decocms 2.311.5 → 2.311.7

package/dist/server/node_modules/xtend/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "xtend",
+  "version": "4.0.2",
+  "description": "extend like a boss",
+  "keywords": [
+    "extend",
+    "merge",
+    "options",
+    "opts",
+    "object",
+    "array"
+  ],
+  "author": "Raynos <raynos2@gmail.com>",
+  "repository": "git://github.com/Raynos/xtend.git",
+  "main": "immutable",
+  "scripts": {
+    "test": "node test"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "tape": "~1.1.0"
+  },
+  "homepage": "https://github.com/Raynos/xtend",
+  "contributors": [
+    {
+      "name": "Jake Verbaten"
+    },
+    {
+      "name": "Matt Esch"
+    }
+  ],
+  "bugs": {
+    "url": "https://github.com/Raynos/xtend/issues",
+    "email": "raynos2@gmail.com"
+  },
+  "license": "MIT",
+  "testling": {
+    "files": "test.js",
+    "browsers": [
+      "ie/7..latest",
+      "firefox/16..latest",
+      "firefox/nightly",
+      "chrome/22..latest",
+      "chrome/canary",
+      "opera/12..latest",
+      "opera/next",
+      "safari/5.1..latest",
+      "ipad/6.0..latest",
+      "iphone/6.0..latest"
+    ]
+  },
+  "engines": {
+    "node": ">=0.4"
+  }
+}

package/dist/server/node_modules/xtend/test.js

@@ -0,0 +1,103 @@
+var test = require("tape")
+var extend = require("./")
+var mutableExtend = require("./mutable")
+
+test("merge", function(assert) {
+    var a = { a: "foo" }
+    var b = { b: "bar" }
+
+    assert.deepEqual(extend(a, b), { a: "foo", b: "bar" })
+    assert.end()
+})
+
+test("replace", function(assert) {
+    var a = { a: "foo" }
+    var b = { a: "bar" }
+
+    assert.deepEqual(extend(a, b), { a: "bar" })
+    assert.end()
+})
+
+test("undefined", function(assert) {
+    var a = { a: undefined }
+    var b = { b: "foo" }
+
+    assert.deepEqual(extend(a, b), { a: undefined, b: "foo" })
+    assert.deepEqual(extend(b, a), { a: undefined, b: "foo" })
+    assert.end()
+})
+
+test("handle 0", function(assert) {
+    var a = { a: "default" }
+    var b = { a: 0 }
+
+    assert.deepEqual(extend(a, b), { a: 0 })
+    assert.deepEqual(extend(b, a), { a: "default" })
+    assert.end()
+})
+
+test("is immutable", function (assert) {
+    var record = {}
+
+    extend(record, { foo: "bar" })
+    assert.equal(record.foo, undefined)
+    assert.end()
+})
+
+test("null as argument", function (assert) {
+    var a = { foo: "bar" }
+    var b = null
+    var c = void 0
+
+    assert.deepEqual(extend(b, a, c), { foo: "bar" })
+    assert.end()
+})
+
+test("mutable", function (assert) {
+    var a = { foo: "bar" }
+
+    mutableExtend(a, { bar: "baz" })
+
+    assert.equal(a.bar, "baz")
+    assert.end()
+})
+
+test("null prototype", function(assert) {
+    var a = { a: "foo" }
+    var b = Object.create(null)
+    b.b = "bar";
+
+    assert.deepEqual(extend(a, b), { a: "foo", b: "bar" })
+    assert.end()
+})
+
+test("null prototype mutable", function (assert) {
+    var a = { foo: "bar" }
+    var b = Object.create(null)
+    b.bar = "baz";
+
+    mutableExtend(a, b)
+
+    assert.equal(a.bar, "baz")
+    assert.end()
+})
+
+test("prototype pollution", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    extend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})
+
+test("prototype pollution mutable", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    mutableExtend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})

package/dist/server/server.js

@@ -6160,25 +6160,24 @@ class SetupOrchestrator {
     if (!repoDir)
       return;
     const onChunk = (_src, data) => this.chunk(data);
-    const gc = \`git -c safe.directory='*' -C \${repoDir}\`;
-    let onRemote = false;
-    const fetch1 = await spawnSetupStep(\`\${gc} fetch origin +refs/heads/\${branch}:refs/remotes/origin/\${branch}\`, onChunk);
-    if (fetch1 === 0) {
-      const fetch2 = await spawnSetupStep(\`\${gc} fetch origin \${branch}:\${branch}\`, onChunk);
-      onRemote = fetch2 === 0;
-    }
-    if (onRemote) {
-      const code = await spawnSetupStep(\`\${gc} checkout -f \${branch}\`, onChunk);
-      if (code !== 0)
-        throw new Error(\`git checkout -f \${branch} exited \${code}\`);
+    const silent = (_src, _data) => {};
+    const gc = \`git -c safe.directory='*' -c http.connectTimeout=10 -c http.lowSpeedLimit=1 -c http.lowSpeedTime=10 -C \${repoDir}\`;
+    const probe = await spawnSetupStep(\`\${gc} fetch origin +refs/heads/\${branch}:refs/remotes/origin/\${branch}\`, silent);
+    if (probe === 0) {
+      const code2 = await spawnSetupStep(\`\${gc} checkout -f \${branch}\`, onChunk);
+      if (code2 !== 0)
+        throw new Error(\`git checkout -f \${branch} exited \${code2}\`);
       return;
     }
-    const checkoutCode = await spawnSetupStep(\`\${gc} checkout -f \${branch}\`, onChunk);
-    if (checkoutCode === 0)
+    this.chunk(\`[orchestrator] branch not found on remote, checking out locally\\r
+\`);
+    if (await spawnSetupStep(\`\${gc} checkout -f \${branch}\`, silent) === 0)
       return;
-    const createCode = await spawnSetupStep(\`\${gc} checkout -b \${branch}\`, onChunk);
-    if (createCode !== 0)
-      throw new Error(\`git checkout -b \${branch} exited \${createCode}\`);
+    this.chunk(\`[orchestrator] creating new local branch: \${branch}\\r
+\`);
+    const code = await spawnSetupStep(\`\${gc} checkout -b \${branch}\`, onChunk);
+    if (code !== 0)
+      throw new Error(\`git checkout -b \${branch} exited \${code}\`);
   }
 }
 
@@ -6726,7 +6725,7 @@ mkdir -p /app && chown deco:deco /app
