catch{return null}}function ld5(X){try{let Y=new URL(X);return Y.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Y.hostname}catch{return X}}var YO="agent-sandbox",PW="AgentSandboxRunner",Ad5="agent-sandbox-system",Id5="studio-sandbox",Yl=9000,jd5=3000,yM0="/app",Td5=32,Vd5,Md5=900000,Rd5,le6,uM0=40000,pe6=1e4,Sd5=256,AU,fd5,bd5=63,yd5;var ne6=D(()=>{TM0();bV1();Gt();Lu1();hQ1();ue6();Vd5=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT","DEV_PORT","RUNTIME","CLONE_URL","REPO_NAME","BRANCH","GIT_USER_NAME","GIT_USER_EMAIL","PACKAGE_MANAGER"]),Rd5=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],le6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];AU={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},fd5=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;yd5=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var re6={};h6(re6,{waitForSandboxReady:()=>wu1,getSandboxClaim:()=>Xl,getHttpRoute:()=>be6,deleteSandboxClaim:()=>eu,deleteHttpRoute:()=>Du1,createSandboxClaim:()=>uQ1,createHttpRoute:()=>zu1,SandboxTimeoutError:()=>Vt,SandboxError:()=>u7,KubeConfig:()=>qt,K8S_CONSTANTS:()=>FG,HTTPROUTE_CONSTANTS:()=>lQ1,AgentSandboxRunner:()=>lM0});var ae6=D(()=>{TM0();hQ1();Lu1();ne6()});var aM0={};h6(aM0,{subscribeLifecycle:()=>rM0,getSharedRunnerIfInit:()=>iM0,getSharedRunner:()=>Gl,getRunnerByKind:()=>Mt,getOrInitSharedRunner:()=>cM0,asLifecycleWatchable:()=>nM0,asDockerRunner:()=>pM0,__resetSharedLifecyclesForTesting:()=>rd5});function oe6(X,Y){let G=dM0[X];if(G)return Promise.resolve(G);let Q=mM0[X];if(Q)return Q;let J=Y().then(($)=>{return dM0[X]=$,$}).finally(()=>{delete mM0[X]});return mM0[X]=J,J}function md5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return X&&X.trim()!==""?X:void 0}function dd5(){let X=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return X&&X.trim()!==""?X:void 0}function cd5(){let X=process.env.STUDIO_ENV;return X&&X.trim()!==""?X:void 0}function id5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Y=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!X&&!Y)return;if(!X||!Y)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:X,namespace:Y}}async function se6(X,Y){let G=new UQ1(Y),Q=md5();switch(X){case"host":{let{HostSandboxRunner:J}=await Promise.resolve().then(() => (aB(),AM)),{getSettings:$}=await Promise.resolve().then(() => (f5(),fS0));return new J({homeDir:$().dataDir,stateStore:G,previewUrlPattern:Q})}case"docker":return new wU({stateStore:G,previewUrlPattern:Q});case"freestyle":{let{FreestyleSandboxRunner:J}=await Promise.resolve().then(() => (Jn6(),Qn6));return new J({stateStore:G})}case"agent-sandbox":{let{AgentSandboxRunner:J}=await Promise.resolve().then(() => (ae6(),re6));return new J({stateStore:G,previewUrlPattern:Q,sandboxTemplateName:dd5(),envName:cd5(),previewGateway:id5(),meter:uH})}default:throw Error(`Unknown runner kind: ${String(X)}`)}}function Gl(X){return Mt(X,rB())}function Mt(X,Y){return oe6(Y,()=>se6(Y,X.db))}async function cM0(){let X;try{X=rB()}catch(Y){return console.warn("[lifecycle] cannot resolve sandbox runner:",Y instanceof Error?Y.message:String(Y)),null}return oe6(X,()=>se6(X,uY().db))}function iM0(){let X;try{X=rB()}catch{return null}return dM0[X]??null}function pM0(X){return X instanceof wU?X:null}function nM0(X){if(!X)return null;if(X.kind!=="agent-sandbox")return null;if(typeof X.watchClaimLifecycle!=="function")return null;return X}function rM0(X,Y,G){let Q=FA.get(Y);if(Q){if(Q.terminated){if(Q.lastPhase)try{G(Q.lastPhase)}catch{}return{unsubscribe:pd5}}if(Q.listeners.add(G),Q.lastPhase)try{G(Q.lastPhase)}catch{}return te6(Y,Q,G)}let J=new AbortController,$={lastPhase:null,terminated:!1,listeners:new Set([G]),abort:J};return FA.set(Y,$),nd5(X,Y,$),te6(Y,$,G)}function pd5(){}function te6(X,Y,G){return{unsubscribe(){if(FA.get(X)!