 `);return c9.from(G)};Sd5.decodePax=function(Y){let G={};while(Y.length){let Q=0;while(Q<Y.length&&Y[Q]!==32)Q++;let J=parseInt(c9.toString(Y.subarray(0,Q)),10);if(!J)return G;let $=c9.toString(Y.subarray(Q+1,J-1)),Z=$.indexOf("=");if(Z===-1)return G;G[$.slice(0,Z)]=$.slice(Z+1),Y=Y.subarray(J)}return G};Sd5.encode=function(Y){let G=c9.alloc(512),Q=Y.name,J="";if(Y.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(c9.byteLength(Q)!==Q.length)return null;while(c9.byteLength(Q)>100){let $=Q.indexOf("/");if($===-1)return null;J+=J?"/"+Q.slice(0,$):Q.slice(0,$),Q=Q.slice($+1)}if(c9.byteLength(Q)>100||c9.byteLength(J)>155)return null;if(Y.linkname&&c9.byteLength(Y.linkname)>100)return null;if(c9.write(G,Q),c9.write(G,UA(Y.mode&4095,6),100),c9.write(G,UA(Y.uid,6),108),c9.write(G,UA(Y.gid,6),116),Md5(Y.size,G,124),c9.write(G,UA(Y.mtime.getTime()/1000|0,11),136),G[156]=48+jd5(Y.type),Y.linkname)c9.write(G,Y.linkname,157);if(c9.copy(_e6,G,257),c9.copy(Ld5,G,263),Y.uname)c9.write(G,Y.uname,265);if(Y.gname)c9.write(G,Y.gname,297);if(c9.write(G,UA(Y.devmajor||0,6),329),c9.write(G,UA(Y.devminor||0,6),337),J)c9.write(G,J,345);return c9.write(G,UA(be6(G),6),148),G};Sd5.decode=function(Y,G,Q){let J=Y[156]===0?0:Y[156]-48,$=Ra(Y,0,100,G),Z=FA(Y,100,8),W=FA(Y,108,8),K=FA(Y,116,8),H=FA(Y,124,12),U=FA(Y,136,12),B=Id5(J),N=Y[157]===0?null:Ra(Y,157,100,G),O=Ra(Y,265,32),z=Ra(Y,297,32),D=FA(Y,329,8),E=FA(Y,337,8),P=be6(Y);if(P===256)return null;if(P!==FA(Y,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(qd5(Y)){if(Y[345])$=Ra(Y,345,155,G)+"/"+$}else if(Ad5(Y));else if(!Q)throw Error("Invalid tar header: unknown format.");if(J===0&&$&&$[$.length-1]==="/")J=5;return{name:$,mode:Z,uid:W,gid:K,size:H,mtime:new Date(1000*U),type:B,linkname:N,uname:O,gname:z,devmajor:D,devminor:E,pax:null}};function qd5(X){return c9.equals(_e6,X.subarray(257,263))}function Ad5(X){return c9.equals(Ed5,X.subarray(257,263))&&c9.equals(Pd5,X.subarray(263,265))}function Td5(X,Y,G){if(typeof X!=="number")return G;if(X=~~X,X>=Y)return Y;if(X>=0)return X;if(X+=Y,X>=0)return X;return 0}function Id5(X){switch(X){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function jd5(X){switch(X){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function fe6(X,Y,G,Q){for(;G<Q;G++)if(X[G]===Y)return G;return Q}function be6(X){let Y=256;for(let G=0;G<148;G++)Y+=X[G];for(let G=156;G<512;G++)Y+=X[G];return Y}function UA(X,Y){if(X=X.toString(8),X.length>Y)return"7777777777777777777".slice(0,Y)+" ";return"0000000000000000000".slice(0,Y-X.length)+X+" "}function Vd5(X,Y,G){Y[G]=128;for(let Q=11;Q>0;Q--)Y[G+Q]=X&255,X=Math.floor(X/256)}function Md5(X,Y,G){if(X.toString(8).length>11)Vd5(X,Y,G);else c9.write(Y,UA(X,11),G)}function Rd5(X){let Y;if(X[0]===128)Y=!0;else if(X[0]===255)Y=!1;else return null;let G=[],Q;for(Q=X.length-1;Q>0;Q--){let Z=X[Q];if(Y)G.push(Z);else G.push(255-Z)}let J=0,$=G.length;for(Q=0;Q<$;Q++)J+=G[Q]*Math.pow(256,Q);return Y?J:-1*J}function FA(X,Y,G){if(X=X.subarray(Y,Y+G),Y=0,X[Y]&128)return Rd5(X);else{while(Y<X.length&&X[Y]===32)Y++;let Q=Td5(fe6(X,32,Y,X.length),X.length,X.length);while(Y<Q&&X[Y]===0)Y++;if(Q===Y)return 0;return parseInt(c9.toString(X.subarray(Y,Q)),8)}}function Ra(X,Y,G,Q){return c9.toString(X.subarray(Y,fe6(X,0,Y,Y+G)),Q)}function $R0(X){let Y=c9.byteLength(X),G=Math.floor(Math.log(Y)/Math.log(10))+1;if(Y+G>=Math.pow(10,G))G++;return Y+G+X}});var de6=k((DRG,me6)=>{var{Writable:bd5,Readable:yd5,getStreamError:ye6}=ZR0(),hd5=eM0(),he6=Ma(),Sa=WR0(),xd5=he6.alloc(0);class xe6{constructor(){this.buffered=0,this.shifted=0,this.queue=new hd5,this._offset=0}push(X){this.buffered+=X.byteLength,this.queue.push(X)}shiftFirst(X){return this._buffered===0?null:this._next(X)}shift(X){if(X>this.buffered)return null;if(X===0)return xd5;let Y=this._next(X);if(X===Y.byteLength)return Y;let G=[Y];while((X-=Y.byteLength)>0)Y=this._next(X),G.push(Y);return he6.concat(G)}_next(X){let Y=this.queue.peek(),G=Y.byteLength-this._offset;if(X>=G){let Q=this._offset?Y.subarray(this._offset,Y.byteLength):Y;return this.queue.shift(),this._offset=0,this.buffered-=G,this.shifted+=G,Q}return this.buffered-=X,this.shifted+=X,Y.subarray(this._offset,this._offset+=X)}}class ge6 extends yd5{constructor(X,Y,G){super();this.header=Y,this.offset=G,this._parent=X}_read(X){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();X(null)}_predestroy(){this._parent.destroy(ye6(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=le6(this.header.size),this._parent._update()}_destroy(X){this._detach(),X(null)}}class ue6 extends bd5{constructor(X){super(X);if(!X)X={};this._buffer=new xe6,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=KR0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=X.filenameEncoding||"utf-8",this._allowUnknownFormat=!!X.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(X){if(this._locked=!1,X){this.destroy(X),this._continueWrite(X);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Sa.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(X){return this._continueWrite(X),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(X){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Sa.decodeLongPath(X,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Sa.decodeLongPath(X,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Sa.decodePax(X);break;case"pax-header":this._pax=this._paxGlobal===null?Sa.decodePax(X):Object.assign({},this._paxGlobal,Sa.decodePax(X));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=le6(this._header.size);let X=this._buffer.shift(this._header.size);try{this._decodeLongHeader(X)}catch(Y){return this._continueWrite(Y),!1}return!0}_consumeStream(){let X=this._buffer.shiftFirst(this._missing);if(X===null)return!1;this._missing-=X.byteLength;let Y=this._stream.push(X);if(this._missing===0){if(this._stream.push(null),Y)this._stream._detach();return Y&&this._locked===!1}return Y}_createStream(){return new ge6(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let X=this._buffer.shiftFirst(this._missing);if(X!==null)this._missing-=X.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(X){let Y=this._callback;this._callback=KR0,Y(X)}_write(X,Y){this._callback=Y,this._buffer.push(X),this._update()}_final(X){this._finished=this._missing===0&&this._buffer.buffered===0,X(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(X){if(this._stream)this._stream.destroy(ye6(this));X(null)}[Symbol.asyncIterator](){let X=null,Y=null,G=null,Q=null,J=null,$=this;return this.on("entry",K),this.on("error",(B)=>{X=B}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return U(null)},throw(B){return U(B)}};function Z(B){if(!J)return;let N=J;J=null,N(B)}function W(B,N){if(X)return N(X);if(Q){B({value:Q,done:!1}),Q=null;return}if(Y=B,G=N,Z(null),$._finished&&Y)Y({value:void 0,done:!0}),Y=G=null}function K(B,N,O){if(J=O,N.on("error",KR0),Y)Y({value:N,done:!1}),Y=G=null;else Q=N}function H(){if(Z(X),!Y)return;if(X)G(X);else Y({value:void 0,done:!0});Y=G=null}function U(B){return $.destroy(B),Z(B),new Promise((N,O)=>{if($.destroyed)return N({value:void 0,done:!0});$.once("close",function(){if(B)O(B);else N({value:void 0,done:!0})})})}}}me6.exports=function(Y){return new ue6(Y)};function KR0(){}function le6(X){return X&=511,X&&512-X}});var ie6=k((wRG,HR0)=>{var ce6={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{HR0.exports=_1("fs").constants||ce6}catch{HR0.exports=ce6}});var se6=k((LRG,oe6)=>{var{Readable:gd5,Writable:ud5,getStreamError:pe6}=ZR0(),Jl=Ma(),ka=ie6(),Ru1=WR0(),ne6=Jl.alloc(1024);class te6 extends ud5{constructor(X,Y,G){super({mapWritable:md5,eagerOpen:!0});if(this.written=0,this.header=Y,this._callback=G,this._linkname=null,this._isLinkname=Y.type==="symlink"&&!Y.linkname,this._isVoid=Y.type!=="file"&&Y.type!=="contiguous-file",this._finished=!1,this._pack=X,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(X){if(this._openCallback=X,this._pack._stream===this)this._continueOpen()}_continuePack(X){if(this._callback===null)return;let Y=this._callback;this._callback=null,Y(X)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let X=this._openCallback;if(this._openCallback=null,X===null)return;if(this._pack.destroying)return X(Error("pack stream destroyed"));if(this._pack._finalized)return X(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);X(null)}_write(X,Y){if(this._isLinkname)return this._linkname=this._linkname?Jl.concat([this._linkname,X]):X,Y(null);if(this._isVoid){if(X.byteLength>0)return Y(Error("No body allowed for this entry"));return Y()}if(this.written+=X.byteLength,this._pack.push(X))return Y();this._pack._drain=Y}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?Jl.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);ae6(this._pack,this.header.size),this._pack._done(this)}_final(X){if(this.written!==this.header.size)return X(Error("Size mismatch"));this._finish(),X(null)}_getError(){return pe6(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(X){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),X()}}class re6 extends gd5{constructor(X){super(X);this._drain=FR0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(X,Y,G){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Y==="function")G=Y,Y=null;if(!G)G=FR0;if(!X.size||X.type==="symlink")X.size=0;if(!X.type)X.type=ld5(X.mode);if(!X.mode)X.mode=X.type==="directory"?493:420;if(!X.uid)X.uid=0;if(!X.gid)X.gid=0;if(!X.mtime)X.mtime=new Date;if(typeof Y==="string")Y=Jl.from(Y);let Q=new te6(this,X,G);if(Jl.isBuffer(Y))return X.size=Y.byteLength,Q.write(Y),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(ne6),this.push(null)}_done(X){if(X!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(X){if(!X.pax){let Y=Ru1.encode(X);if(Y){this.push(Y);return}}this._encodePax(X)}_encodePax(X){let Y=Ru1.encodePax({name:X.name,linkname:X.linkname,pax:X.pax}),G={name:"PaxHeader",mode:X.mode,uid:X.uid,gid:X.gid,size:Y.byteLength,mtime:X.mtime,type:"pax-header",linkname:X.linkname&&"PaxHeader",uname:X.uname,gname:X.gname,devmajor:X.devmajor,devminor:X.devminor};this.push(Ru1.encode(G)),this.push(Y),ae6(this,Y.byteLength),G.size=X.size,G.type=X.type,this.push(Ru1.encode(G))}_doDrain(){let X=this._drain;this._drain=FR0,X()}_predestroy(){let X=pe6(this);if(this._stream)this._stream.destroy(X);while(this._pending.length){let Y=this._pending.shift();Y.destroy(X),Y._continueOpen()}this._doDrain()}_read(X){this._doDrain(),X()}}oe6.exports=function(Y){return new re6(Y)};function ld5(X){switch(X&ka.S_IFMT){case ka.S_IFBLK:return"block-device";case ka.S_IFCHR:return"character-device";case ka.S_IFDIR:return"directory";case ka.S_IFIFO:return"fifo";case ka.S_IFLNK:return"symlink"}return"file"}function FR0(){}function ae6(X,Y){if(Y&=511,Y)X.push(ne6.subarray(0,512-Y))}function md5(X){return Jl.isBuffer(X)?X:Jl.from(X)}});var ee6=k((dd5)=>{dd5.extract=de6();dd5.pack=se6()});var G18=k((PRG,Y18)=>{Y18.exports=X18;function X18(X,Y){if(X&&Y)return X18(X)(Y);if(typeof X!=="function")throw TypeError("need wrapper function");return Object.keys(X).forEach(function(Q){G[Q]=X[Q]}),G;function G(){var Q=Array(arguments.length);for(var J=0;J<Q.length;J++)Q[J]=arguments[J];var $=X.apply(this,Q),Z=Q[Q.length-1];if(typeof $==="function"&&$!==Z)Object.keys(Z).forEach(function(W){$[W]=Z[W]});return $}}});var BR0=k((qRG,UR0)=>{var Q18=G18();UR0.exports=Q18(Su1);UR0.exports.strict=Q18(J18);Su1.proto=Su1(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Su1(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return J18(this)},configurable:!0})});function Su1(X){var Y=function(){if(Y.called)return Y.value;return Y.called=!0,Y.value=X.apply(this,arguments)};return Y.called=!1,Y}function J18(X){var Y=function(){if(Y.called)throw Error(Y.onceError);return Y.called=!0,Y.value=X.apply(this,arguments)},G=X.name||"Function wrapped with `once`";return Y.onceError=G+" shouldn't be called more than once",Y.called=!1,Y}});var W18=k((ARG,$18)=>{var pd5=BR0(),nd5=function(){},td5=global.Bare?queueMicrotask:process.nextTick.bind(process),rd5=function(X){return X.setHeader&&typeof X.abort==="function"},ad5=function(X){return X.stdio&&Array.isArray(X.stdio)&&X.stdio.length===3},Z18=function(X,Y,G){if(typeof Y==="function")return Z18(X,null,Y);if(!Y)Y={};G=pd5(G||nd5);var{_writableState:Q,_readableState:J}=X,$=Y.readable||Y.readable!==!1&&X.readable,Z=Y.writable||Y.writable!==!1&&X.writable,W=!1,K=function(){if(!X.writable)H()},H=function(){if(Z=!1,!$)G.call(X)},U=function(){if($=!1,!Z)G.call(X)},B=function(E){G.call(X,E?Error("exited with error code: "+E):null)},N=function(E){G.call(X,E)},O=function(){td5(z)},z=function(){if(W)return;if($&&!(J&&(J.ended&&!J.destroyed)))return G.call(X,Error("premature close"));if(Z&&!