==Y)return;if(Y.listeners.delete(G),Y.listeners.size===0)FA.delete(X),Y.abort.abort()}}}async function nd5(X,Y,G){let Q=null;try{for await(let J of X.watchClaimLifecycle(Y,G.abort.signal)){if(G.abort.signal.aborted)break;let $=J;G.lastPhase=$;let Z=$.kind==="ready"||$.kind==="failed";if(Z)G.terminated=!0;let W=Array.from(G.listeners);for(let K of W)try{K($)}catch{}if(Z)break}}catch(J){Q=J}finally{if(!G.terminated&&!G.abort.signal.aborted&&G.listeners.size>0){let J={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};G.lastPhase=J,G.terminated=!0;for(let $ of Array.from(G.listeners))try{$(J)}catch{}}if(FA.get(Y)===G)FA.delete(Y)}}function rd5(){for(let X of FA.values())X.abort.abort();FA.clear()}var dM0,mM0,FA;var qw=D(()=>{aB();tE();AW();eT0();dM0={},mM0={};FA=new Map});async function ee6(X,Y){U0(Y);let G=s1(Y),Q=B6(Y);if(!Q)throw Error("User ID required");let J=await Y.storage.virtualMcps.findById(X.virtualMcpId);if(!J||J.organization_id!==G.id)throw Error("Virtual MCP not found");let $=J.metadata??{},Z=Jt(tq($),Q,X.branch),W=rB();if(Z&&(Z.runnerKind??"freestyle")===W)return Z;await X18(Y,Z,W);let K=$.githubRepo??null,{entry:H}=await Y18({ctx:Y,userId:Q,orgId:G.id,virtualMcpId:X.virtualMcpId,branch:X.branch,metadata:$,githubRepo:K,existing:Z});return H}async function X18(X,Y,G){if(!Y)return;let Q=Y.runnerKind??"freestyle";if(Q===G)return;if(Q==="freestyle")return;try{await(await Mt(X,Q)).delete(Y.vmId)}catch(J){console.error(`[VM_START] stale ${Q} ${Y.vmId}: ${J instanceof Error?J.message:String(J)}`)}}async function Y18(X){let{ctx:Y,userId:G,orgId:Q,virtualMcpId:J,branch:$,metadata:Z,githubRepo:W,existing:K}=X;if(W&&!W.connectionId)throw Error("GitHub connection id missing on virtual MCP metadata");let{runtime:H,packageManager:U,port:N}=$f6(Z),B;if(W){let{cloneUrl:T,gitUserName:S,gitUserEmail:C}=await Wf6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(!U){let _=await Uf6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(_)U=_.packageManager,H=FQ1[_.packageManager].runtime,N=_.devPort??N,await ad5(Y,J,G,_.packageManager,_.devPort)}B={cloneUrl:T,userName:S,userEmail:C,branch:$,displayName:`${W.owner}/${W.name}`}}let O=H&&U?{runtime:H,packageManager:U,devPort:Number(N)}:void 0,z=Qt({orgId:Q,virtualMcpId:J,branch:$}),w=await Gl(Y),E=await w.ensure({userId:G,projectRef:z},{repo:B,workload:O,tenant:{orgId:Q,userId:G}}),q=!!K&&K.vmId===E.handle&&K?.createdAt?K.createdAt:Date.now(),V={vmId:E.handle,previewUrl:E.previewUrl,runnerKind:w.kind,createdAt:q};await Jf6(Y.storage.virtualMcps,J,G,G,$,V);let M=!K||K.vmId!==E.handle;return{entry:V,isNewVm:M}}async function ad5(X,Y,G,Q,J){let $=await X.storage.virtualMcps.findById(Y);if(!$)return;let Z=$.metadata??{};await X.storage.virtualMcps.update(Y,G,{metadata:{...Z,runtime:{selected:Q,port:J}}})}var tM0;var oM0=D(()=>{H0();aB();b0();sT0();Kf6();Nf6();pA0();oT0();qw();tM0=l1({name:"VM_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID"),branch:F.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it.")}),outputSchema:F.object({previewUrl:F.string().nullable(),vmId:F.string(),branch:F.string(),isNewVm:F.boolean(),runnerKind:F.enum(["host","docker","freestyle","agent-sandbox"])}),handler:async(X,Y)=>{let G=X.branch??mT1(),{metadata:Q,userId:J,organization:$,entry:Z}=await lV1({virtualMcpId:X.virtualMcpId,branch:G},Y),W=Q.githubRepo;if(!W)throw Error("No GitHub repo connected");let K=rB();await X18(Y,Z,K);let{entry:H,isNewVm:U}=await Y18({ctx:Y,userId:J,orgId:$.id,virtualMcpId:X.virtualMcpId,branch:G,metadata:Q,githubRepo:W,existing:Z});return{...H,branch:G,isNewVm:U,runnerKind:K}}})});var sM0;var G18=D(()=>{H0();b0();sT0();qw();sM0=l1({name:"VM_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID that owns this VM"),branch:F.string().min(1).describe("Branch whose vm should be deleted (vmMap[userId][branch])")}),outputSchema:F.object({success:F.boolean()}),handler:async(X,Y)=>{let G;try{G=await lV1(X,Y)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Q,userId:J}=G;if(!Q)return{success:!0};await Zf6(Y.storage.virtualMcps,X.virtualMcpId,J,J,X.branch);let $=Q.runnerKind??"freestyle";return await(await Mt(Y,$)).delete(Q.vmId).catch((W)=>console.error(`[VM_DELETE] ${$} ${Q.vmId}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var Q18=D(()=>{oM0();G18()});var od5="https://api.github.com",eM0;var J18=D(()=>{H0();b0();cE1();XM();eM0=l1({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({connectionId:F.string().describe("ID of the mcp-github connection to use")}),outputSchema:F.object({installations:F.array(F.object({installationId:F.number(),login:F.string(),avatarUrl:F.string(),type:F.string()})),appSlug:F.string().optional()}),handler:async(X,Y)=>{await Y.access.check();let G=new Y$(Y.db,Y.vault),Q=await G.get(X.connectionId);if(!Q)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=Q.accessToken;if(R51(Q)&&G.isExpired(Q,dE1)){let U=await S51(Q,G);if(!U)throw Error(PV);J=U,Q=await G.get(X.connectionId)??Q}let $=[],Z,W=1,K=100,H=async(U)=>fetch(`${od5}/user/installations?per_page=${K}&page=${W}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let U=await H(J);if(U.status===401){let B=await G.get(X.connectionId);if(!B||!R51(B))throw Error(PV);let O=await S51(B,G);if(!O)throw Error(PV);if(J=O,U=await H(J),U.status===401)throw Error(PV)}if(!U.ok)throw Error(`GitHub /user/installations failed: ${U.status}`);let N=await U.json();for(let B of N.installations){if(!Z)Z=B.app_slug??B.app?.slug;$.push({installationId:B.id,login:B.account.login,avatarUrl:B.account.avatar_url,type:B.account.type})}if(N.installations.length<K)break;W++}return{installations:$,...Z?{appSlug:Z}:{}}}})});var Z18=D(()=>{J18()});var gT1={};h6(gT1,{managementMCP:()=>_a,listManagementTools:()=>Yc5,ALL_TOOLS:()=>$18});async function Yc5(X){let Y=await _a(X),[G,Q]=d91.createLinkedPair();await Y.connect(Q);let J=new A7({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(G),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var ed5,Xc5,$18,_a=async(X)=>{let Y=null;if(X.organization){let Z=await X.storage.organizationSettings.get(X.organization.id),W=await X.storage.virtualMcps.list(X.organization.id),K=new Set(Z?.enabled_plugins??[]);for(let H of W){let U=H.metadata?.enabled_plugins;if(U&&Array.isArray(U))for(let N of U)K.add(N)}Y=K.size>0?[...K]:null}let G=cd4($18,Y),Q=new oO({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let Z of G){let W=Z.inputSchema&&typeof Z.inputSchema==="object"&&"shape"in Z.inputSchema?Z.inputSchema:F.object({}),K=Z.outputSchema&&typeof Z.outputSchema==="object"&&"shape"in Z.outputSchema?Z.outputSchema:void 0,H=W.shape,U=K?.shape;Q.registerTool(Z.name,{description:Z.description??"",inputSchema:H,outputSchema:U,annotations:Z.annotations,_meta:Z._meta},async(N)=>{X.access.setToolName(Z.name);try{let B=await Z.execute(N,X);return{content:[{type:"text",text:JSON.stringify(B)}],structuredContent:B}}catch(B){return{content:[{type:"text",text:`Error: ${B.message}`}],isError:!0}}})}let J=MT6();for(let Z of J)Q.registerPrompt(Z.name,{title:Z.title,description:Z.description},()=>({messages:[{role:"user",content:{type:"text",text:Z.text}}]}));if(X.organization?.id){let Z=await X.storage.brandContext.list(X.organization.id),W=new Set;for(let K of Z){let H=K.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),U=H?