(Q&&(Q.ended&&!Q.destroyed)))return G.call(X,Error("premature close"))},D=function(){X.req.on("finish",H)};if(rd5(X))if(X.on("complete",H),X.on("abort",O),X.req)D();else X.on("request",D);else if(Z&&!Q)X.on("end",K),X.on("close",K);if(ad5(X))X.on("exit",B);if(X.on("end",U),X.on("finish",H),Y.error!==!1)X.on("error",N);return X.on("close",O),function(){if(W=!0,X.removeListener("complete",H),X.removeListener("abort",O),X.removeListener("request",D),X.req)X.req.removeListener("finish",H);X.removeListener("end",K),X.removeListener("close",K),X.removeListener("finish",H),X.removeListener("exit",B),X.removeListener("end",U),X.removeListener("error",N),X.removeListener("close",O)}};$18.exports=Z18});var F18=k((TRG,H18)=>{var od5=BR0(),sd5=W18(),ku1;try{ku1=_1("fs")}catch(X){}var tQ1=function(){},ed5=typeof process>"u"?!1:/^v?\.0/.test(process.version),Cu1=function(X){return typeof X==="function"},Xc5=function(X){if(!ed5)return!1;if(!ku1)return!1;return(X instanceof(ku1.ReadStream||tQ1)||X instanceof(ku1.WriteStream||tQ1))&&Cu1(X.close)},Yc5=function(X){return X.setHeader&&Cu1(X.abort)},Gc5=function(X,Y,G,Q){Q=od5(Q);var J=!1;X.on("close",function(){J=!0}),sd5(X,{readable:Y,writable:G},function(Z){if(Z)return Q(Z);J=!0,Q()});var $=!1;return function(Z){if(J)return;if($)return;if($=!0,Xc5(X))return X.close(tQ1);if(Yc5(X))return X.abort();if(Cu1(X.destroy))return X.destroy();Q(Z||Error("stream was destroyed"))}},K18=function(X){X()},Qc5=function(X,Y){return X.pipe(Y)},Jc5=function(){var X=Array.prototype.slice.call(arguments),Y=Cu1(X[X.length-1]||tQ1)&&X.pop()||tQ1;if(Array.isArray(X[0]))X=X[0];if(X.length<2)throw Error("pump requires two streams per minimum");var G,Q=X.map(function(J,$){var Z=$<X.length-1,W=$>0;return Gc5(J,Z,W,function(K){if(!G)G=K;if(K)Q.forEach(K18);if(Z)return;Q.forEach(K18),Y(G)})});return X.reduce(Qc5)};H18.exports=Jc5});var E18=k((Kc5)=>{var U18=ee6(),B18=F18(),N18=_1("fs"),rY=_1("path"),rQ1=(global.Bare?global.Bare.platform:process.platform)==="win32";Kc5.pack=function(Y,G){if(!Y)Y=".";if(!G)G={};let Q=G.fs||N18,J=G.ignore||G.filter||aQ1,$=G.mapStream||w18,Z=Wc5(Q,G.dereference?Q.stat:Q.lstat,Y,J,G.entries,G.sort),W=G.strict!==!1,K=typeof G.umask==="number"?~G.umask:~O18(),H=G.pack||U18.pack(),U=G.finish||aQ1,B=G.map||aQ1,N=typeof G.dmode==="number"?G.dmode:0,O=typeof G.fmode==="number"?G.fmode:0;if(G.strip)B=L18(B,G.strip);if(G.readable)N|=parseInt(555,8),O|=parseInt(444,8);if(G.writable)N|=parseInt(333,8),O|=parseInt(222,8);E();function z(P,q){Q.readlink(rY.join(Y,P),function(V,M){if(V)return H.destroy(V);q.linkname=NR0(M),H.entry(q,E)})}function D(P,q,V){if(H.destroyed)return;if(P)return H.destroy(P);if(!q){if(G.finalize!==!1)H.finalize();return U(H)}if(V.isSocket())return E();let M={name:NR0(q),mode:(V.mode|(V.isDirectory()?N:O))&K,mtime:V.mtime,size:V.size,type:"file",uid:V.uid,gid:V.gid};if(V.isDirectory())return M.size=0,M.type="directory",M=B(M)||M,H.entry(M,E);if(V.isSymbolicLink())return M.size=0,M.type="symlink",M=B(M)||M,z(q,M);if(M=B(M)||M,!V.isFile()){if(W)return H.destroy(Error("unsupported type for "+q));return E()}let j=H.entry(M,E),R=$(Q.createReadStream(rY.join(Y,q),{start:0,end:M.size>0?M.size-1:M.size}),M);R.on("error",function(C){j.destroy(C)}),B18(R,j)}function E(P){if(P)return H.destroy(P);Z(D)}return H};function Zc5(X){return X.length?X[X.length-1]:null}function $c5(){return!global.Bare&&process.getuid?process.getuid():-1}function O18(){return!global.Bare&&process.umask?process.umask():0}Kc5.extract=function(Y,G){if(!Y)Y=".";if(!G)G={};Y=rY.resolve(Y);let Q=G.fs||N18,J=G.ignore||G.filter||aQ1,$=G.mapStream||w18,Z=G.chown!==!1&&!rQ1&&$c5()===0,W=G.extract||U18.extract(),K=[],H=new Date,U=typeof G.umask==="number"?~G.umask:~O18(),B=G.strict!==!1,N=G.validateSymlinks!==!1,O=G.map||aQ1,z=typeof G.dmode==="number"?G.dmode:0,D=typeof G.fmode==="number"?G.fmode:0;if(G.strip)O=L18(O,G.strip);if(G.readable)z|=parseInt(555,8),D|=parseInt(444,8);if(G.writable)z|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",E),G.finish)W.on("finish",G.finish);return W;function E(j,R,C){j=O(j)||j,j.name=NR0(j.name);let _=rY.join(Y,rY.join("/",j.name));if(J(_,j))return R.resume(),C();let v=rY.join(_,".")===rY.join(Y,".")?Y:rY.dirname(_);D18(Q,v,rY.join(Y,"."),function(m,e){if(m)return C(m);if(!e)return C(Error(v+" is not a valid path"));if(j.type==="directory")return K.push([_,j.mtime]),M(_,{fs:Q,own:Z,uid:j.uid,gid:j.gid,mode:j.mode},b);M(v,{fs:Q,own:Z,uid:j.uid,gid:j.gid,mode:493},function(s){if(s)return C(s);switch(j.type){case"file":return h();case"link":return i();case"symlink":return x()}if(B)return C(Error("unsupported type for "+_+" ("+j.type+")"));R.resume(),C()})});function b(m){if(m)return C(m);q(_,j,function(e){if(e)return C(e);if(rQ1)return C();V(_,j,C)})}function x(){if(rQ1)return C();Q.unlink(_,function(){let m=rY.resolve(rY.dirname(_),j.linkname);if(!n(m)&&N)return C(Error(_+" is not a valid symlink"));z18(Q,m,rY.join(Y,"."),function(e,s){if(e)return C(e);if(!s&&N)return C(Error(_+" is not a valid symlink"));Q.symlink(j.linkname,_,b)})})}function i(){if(rQ1)return C();Q.unlink(_,function(){let m=rY.join(Y,rY.join("/",j.linkname));Q.realpath(m,function(e,s){if(e||!n(s))return C(Error(_+" is not a valid hardlink"));Q.link(s,_,function(N1){if(N1&&N1.code==="EPERM"&&G.hardlinkAsFilesFallback)return R=Q.createReadStream(s),h();b(N1)})})})}function n(m){return m===Y||m.startsWith(Y+rY.sep)}function h(){let m=Q.createWriteStream(_),e=$(R,j);m.on("error",function(s){e.destroy(s)}),B18(e,m,function(s){if(s)return C(s);m.on("close",b)})}}function P(j,R){let C;while((C=Zc5(K))&&j.slice(0,C[0].length)!==C[0])K.pop();if(!C)return R();Q.utimes(C[0],H,C[1],R)}function q(j,R,C){if(G.utimes===!1)return C();if(R.type==="directory")return Q.utimes(j,H,R.mtime,C);if(R.type==="symlink")return P(j,C);Q.utimes(j,H,R.mtime,function(_){if(_)return C(_);P(j,C)})}function V(j,R,C){let _=R.type==="symlink",v=_?Q.lchmod:Q.chmod,b=_?Q.lchown:Q.chown;if(!v)return C();let x=(R.mode|(R.type==="directory"?z:D))&U;if(b&&Z)b.call(Q,j,R.uid,R.gid,i);else i(null);function i(n){if(n)return C(n);if(!v)return C();v.call(Q,j,x,C)}}function M(j,R,C){Q.stat(j,function(_){if(!_)return C(null);if(_.code!=="ENOENT")return C(_);Q.mkdir(j,{mode:R.mode,recursive:!0},function(v,b){if(v)return C(v);V(j,R,C)})})}};function z18(X,Y,G,Q){if(Y===G)return Q(null,!0);if(!Y.startsWith(G+rY.sep))return Q(null,!1);X.lstat(Y,function(J,$){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return Q(J);if(J||!$.isSymbolicLink())return z18(X,rY.join(Y,".."),G,Q);Q(null,!1)})}function D18(X,Y,G,Q){if(Y===G)return Q(null,!0);X.lstat(Y,function(J,$){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return Q(J);if(J||$.isDirectory())return D18(X,rY.join(Y,".."),G,Q);Q(null,!1)})}function aQ1(){}function w18(X){return X}function NR0(X){return rQ1?X.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):X}function Wc5(X,Y,G,Q,J,$){if(!J)J=["."];let Z=J.slice(0);return function(K){if(!Z.length)return K(null);let H=Z.shift(),U=rY.join(G,H);Y.call(X,U,function(B,N){if(B)return K(J.indexOf(H)===-1&&B.code==="ENOENT"?null:B);if(!N.isDirectory())return K(null,H,N);X.readdir(U,function(O,z){if(O)return K(O);if($)z.sort();for(let D=0;D<z.length;D++)if(!Q(rY.join(G,H,z[D])))Z.push(rY.join(H,z[D]));K(null,H,N)})})}}function L18(X,Y){return function(G){G.name=G.name.split("/").slice(Y).join("/");let Q=G.linkname;if(Q&&(G.type==="link"||rY.isAbsolute(Q)))G.linkname=Q.split("/").slice(Y).join("/");return X(G)}}});var Uc5,Bc5;var P18=w(()=>{oM0();Uc5=X1(We6(),1),Bc5=X1(E18(),1)});var vu1=()=>{};var q18=w(()=>{pg1()});var A18=w(()=>{Eu1();Lu1();vu1()});var T18=()=>{};var I18=()=>{};var OR0=w(()=>{ms6();rM0();Eu1();ns6();nM0();oM0();ts6();rs6();as6();os6();tM0();ss6();P18();vu1();q18();A18();T18();I18();vu1()});var eG,u7,Zl,oQ1;var sQ1=w(()=>{eG={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};u7=class u7 extends Error{cause;constructor(X,Y){super(X);if(this.name="SandboxError",this.cause=Y,Y instanceof Error&&Y.stack)this.stack=`${this.stack}
 Caused by: ${Y.stack}`}};Zl=class Zl extends u7{constructor(X,Y){super(X,Y);this.name="SandboxTimeoutError"}};oQ1=class oQ1 extends u7{constructor(X,Y){super(X,Y);this.name="SandboxAlreadyExistsError"}}});async function Nc5(X){let Y=X.getCurrentCluster();if(!Y)throw new u7("No active cluster in kubeconfig");let G={};await X.applyToHTTPSOptions(G);let Q={},J=G.headers??{};for(let[$,Z]of Object.entries(J))if(Array.isArray(Z))Q[$]=Z.join(", ");else if(Z!==void 0)Q[$]=String(Z);if(typeof G.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(G.auth).toString("base64")}`;return{server:Y.server.replace(/\/+$/,""),headers:Q,tls:{cert:zR0(G.cert),key:zR0(G.key),ca:zR0(G.ca),rejectUnauthorized:Y.skipTLSVerify?!1:void 0}}}function zR0(X){if(X==null)return;if(typeof X==="string")return X;if(Buffer.isBuffer(X))return X.toString("utf8");return String(X)}async function $l(X,Y){let G=await Nc5(X),Q={...G.headers,...Y.headers};if(Y.method==="PATCH")Q["content-type"]=Y.patchType==="apply"?"application/apply-patch+yaml":Y.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Y.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let J={method:Y.method,headers:Q,body:Y.body===void 0?void 0:JSON.stringify(Y.body),signal:Y.signal,tls:G.tls};return fetch(`${G.server}${Y.path}`,J)}async function wR0(X){try{return await X.json()}catch{return null}}async function LR0(X,Y){if(X.ok)return;let G=await wR0(X),Q=G?.message??`${Y} failed: ${X.status} ${X.statusText}`;throw new DR0(X.status,G,Q)}async function eQ1(X,Y,G,Q,J="none"){try{let $=await $l(X,Y);if($.status===404)return null;if(await LR0($,G),J==="json")return await $.json();return null}catch($){throw new u7(Q,$)}}async function XJ1(X,Y,G){let Q=`${j18}/${encodeURIComponent(Y)}/${eG.CLAIM_PLURAL}`,J;try{J=await $l(X,{method:"POST",path:Q,body:G})}catch(H){let U=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} transport error: ${U}`),new u7(`Failed to create SandboxClaim: ${G.metadata.name} (transport error: ${U})`,H)}if(J.ok)return;let $=await wR0(J),Z=$?.reason?` ${$.reason}`:"",W=$?.message??J.statusText,K=`Failed to create SandboxClaim: ${G.metadata.name} (${J.status}${Z}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} rejected: status=${J.status} reason=${$?.reason??"<none>"} message=${W}`),J.status===409)throw new oQ1(K);throw new u7(K)}async function _u1(X,Y,G,Q=60000){let J=Date.now()+Q,$=500,Z;while(!0){let W=await NA(X,Y,G).catch(()=>{return});if(!W)return;if(Z=W,Date.now()>=J){let K=Z.metadata?.finalizers??[],H=Z.metadata?.deletionTimestamp??"<unknown>";throw new Zl(`SandboxClaim ${G} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await new Promise((K)=>setTimeout(K,500))}}function ER0(X,Y){return`${j18}/${encodeURIComponent(X)}/${eG.CLAIM_PLURAL}/${encodeURIComponent(Y)}`}async function V18(X,Y,G,Q){await eQ1(X,{method:"PATCH",path:ER0(Y,G),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${G}`)}async function BA(X,Y,G){await eQ1(X,{method:"DELETE",path:ER0(Y,G)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${G}`)}async function NA(X,Y,G){return await eQ1(X,{method:"GET",path:ER0(Y,G)},"getSandboxClaim",`Failed to get SandboxClaim: ${G}`,"json")??void 0}async function M18(X,Y,G,Q=60){let J=Date.now()+Q*1000,$=200;while(Date.now()<J){let W=(await NA(X,Y,G).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await new Promise((K)=>setTimeout(K,200))}throw new Zl(`SandboxClaim ${G} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}function C18(X,Y){return`${k18}/${encodeURIComponent(X)}/${PR0}/${encodeURIComponent(Y)}`}function Oc5(X){return`${k18}/${encodeURIComponent(X)}/${PR0}`}async function fu1(X,Y,G){try{let Q=await $l(X,{method:"POST",path:Oc5(Y),body:G});if(Q.status===409)return;await LR0(Q,"createHttpRoute")}catch(Q){if(Q instanceof DR0&&Q.status===409)return;throw new u7(`Failed to create HTTPRoute: ${G.metadata.name}`,Q)}}async function bu1(X,Y,G){await eQ1(X,{method:"DELETE",path:C18(Y,G)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${G}`)}async function v18(X,Y,G){return await eQ1(X,{method:"GET",path:C18(Y,G)},"getHttpRoute",`Failed to get HTTPRoute: ${G}`,"json")??void 0}async function _18(X,Y,G,Q){let J={apiVersion:"v1",kind:"Service",metadata:{name:G},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},$=new URLSearchParams({fieldManager:zc5,force:"true"}),Z=`/api/v1/namespaces/${encodeURIComponent(Y)}/services/${encodeURIComponent(G)}?