`brand-${H}`:`brand-${K.id}`;if(W.has(U))U=`${U}-${K.id.slice(0,8)}`;W.add(U);let N=[`# Brand: ${K.name}`,"",`**Domain:** ${K.domain}`,"","## Overview",K.overview];if(K.colors){let O=Object.entries(K.colors).filter(([,z])=>z);if(O.length>0){N.push("","## Colors");for(let[z,w]of O)N.push(`- **${z}:** ${w}`)}}if(K.fonts){let O=Object.entries(K.fonts).filter(([,z])=>z);if(O.length>0){N.push("","## Fonts");for(let[z,w]of O)N.push(`- ${w} (${z})`)}}if(K.logo)N.push("",`**Logo:** ${K.logo}`);if(K.favicon)N.push(`**Favicon:** ${K.favicon}`);if(K.ogImage)N.push(`**OG Image:** ${K.ogImage}`);if(K.images&&K.images.length>0){N.push("","## Images");for(let O of K.images){let z=Object.entries(O).map(([w,E])=>`${w}: ${E}`).join(", ");N.push(`- ${z}`)}}let B=N.join(`
 `);Q.prompt(U,`Brand context for ${K.name}`,()=>({messages:[{role:"user",content:{type:"text",text:B}}]}))}}let $=RT6();for(let Z of $)Q.resource(Z.name,Z.uri,{description:Z.description,mimeType:Z.mimeType??"text/markdown"},async(W)=>{return{contents:[{uri:typeof W==="string"?W:W.href,mimeType:Z.mimeType??"text/markdown",text:Z.text}]}});return Q};var ka=D(()=>{VL1();$N();h01();H0();Hc4();KI6();NI6();AI6();_I6();xI6();Jj6();Fj6();Tj6();lj6();dj6();$T6();ST6();XV6();h_6();Q18();Z18();ed5=[wA0,LA0,EA0,PA0,qA0,AA0,IA0,jA0,TA0,VA0,MA0,RA0,kA0,CA0,vA0,_A0,fA0,bA0,yA0,xA0,hA0,gA0,uA0,E30,nq0,rq0,aq0,tq0,oq0,ZA0,WA0,KA0,HA0,FA0,UI6,OA0,zA0,DA0,k$0,v$0,_$0,C$0,sq0,eq0,XA0,YA0,GA0,QA0,JA0,BI0,nA0,rA0,aA0,tA0,oA0,sA0,lA0,mA0,dA0,cA0,iA0,eA0,XI0,YI0,ZI0,$I0,FI0,UI0,NI0,UA0,NA0,BA0,OI0,zI0,DI0,wI0,LI0,EI0,PI0,qI0,AI0,II0,jI0,TI0,VI0,MI0,RI0,SI0,kI0,CI0,...x_6,tM0,sM0,eM0],Xc5=id4(),$18=[...ed5,...Xc5]});function Gc5(X){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:Y}=await Promise.resolve().then(() => (ka(),gT1));return Y.map((G)=>{return{name:G.name,inputSchema:F.toJSONSchema(G.inputSchema,{unrepresentable:"any"}),outputSchema:G.outputSchema?F.toJSONSchema(G.outputSchema,{unrepresentable:"any"}):void 0,description:G.description}})},data:g40(J3(),X)},{data:h40()},{data:x40(X)}]}async function W18(X,Y){try{let G=uY(),Q=T4(),J=new yT(Q.encryptionKey),$=new s81(G.db,J),Z=Gc5(X);await Promise.all(Z.map(async(W)=>{let K=null;if(W.permissions)K=(await D7.api.createApiKey({body:{name:`${W.data.app_name??crypto.randomUUID()}-mcp`,userId:Y,permissions:W.permissions,rateLimitEnabled:!1,metadata:{organization:{id:X},purpose:"default-org-connections"}}}))?.key;let H=await XP({id:"pending",title:W.data.title,connection_type:W.data.connection_type,connection_url:W.data.connection_url,connection_token:W.data.connection_token,connection_headers:W.data.connection_headers}).catch(()=>null),U=await W.getTools?.()??H?.tools??null,N=H?.scopes?.length?H.scopes:null,B=W.data.id?W.data.id.startsWith(`${X}_`)?W.data.id:`${X}_${W.data.id}`:void 0;await $.create({...W.data,id:B,tools:U,configuration_scopes:N,organization_id:X,created_by:Y,connection_token:W.data.connection_token??K})}));try{let W=new e81(G.db);await yh4(X,Y,W)}catch(W){console.error("Failed to install studio pack agents:",W)}if(Q.aiGatewayEnabled&&r81.provisionKey)try{let W=await YP(Y),K=await r81.provisionKey(W,X);await new t81(G.db,J).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:K,organizationId:X,createdBy:Y})}catch(W){console.error("Failed to auto-provision Deco AI Gateway key:",W)}}catch(G){console.error("Error creating default MCP connections:",G)}}var K18=D(()=>{g5();sQ0();nz();tE();Pw1();eQ0();YJ0();GJ0();$91();xh4();H0();f5();QM();gT()});function Qc5(X,Y){let G=X.email.split("@")[1]?.toLowerCase()??null;return{distinctId:X.id,properties:{$set:{email:X.email,name:X.name,email_verified:X.emailVerified},$set_once:{first_seen_at:Y.toISOString(),signup_email_domain:G}}}}function XR0(X){q6.identify(Qc5(X,new Date))}var H18=D(()=>{NY()});async function Zc5(X){let{user:Y,token:G}=X;if(!G?.idToken)return;let Q;try{Q=d5(G.idToken)}catch{return}let{preferred_username:J,upn:$}=Q,Z=[J,$].filter((H)=>typeof H==="string"&&H.length>0&&H.toLowerCase()!==Y.email.toLowerCase()).map((H)=>H.toLowerCase());if(Z.length===0)return;let{db:W}=uY(),K=await W.selectFrom("user").selectAll().where("email","in",Z).where("id","!=",Y.id).executeTakeFirst();if(!K)return;try{await W.transaction().execute(async(H)=>{await n1`UPDATE "account" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await n1`UPDATE "session" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await n1`