${$}`;try{let W=await $l(X,{method:"PATCH",path:Z,patchType:"apply",body:J});await LR0(W,"ensureServicePort")}catch(W){throw new u7(`Failed to apply Service ports: ${G}`,W)}}function yu1(X,Y,G,Q=180){let J=`/apis/${eG.SANDBOX_API_GROUP}/${eG.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Y)}/${eG.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`,{resolve:$,reject:Z,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,U=setTimeout(()=>{if(H)return;H=!0,K.abort(),Z(new Zl(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),B=(N)=>{if(H)return;H=!0,clearTimeout(U),K.abort(),N()};return(async()=>{let N;try{N=await $l(X,{method:"GET",path:J,signal:K.signal,headers:{accept:"application/json"}})}catch(O){B(()=>Z(new u7("Failed to start watch for sandbox readiness",O)));return}if(!N.ok||!N.body){let O=await wR0(N).catch(()=>null);B(()=>Z(new u7(`Watch handshake failed (${N.status}): ${O?.message??N.statusText}`)));return}try{for await(let O of qR0(N.body)){if(H)return;if(O.type==="ERROR"){let q=O.object;B(()=>Z(new u7(`Watch stream error while waiting for sandbox: ${q.message??"unknown"}`)));return}if(O.type!=="ADDED"&&O.type!=="MODIFIED")continue;let z=O.object;if(!z.status?.conditions?.find((q)=>q.type==="Ready"&&q.status==="True"))continue;let E=z.metadata?.name;if(!E){B(()=>Z(new u7("Sandbox metadata or name is missing")));return}let P=z.metadata?.annotations?.[eG.POD_NAME_ANNOTATION]??E;B(()=>$({sandboxName:E,podName:P}));return}B(()=>Z(new u7("Watch stream closed before sandbox became ready")))}catch(O){if(H)return;if(O instanceof Error&&(O.name==="AbortError"||K.signal.aborted))return;B(()=>Z(new u7("Watch stream error while waiting for sandbox",O)))}})(),W}async function*qR0(X){let Y=X.getReader(),G=new TextDecoder,Q="";try{while(!0){let{value:$,done:Z}=await Y.read();if(Z)break;Q+=G.decode($,{stream:!0});let W;while((W=Q.indexOf(`
 `))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let J=Q.trim();if(J)yield JSON.parse(J)}finally{Y.releaseLock()}}var DR0,j18,R18="gateway.networking.k8s.io",S18="v1",PR0="httproutes",k18,YJ1,zc5="mesh-sandbox-runner";var hu1=w(()=>{sQ1();DR0=class DR0 extends Error{status;body;constructor(X,Y,G){super(G);this.status=X;this.body=Y;this.name="KubeHttpError"}};j18=`/apis/${eG.CLAIM_API_GROUP}/${eG.CLAIM_API_VERSION}/namespaces`;k18=`/apis/${R18}/${S18}/namespaces`;YJ1={API_GROUP:R18,API_VERSION:S18,PLURAL:PR0}});async function*y18(X){let Y=X.now??(()=>Date.now()),G=Y(),Q=X.schedulingTimeoutMs??Lc5,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:G},$=[],Z=null,W=!1,K=(q)=>{if(W)return;if(Z){let V=Z;Z=null,V(q)}else $.push(q)},H=()=>{if($.length>0)return Promise.resolve($.shift());if(W)return Promise.resolve(null);return new Promise((q)=>{Z=q})},U=()=>{if(W)return;if(W=!0,Z){let q=Z;Z=null,q(null)}},B=new AbortController,N=()=>{B.abort(),U()};if(X.signal)if(X.signal.aborted)B.abort(),U();else X.signal.addEventListener("abort",N,{once:!0});let O=Math.max(0,Q-(Y()-G)),z=setTimeout(()=>K("tick"),O+100),D,E=new Promise((q)=>{D=q}),P=Promise.allSettled([Ec5(X.kc,X.namespace,X.claimName,B.signal,J,K,Y,D),qc5(X.kc,X.namespace,X.claimName,B.signal,J,K),Ac5(X.kc,X.namespace,X.claimName,E,B.signal,J,K,Y)]);try{let q=null,V=-1,M=f18(J,Q,Y);if(q=TR0(M),!AR0(M))V=b18(M);if(yield M,AR0(M))return;while(!W){if(await H()===null)break;let R=f18(J,Q,Y);if(AR0(R)){let v=TR0(R);if(v!==q)q=v,yield R;return}let C=b18(R);if(C<V)continue;let _=TR0(R);if(_!==q)q=_,V=C,yield R}}finally{if(clearTimeout(z),B.abort(),X.signal)X.signal.removeEventListener("abort",N);U(),await P.catch(()=>{})}}function f18(X,Y,G){let{pod:Q,sandbox:J,events:$,startedAt:Z}=X;if(J.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&$.lastFailedSchedulingAt!==void 0&&G()-Z>Y)return{kind:"failed",reason:"scheduling-timeout",message:$.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Y/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:Z};if($.hasPulling&&!$.hasPulled)return{kind:"pulling-image",since:Z};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:Z};if(Q.scheduledFalseReason==="Unschedulable"||$.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:Z,message:$.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:$.nominatedNodeClaim};return{kind:"claiming",since:Z}}function AR0(X){return X.kind==="ready"||X.kind==="failed"}function b18(X){switch(X.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function TR0(X){switch(X.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return X.kind;case"waiting-for-capacity":return`waiting-for-capacity:${X.message??""}:${X.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${X.reason}:${X.message}`}}async function Ec5(X,Y,G,Q,J,$,Z,W){let K=`/api/v1/namespaces/${encodeURIComponent(Y)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Dc5}=${G}`)}`;return IR0({kc:X,path:K,signal:Q,label:`pod/${G}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let U=H.object;if(U.metadata?.name)W(U.metadata.name);Pc5(U,J,Z),$("pod")}})}function Pc5(X,Y,G){let J=(X.status?.conditions??[]).find((Z)=>Z.type==="PodScheduled");if(J?.status==="True")Y.pod.scheduled=!0,Y.pod.scheduledFalseReason=void 0,Y.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")Y.pod.scheduled=!1,Y.pod.scheduledFalseReason=J.reason,Y.pod.scheduledFalseMessage=J.message;let $=(X.status?.containerStatuses??[]).find((Z)=>Z.name===wc5);if($)Y.pod.containerWaitingReason=$.state?.waiting?.reason,Y.pod.containerRunning=!!$.state?.running,Y.pod.containerReady=$.ready===!0}async function qc5(X,Y,G,Q,J,$){let Z=`/apis/${eG.CLAIM_API_GROUP}/${eG.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Y)}/${eG.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`;return IR0({kc:X,path:Z,signal:Q,label:`sandboxclaim/${G}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((U)=>U.type==="Ready");if(!H)return;if(H.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=H.reason,J.sandbox.notReadyMessage=H.message;$("sandbox")}})}async function Ac5(X,Y,G,Q,J,$,Z,W){let K=await Promise.race([Q,new Promise((U)=>{if(J.aborted){U(G);return}J.addEventListener("abort",()=>U(G),{once:!0})})]);if(J.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Y)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return IR0({kc:X,path:H,signal:J,label:`events/${G}`,onEvent:(U)=>{if(U.type!=="ADDED"&&U.type!=="MODIFIED")return;let B=U.object,N=B.reason;if(!N)return;switch(N){case"Pulling":$.events.hasPulling=!0;break;case"Pulled":$.events.hasPulling=!0,$.events.hasPulled=!0;break;case"FailedScheduling":$.events.lastFailedSchedulingAt=W(),$.events.failedSchedulingMessage=B.message;break;case"Nominated":{let O=B.message?.match(/nodeclaim\/([\w-]+)/);if(O)$.events.nominatedNodeClaim=O[1];break}default:return}Z("event")}})}async function IR0(X){let{kc:Y,path:G,signal:Q,label:J,onEvent:$}=X,Z=0;while(!Q.aborted){try{let K=await $l(Y,{method:"GET",path:G,signal:Q,headers:{accept:"application/json"}});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}Z=0;for await(let H of qR0(K.body)){if(Q.aborted)return;try{$(H)}catch(U){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${U instanceof Error?U.message:String(U)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${J} watch ended: ${H}`)}if(Q.aborted)return;let W=Math.min(250*2**Z,5000);Z+=1,await Tc5(W,Q)}}function Tc5(X,Y){return new Promise((G)=>{if(Y.aborted){G();return}let Q=setTimeout(()=>{Y.removeEventListener("abort",J),G()},X),J=()=>{clearTimeout(Q),G()};Y.addEventListener("abort",J,{once:!0})})}var Dc5="studio.decocms.com/sandbox-handle",wc5="sandbox",Lc5=300000;var h18=w(()=>{sQ1();hu1()});import{createHash as Ic5,randomBytes as jc5,randomUUID as Vc5}from"crypto";import*as l18 from"net";import{PassThrough as Mc5}from"stream";class kR0{kind=TH;records=new Map;inflight=new aq;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor(X={}){this.stateStore=X.stateStore??null,this.previewUrlPattern=X.previewUrlPattern??null,this.kubeConfig=X.kubeConfig??hc5(),this.portForward=new sM0(this.kubeConfig),this.namespace=X.namespace??Rc5,this.sandboxTemplateName=X.sandboxTemplateName??Sc5,this.envName=dc5(X.envName),this.tokenGenerator=X.tokenGenerator??(()=>jc5(Cc5).toString("hex")),this.idleTtlMs=X.idleTtlMs??_c5,this.metrics=X.meter?yc5(X.meter):null,this.previewGateway=X.previewGateway&&X.previewUrlPattern?{...X.previewGateway}:null;let Y=X.sentinelToken?.trim()??"";this.sentinelToken=Y.length>0?Y:null}async ensure(X,Y={}){let G=this.computeHandle(X,Y.repo?.branch??null);return this.inflight.run(G,()=>VM(this.stateStore,X,TH,(Q)=>this.ensureLocked(X,G,Y,Q)))}async exec(X,Y){let G=await this.requireRecord(X);return Za(G.daemonUrl,G.token,Y)}async delete(X){let Y=await this.getRecord(X);if(this.records.delete(X),Y)this.closeForwarder(Y.daemonForward),this.metrics?.active.add(-1,RR0(Y.tenant));if(await this.deleteHttpRouteIfManaged(X).catch((G)=>{console.warn(`[${qW}] HTTPRoute delete failed for ${X}: ${G instanceof Error?G.message:String(G)}`)}),await BA(this.kubeConfig,this.namespace,X),this.stateStore)if(Y)await this.stateStore.delete(Y.id,TH);else await this.stateStore.deleteByHandle(TH,X)}async alive(X){return await NA(this.kubeConfig,this.namespace,X)!==void 0}watchClaimLifecycle(X,Y){return y18({kc:this.kubeConfig,namespace:this.namespace,claimName:X,signal:Y})}async getPreviewUrl(X){let Y=await this.getRecord(X);if(!Y)return null;return this.composePreviewUrl(Y)}async proxyDaemonRequest(X,Y,G){let Q=await this.getRecord(X);if(!Q&&this.previewUrlPattern&&this.stateStore){let Z=await this.stateStore.getByHandle(TH,X),W=Z?.state,K=W?.token;if(Z&&K){let U=`http://${W?.adoptedSandboxName??X}.${this.namespace}.svc.cluster.local:${OA}`;return jM(U,K,Y,G)}}if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=performance.now(),$=0;try{let Z=await jM(Q.daemonUrl,Q.token,Y,G);return $=Z.status,Z}finally{this.recordProxyDuration("daemon",$,Q,performance.now()-J)}}async resolvePreviewUpstreamUrl(X){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(X)}.${this.namespace}.svc.cluster.local:${OA}`;let Y=await this.getRecord(X);if(Y)return Y.daemonUrl;let G=await this.resurrectByHandle(X);return G?G.daemonUrl:null}async resolveServiceNameForHandle(X){let Y=this.records.get(X);if(Y)return Y.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(TH,X).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return X}async proxyPreviewRequest(X,Y){let G=performance.now(),Q=this.records.get(X)??null,J=0;try{let $=await this.resolvePreviewUpstreamUrl(X);if(!$)return J=404,VR0(404,{error:"sandbox not found"});let Z=new URL(Y.url);if((Z.pathname==="/_decopilot_vm"||Z.pathname.startsWith("/_decopilot_vm/"))&&Y.method!=="GET")return J=404,VR0(404,{error:"not found"});let K=(z)=>`${z}${Z.pathname}${Z.search}`,H=new Headers(Y.headers);for(let z of fc5)H.delete(z);let U=Y.method!=="GET"&&Y.method!=="HEAD",B={method:Y.method,headers:H,body:U?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:U?"half":void 0},N;try{N=await fetch(K($),B)}catch(z){let D=`${$}${Z.pathname}`;if(console.warn(`[${qW}] preview fetch to ${D} failed: ${z instanceof Error?z.message:String(z)}`),Y.method==="GET"||Y.method==="HEAD"){if(this.invalidateRecord(X),await this.resurrectByHandle(X).catch(()=>null)){let P=await this.resolvePreviewUpstreamUrl(X);if(P)try{N=await fetch(K(P),B);let q=new Headers;for(let[V,M]of N.headers.entries())if(!x18.includes(V.toLowerCase()))q.set(V,M);return J=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:q})}catch(q){console.warn(`[${qW}] preview fetch retry to ${D} failed: ${q instanceof Error?q.message:String(q)}`)}}}else this.invalidateRecord(X);return J=502,VR0(502,{error:"sandbox daemon unreachable"})}let O=new Headers;for(let[z,D]of N.headers.entries())if(!x18.includes(z.toLowerCase()))O.set(z,D);return J=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:O})}finally{this.recordProxyDuration("preview",J,Q,performance.now()-G,X)}}async ensureLocked(X,Y,G,Q){if(G.image)console.warn(`[${qW}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${G.image}`);if(Q){let Z=await Q.get(X,TH);if(Z){let W=await this.rehydrate(X,Y,Z);if(W)return this.finish(W,Q,!1,!0,"resume");await Q.delete(X,TH)}}let