         UPDATE "member" SET "userId" = ${K.id}
         WHERE "userId" = ${Y.id}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/ai-providers-C1FPIgEY.js

@@ -1 +0,0 @@
-import{e as t,j as i}from"./index-DTUtF6tB.js";import{O as m}from"./select-model-FblXWw23.js";import"./checkbox-CNJ6z3XU.js";import"./ChevronDown-DDFxcF9W.js";import"./input-TpxNqT-Q.js";import"./dialog-lD4W7cL9.js";import"./X-DqkI9zVV.js";import"./drawer-B6Pw2Zfs.js";import"./tooltip-Ju9odpt2.js";import"./select-CyG96pDg.js";import"./ChevronUp-CtNieYpH.js";import"./skeleton-BvuzXwwl.js";import"./Tool01-BPPJNEle.js";import"./RefreshCcw01-DqLt_1bE.js";import"./SearchMd-DKMhFHxh.js";import"./Settings02-taJod4SB.js";import"./use-ai-providers-Dk352xYe.js";import"./constants-DSf6w6yo.js";import"./chat-context-BmpJ7SNS.js";import"./use-virtual-mcp-B1BxhZXH.js";import"./use-collections-Dp9e4q3y.js";import"./use-decopilot-events-DN-SMHVv.js";import"./create-sse-subscription-CxkOgzKf.js";import"./use-tasks-Ceh8jY0q.js";import"./use-organization-settings-J-AkXlMa.js";import"./ai-providers-logos-D6a8kmGH.js";import"./Zap-DC_qP-1G.js";import"./AlertCircle-BEl-P1aJ.js";import"./CheckCircle-D5rpSegm.js";import"./Trash01-BJfG55F8.js";import"./index-Cj5K0yVq.js";import"./settings-section-WU-BEfr6.js";import"./card-C12vo1Oj.js";import"./ArrowUpRight-BpNxiq0a.js";import"./switch-B9BVMWzi.js";import"./toggle-group-CVu8ATbO.js";import"./avatar-Bynt8XW_.js";import"./User01-JUiKZKer.js";import"./alert-dialog-DeVpX_3k.js";import"./formatDistanceToNow-Cb2QZZJn.js";import"./differenceInSeconds-NQ4PDo0z.js";import"./unwrap-tool-result-BYXdCQMg.js";function T(){const o=t.c(1);let r;return o[0]===Symbol.for("react.memo_cache_sentinel")?(r=i.jsx(m,{}),o[0]=r):r=o[0],r}export{T as default};

package/dist/client/assets/index-B3bKRv_D.js

@@ -1 +0,0 @@
-import{e as n,j as r,r as d,g as h,O as f,l as u}from"./index-DTUtF6tB.js";import{S as j,a as b,b as S}from"./index-Cj5K0yVq.js";import{u as _}from"./tooltip-Ju9odpt2.js";import{u as k,T as y,a as T,b as i,S as g}from"./index-1TPOFLt6.js";import{C as v}from"./chat-context-BmpJ7SNS.js";import"./X-DqkI9zVV.js";import"./agent-icon-DamyRaK7.js";import"./AlertCircle-BEl-P1aJ.js";import"./Tool01-BPPJNEle.js";import"./XClose-Cn_0qgm2.js";import"./RefreshCcw01-DqLt_1bE.js";import"./ArrowNarrowLeft-UuLNV5ks.js";import"./XCircle-DB9lNtAM.js";import"./ArrowUpRight-BpNxiq0a.js";import"./ZapSquare-TGY7Gwno.js";import"./Users03-XiqDhrhQ.js";import"./CheckCircle-D5rpSegm.js";import"./ChevronDown-DDFxcF9W.js";import"./ChevronRight-CRmRMkqi.js";import"./ChevronUp-CtNieYpH.js";import"./DotsVertical-Cprvx6Eg.js";import"./Container-DximN8pX.js";import"./Star01-DlhbcR1x.js";import"./Palette-Ye5CLNlX.js";import"./SearchMd-DKMhFHxh.js";import"./LinkExternal01-i6uggWQR.js";import"./Lock01-Deeb6XHh.js";import"./Sun-CmYb8MhQ.js";import"./Play-CDSLiCuz.js";import"./Plus-DpjXlSo9.js";import"./Settings02-taJod4SB.js";import"./Shield01-1NL5CB8G.js";import"./Trash01-BJfG55F8.js";import"./User01-JUiKZKer.js";import"./Zap-DC_qP-1G.js";import"./shell-layout-DSl8Bt23.js";import"./dialog-lD4W7cL9.js";import"./required-auth-layout-QyKcPfkb.js";import"./use-tasks-Ceh8jY0q.js";import"./use-collections-Dp9e4q3y.js";import"./constants-DSf6w6yo.js";import"./use-organization-settings-J-AkXlMa.js";import"./use-org-sso-firP3Vdm.js";import"./pair-P2Rt1Yzk.js";import"./index-LUGE748D.js";import"./use-copy-ChW86iBL.js";import"./differenceInSeconds-NQ4PDo0z.js";import"./content-blocks-o63cs2vh.js";import"./types-C7HolpHC.js";import"./integration-icon-DbXG6KKJ.js";import"./use-virtual-mcp-B1BxhZXH.js";import"./skeleton-BvuzXwwl.js";import"./popover-kim5gbvq.js";import"./drawer-B6Pw2Zfs.js";import"./avatar-Bynt8XW_.js";import"./alert-dialog-DeVpX_3k.js";import"./form-BqyPslyw.js";import"./label-BNU285Rh.js";import"./input-TpxNqT-Q.js";import"./index-CdP1fB6m.js";import"./use-mcp-tools-CGsNy8CG.js";import"./use-ai-providers-Dk352xYe.js";import"./index-CpAtDDvI.js";import"./switch-B9BVMWzi.js";import"./use-connection-CyXg_60p.js";import"./lean-canvas-recruit-modal-CdPczQti.js";import"./use-navigate-to-agent-YkMwhD8K.js";import"./collection-search-Cod3svbd.js";import"./checkbox-CNJ6z3XU.js";import"./extract-connection-data-sU9mZxB7.js";import"./constants-CpX-unNl.js";import"./collections-DWJ0-uuD.js";import"./tabs-D86C2OZJ.js";import"./dropdown-menu-iOKHVoXF.js";import"./select-CyG96pDg.js";import"./toggle-group-CVu8ATbO.js";import"./select-model-FblXWw23.js";import"./ai-providers-logos-D6a8kmGH.js";import"./settings-section-WU-BEfr6.js";import"./card-C12vo1Oj.js";import"./formatDistanceToNow-Cb2QZZJn.js";import"./unwrap-tool-result-BYXdCQMg.js";import"./index-sm8aigvr.js";import"./question-004-sINsf4GQ.js";import"./connection-slug-eyAPH6o3.js";import"./connection-card-DieKn2X5.js";import"./use-registry-connections-M1V7Kg3U.js";import"./useInfiniteQuery-DMAfx3i_.js";import"./infiniteQueryObserver-6D5CrZOV.js";import"./collection-tabs-BqrhMDY6.js";import"./badge-Id-Iau1h.js";import"./textarea-_s-nSiHJ.js";import"./connection-form-helpers-T5uLVfeV.js";import"./use-infinite-scroll-CDATP25U.js";import"./useSuspenseInfiniteQuery-BqjEaABk.js";import"./collection-search-Cy9SjZ7-.js";import"./use-create-virtual-mcp-kdZj_y0i.js";import"./empty-state-p-AMSRlv.js";import"./use-decopilot-events-DN-SMHVv.js";import"./create-sse-subscription-CxkOgzKf.js";import"./task-status-DShE4Jg-.js";const N=280;function P(){const t=n.c(2),{tasksOpen:e}=k();if(!e)return null;let o;t[0]===Symbol.for("react.memo_cache_sentinel")?(o={width:`${N}px`},t[0]=o):o=t[0];let m;return t[1]===Symbol.for("react.memo_cache_sentinel")?(m=r.jsx("aside",{className:"shrink-0 h-full bg-sidebar pb-1",style:o,children:r.jsx("div",{className:"h-full p-0.5 pt-0.25",children:r.jsx("div",{className:"h-full bg-background rounded-[0.75rem] overflow-hidden card-shadow",children:r.jsx(y,{})})})}),t[1]=m):m=t[1],m}function C(){const t=n.c(1);let e;return t[0]===Symbol.for("react.memo_cache_sentinel")?(e=r.jsx(d.Suspense,{fallback:null,children:r.jsx(P,{})}),t[0]=e):e=t[0],e}function x(){const t=n.c(1);let e;return t[0]===Symbol.for("react.memo_cache_sentinel")?(e=r.jsx("div",{className:"flex-1 flex items-center justify-center",children:r.jsx(u,{size:20,className:"animate-spin text-muted-foreground"})}),t[0]=e):e=t[0],e}function yr(){const t=n.c(7),e=_();let o;t[0]===Symbol.for("react.memo_cache_sentinel")?(o={strict:!1},t[0]=o):o=t[0];const c=!!h(o).taskId;let s;t[1]===Symbol.for("react.memo_cache_sentinel")?(s={"--sidebar-width-icon":"3.5rem"},t[1]=s):s=t[1];let l;t[2]===Symbol.for("react.memo_cache_sentinel")?(l=r.jsx(g,{}),t[2]=l):l=t[2];let p;t[3]===Symbol.for("react.memo_cache_sentinel")?(p={background:"transparent",containerType:"inline-size"},t[3]=p):p=t[3];let a;return t[4]!==c||t[5]!==e?(a=r.jsx(j,{defaultOpen:!1,children:r.jsx("div",{className:"flex flex-col h-dvh overflow-hidden",children:r.jsxs(b,{className:"flex-1 bg-sidebar",style:s,children:[l,r.jsx(S,{className:"flex flex-col",style:p,children:r.jsx(v,{children:r.jsx(T,{children:e?r.jsx(d.Suspense,{fallback:r.jsx(x,{}),children:r.jsx(f,{})}):r.jsxs(i,{children:[r.jsxs(i.Header,{children:[r.jsxs(i.LeftColumn,{children:[r.jsx(i.Nav,{}),r.jsx(i.TogglesSlot,{})]}),r.jsx(i.CenterSlot,{}),r.jsxs(i.RightColumn,{children:[r.jsx(i.TabsSlot,{}),r.jsx(i.RightSlot,{})]})]}),r.jsxs("div",{className:"flex-1 min-h-0 flex flex-row",children:[c&&r.jsx(C,{}),r.jsx(d.Suspense,{fallback:r.jsx(x,{}),children:r.jsx(f,{})})]})]})})})})]})})}),t[4]=c,t[5]=e,t[6]=a):a=t[6],a}export{yr as default};

package/dist/client/assets/registry-B-_5oMj_.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/registry-layout-Bw5aMcpb.js","assets/index-DTUtF6tB.js","assets/index-DT63_YMm.css","assets/ArrowNarrowLeft-UuLNV5ks.js","assets/CheckCircle-D5rpSegm.js","assets/Container-DximN8pX.js","assets/Settings02-taJod4SB.js","assets/XCircle-DB9lNtAM.js","assets/constants-DSf6w6yo.js","assets/useInfiniteQuery-DMAfx3i_.js","assets/infiniteQueryObserver-6D5CrZOV.js","assets/badge-Id-Iau1h.js","assets/input-TpxNqT-Q.js","assets/dropdown-menu-iOKHVoXF.js","assets/ChevronDown-DDFxcF9W.js","assets/ChevronRight-CRmRMkqi.js","assets/DotsVertical-Cprvx6Eg.js","assets/table-BI_8F_nL.js","assets/toggle-group-CVu8ATbO.js","assets/use-view-mode-DHDRtqKq.js","assets/tooltip-Ju9odpt2.js","assets/SearchMd-DKMhFHxh.js","assets/dialog-lD4W7cL9.js","assets/X-DqkI9zVV.js","assets/AlertCircle-BEl-P1aJ.js","assets/alert-dialog-DeVpX_3k.js","assets/card-C12vo1Oj.js","assets/Trash01-BJfG55F8.js","assets/label-BNU285Rh.js","assets/select-CyG96pDg.js","assets/ChevronUp-CtNieYpH.js","assets/switch-B9BVMWzi.js","assets/textarea-_s-nSiHJ.js","assets/RefreshCcw01-DqLt_1bE.js","assets/checkbox-CNJ6z3XU.js","assets/LinkExternal01-i6uggWQR.js","assets/use-copy-ChW86iBL.js","assets/Plus-DpjXlSo9.js","assets/Play-CDSLiCuz.js"])))=>i.map(i=>d[i]);
-import{e as a,j as t,r,l as i,_ as o}from"./index-DTUtF6tB.js";const n=r.lazy(()=>o(()=>import("./registry-layout-Bw5aMcpb.js"),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38])));function c(){const s=a.c(1);let e;return s[0]===Symbol.for("react.memo_cache_sentinel")?(e=t.jsx(r.Suspense,{fallback:t.jsx("div",{className:"flex-1 flex items-center justify-center",children:t.jsx(i,{size:20,className:"animate-spin text-muted-foreground"})}),children:t.jsx(n,{})}),s[0]=e):e=s[0],e}export{c as default};

package/dist/client/assets/store-registry-CQdXfZj-.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/registry-layout-Bw5aMcpb.js","assets/index-DTUtF6tB.js","assets/index-DT63_YMm.css","assets/ArrowNarrowLeft-UuLNV5ks.js","assets/CheckCircle-D5rpSegm.js","assets/Container-DximN8pX.js","assets/Settings02-taJod4SB.js","assets/XCircle-DB9lNtAM.js","assets/constants-DSf6w6yo.js","assets/useInfiniteQuery-DMAfx3i_.js","assets/infiniteQueryObserver-6D5CrZOV.js","assets/badge-Id-Iau1h.js","assets/input-TpxNqT-Q.js","assets/dropdown-menu-iOKHVoXF.js","assets/ChevronDown-DDFxcF9W.js","assets/ChevronRight-CRmRMkqi.js","assets/DotsVertical-Cprvx6Eg.js","assets/table-BI_8F_nL.js","assets/toggle-group-CVu8ATbO.js","assets/use-view-mode-DHDRtqKq.js","assets/tooltip-Ju9odpt2.js","assets/SearchMd-DKMhFHxh.js","assets/dialog-lD4W7cL9.js","assets/X-DqkI9zVV.js","assets/AlertCircle-BEl-P1aJ.js","assets/alert-dialog-DeVpX_3k.js","assets/card-C12vo1Oj.js","assets/Trash01-BJfG55F8.js","assets/label-BNU285Rh.js","assets/select-CyG96pDg.js","assets/ChevronUp-CtNieYpH.js","assets/switch-B9BVMWzi.js","assets/textarea-_s-nSiHJ.js","assets/RefreshCcw01-DqLt_1bE.js","assets/checkbox-CNJ6z3XU.js","assets/LinkExternal01-i6uggWQR.js","assets/use-copy-ChW86iBL.js","assets/Plus-DpjXlSo9.js","assets/Play-CDSLiCuz.js"])))=>i.map(i=>d[i]);
-import{e as n,f as c,g as m,j as r,l as f,r as l,_ as u}from"./index-DTUtF6tB.js";const _=l.lazy(()=>u(()=>import("./registry-layout-Bw5aMcpb.js"),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38])));function x(){const e=n.c(5),o=c();let t;e[0]===Symbol.for("react.memo_cache_sentinel")?(t={from:"/shell/$org"},e[0]=t):t=e[0];const{org:i}=m(t);let s;e[1]===Symbol.for("react.memo_cache_sentinel")?(s=r.jsx("div",{className:"h-full flex items-center justify-center",children:r.jsx(f,{size:20,className:"animate-spin text-muted-foreground"})}),e[1]=s):s=e[1];let a;return e[2]!==o||e[3]!==i?(a=r.jsx(l.Suspense,{fallback:s,children:r.jsx(_,{onBack:()=>o({to:"/$org/settings/store",params:{org:i}})})}),e[2]=o,e[3]=i,e[4]=a):a=e[4],a}export{x as default};

package/dist/client/assets/useInfiniteQuery-DMAfx3i_.js

@@ -1 +0,0 @@
-import{I as u}from"./infiniteQueryObserver-6D5CrZOV.js";import{c2 as i}from"./index-DTUtF6tB.js";function t(e,r){return i(e,u,r)}export{t as u};

package/dist/client/assets/useSuspenseInfiniteQuery-BqjEaABk.js

@@ -1 +0,0 @@
-import{I as s}from"./infiniteQueryObserver-6D5CrZOV.js";import{c2 as u,c3 as n}from"./index-DTUtF6tB.js";function a(r,e){return u({...r,enabled:!0,suspense:!0,throwOnError:n},s,e)}export{a as u};

package/dist/client/assets/workflow-detail-Cx1ON290.js

@@ -1 +0,0 @@
-import{e as s,g as l,j as o,l as a,E as n,r as c}from"./index-DTUtF6tB.js";import{a as f}from"./index-DhzeM_Du.js";import"./index-DeypY-gF.js";import"./constants-DSf6w6yo.js";import"./collections-DWJ0-uuD.js";import"./index-C9KyfQmt.js";import"./use-virtual-mcp-B1BxhZXH.js";import"./use-collections-Dp9e4q3y.js";import"./monaco-editor-rWTM04Ye.js";import"./index-LUGE748D.js";import"./accordion-C_TRqr7H.js";import"./agent-icon-DamyRaK7.js";import"./AlertCircle-BEl-P1aJ.js";import"./Tool01-BPPJNEle.js";import"./XClose-Cn_0qgm2.js";import"./RefreshCcw01-DqLt_1bE.js";import"./ArrowNarrowLeft-UuLNV5ks.js";import"./XCircle-DB9lNtAM.js";import"./ArrowUpRight-BpNxiq0a.js";import"./ZapSquare-TGY7Gwno.js";import"./Users03-XiqDhrhQ.js";import"./CheckCircle-D5rpSegm.js";import"./ChevronDown-DDFxcF9W.js";import"./ChevronRight-CRmRMkqi.js";import"./ChevronUp-CtNieYpH.js";import"./DotsVertical-Cprvx6Eg.js";import"./Container-DximN8pX.js";import"./Star01-DlhbcR1x.js";import"./Palette-Ye5CLNlX.js";import"./SearchMd-DKMhFHxh.js";import"./index-Cj5K0yVq.js";import"./tooltip-Ju9odpt2.js";import"./X-DqkI9zVV.js";import"./LinkExternal01-i6uggWQR.js";import"./Lock01-Deeb6XHh.js";import"./Sun-CmYb8MhQ.js";import"./Play-CDSLiCuz.js";import"./Plus-DpjXlSo9.js";import"./Settings02-taJod4SB.js";import"./Shield01-1NL5CB8G.js";import"./Trash01-BJfG55F8.js";import"./User01-JUiKZKer.js";import"./Zap-DC_qP-1G.js";import"./badge-Id-Iau1h.js";import"./select-CyG96pDg.js";import"./view-mode-toggle-CppmeCW-.js";import"./layout-FPl3EeRG.js";import"./use-connection-CyXg_60p.js";import"./use-mcp-tools-CGsNy8CG.js";import"./dialog-lD4W7cL9.js";import"./index-sm8aigvr.js";import"./dropdown-menu-iOKHVoXF.js";import"./integration-icon-DbXG6KKJ.js";import"./scroll-area-dzwIlukh.js";import"./index-CdP1fB6m.js";import"./empty-state-BxlxnTB7.js";import"./create-sse-subscription-CxkOgzKf.js";import"./input-TpxNqT-Q.js";function ht(){const t=s.c(4);let r;t[0]===Symbol.for("react.memo_cache_sentinel")?(r={from:"/shell/$org/settings/workflows/$itemId"},t[0]=r):r=t[0];const{itemId:e}=l(r);let i;t[1]===Symbol.for("react.memo_cache_sentinel")?(i=o.jsx("div",{className:"flex h-full items-center justify-center",children:o.jsx(a,{size:32,className:"animate-spin text-muted-foreground"})}),t[1]=i):i=t[1];const p=decodeURIComponent(e);let m;return t[2]!==p?(m=o.jsx(n,{children:o.jsx(c.Suspense,{fallback:i,children:o.jsx(f,{itemId:p})})}),t[2]=p,t[3]=m):m=t[3],m}export{ht as default};