J=await NA(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await _u1(this.kubeConfig,this.namespace,Y).catch((Z)=>{console.warn(`[${qW}] wait for terminating claim ${Y} failed: ${Z instanceof Error?Z.message:String(Z)}`)});else{let Z=await this.adopt(X,Y,J).catch((W)=>{return console.warn(`[${qW}] adopt ${Y} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(Z)return this.finish(Z,Q,!0,!0,"adopt");await BA(this.kubeConfig,this.namespace,Y).catch(()=>{}),await _u1(this.kubeConfig,this.namespace,Y).catch((W)=>{console.warn(`[${qW}] wait for deleted claim ${Y} failed: ${W instanceof Error?W.message:String(W)}`)})}let $=await this.provision(X,Y,G);return this.finish($,Q,!0,!1,"fresh")}async finish(X,Y,G,Q,J){let $=this.records.has(X.handle);if(this.records.set(X.handle,X),G)await this.persist(Y,X);if(Q)await V18(this.kubeConfig,this.namespace,X.handle,this.computeShutdownTime()).catch((Z)=>console.warn(`[${qW}] TTL refresh failed for ${X.handle}: ${Z instanceof Error?Z.message:String(Z)}`));if(this.metrics){let Z=RR0(X.tenant);if(this.metrics.ensureOutcome.add(1,{...Z,outcome:J}),!$)this.metrics.active.add(1,Z)}return this.toSandbox(X)}buildEnvMap(X,Y){let G={},Q=[];for(let[J,$]of Object.entries(X.env??{}))if(vc5.has(J))Q.push(J);else G[J]=$;if(Q.length>0)console.warn(`[${qW}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...G,DAEMON_TOKEN:Y.token,DAEMON_BOOT_ID:Y.daemonBootId,APP_ROOT:Y.workdir,PROXY_PORT:String(OA)}}buildClaim(X,Y,G){let Q=this.sentinelToken!==null,J=Q?[]:Object.entries(this.buildEnvMap(Y,G)).sort(([$],[Z])=>$<Z?-1:$>Z?1:0).map(([$,Z])=>({name:$,value:Z}));return{apiVersion:`${eG.CLAIM_API_GROUP}/${eG.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:X,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[MU.env]:this.envName}:{},...MR0(Y.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:MR0(Y.tenant,{[MU.role]:"claimed",[MU.sandboxHandle]:X,...this.envName?{[MU.env]:this.envName}:{}})},env:J,warmpool:Q?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(X,Y,G){let Q=this.tokenGenerator(),J=Vc5(),$=jR0,Z=this.buildClaim(Y,G,{token:Q,daemonBootId:J,workdir:$});try{await XJ1(this.kubeConfig,this.namespace,Z)}catch(N){if(N instanceof oQ1)await _u1(this.kubeConfig,this.namespace,Y),await XJ1(this.kubeConfig,this.namespace,Z);else throw N}let W;try{W=await M18(this.kubeConfig,this.namespace,Y),await yu1(this.kubeConfig,this.namespace,W)}catch(N){throw await BA(this.kubeConfig,this.namespace,Y).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Y,W,G.tenant??null)}catch(N){throw await BA(this.kubeConfig,this.namespace,Y).catch(()=>{}),N}let K=await this.openForwarder(W,OA,Y),H=`http://127.0.0.1:${K.localPort}`,U=MM({runtime:G.workload?.runtime??"node",packageManager:G.workload?.packageManager?{name:G.workload.packageManager,...G.workload.packageManagerPath?{path:G.workload.packageManagerPath}:{}}:null,repo:G.repo??null,port:G.workload?.devPort??kc5}),B=J;try{if(await oV1(H),this.sentinelToken!==null){let N=await Nw(H);if(N)B=N.bootId;await IM(H,this.sentinelToken,U??{},{rotateToken:Q})}else if(U)await IM(H,Q,U)}catch(N){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Y).catch(()=>{}),await BA(this.kubeConfig,this.namespace,Y).catch(()=>{}),N}return{id:X,handle:Y,adoptedSandboxName:W,token:Q,workdir:$,daemonUrl:H,daemonForward:K,workload:G.workload??null,daemonBootId:B,tenant:G.tenant??null,ensureOpts:ic5(G)}}async ensureServicePortForAdoptedSandbox(X){if(!this.previewGateway||!this.previewUrlPattern)return;await _18(this.kubeConfig,this.namespace,X,{name:"daemon",port:OA,targetPort:OA})}async ensureHttpRouteForHandle(X,Y,G){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=pc5(this.previewUrlPattern,X);if(!Q)throw new u7(`Unable to derive preview hostname for ${X} from pattern: ${this.previewUrlPattern}`);let J={apiVersion:`${YJ1.API_GROUP}/${YJ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:X,namespace:this.namespace,labels:MR0(G??void 0,{[MU.role]:"claimed",[MU.sandboxHandle]:X,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[MU.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Y,port:OA}]}]}};await fu1(this.kubeConfig,this.namespace,J)}async deleteHttpRouteIfManaged(X){if(!this.previewGateway)return;await bu1(this.kubeConfig,this.namespace,X)}async rehydrate(X,Y,G){let Q=G.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let J=await NA(this.kubeConfig,this.namespace,Y).catch(()=>{return});if(!J||!g18(J))return null;let $=J.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Y,Z=await this.openAndProbeDaemon($,Y);if(!Z)return null;if(Q.daemonBootId&&Q.daemonBootId!==Z.bootId)console.warn(`[${qW}] daemon restart detected (handle=${Y}): stored bootId=${Q.daemonBootId} live bootId=${Z.bootId}`);return{id:X,handle:Y,adoptedSandboxName:$,token:Q.token,workdir:Q.workdir??jR0,daemonUrl:Z.daemonUrl,daemonForward:Z.daemonForward,workload:Q.workload??null,daemonBootId:Z.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt(X,Y,G){if(!g18(G))return null;let Q=G.status?.sandbox?.name??Y;if(this.sentinelToken!==null)return null;let J=xc5(G);if(!J)return null;let $=await this.openAndProbeDaemon(Q,Y);if(!$)return null;let Z=cc5(G);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${qW}] Service port backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Y,Q,Z).catch((W)=>{console.warn(`[${qW}] HTTPRoute backfill failed for ${Y}: ${W instanceof Error?W.message:String(W)}`)});return{id:X,handle:Y,adoptedSandboxName:Q,token:J,workdir:jR0,daemonUrl:$.daemonUrl,daemonForward:$.daemonForward,workload:null,daemonBootId:$.bootId,tenant:Z,ensureOpts:null}}async openAndProbeDaemon(X,Y){let G=await this.openForwarder(X,OA,Y).catch(()=>null);if(!G)return null;let Q=`http://127.0.0.1:${G.localPort}`,J=await Nw(Q);if(!J)return this.closeForwarder(G),null;return{daemonForward:G,daemonUrl:Q,bootId:J.bootId}}async getRecord(X){let Y=this.records.get(X);if(Y)return Y;if(!this.stateStore)return null;let G=await this.stateStore.getByHandle(TH,X);if(!G)return null;let Q=await this.rehydrate(G.id,X,G);if(Q)this.records.set(X,Q);return Q}async resurrectByHandle(X){if(!this.stateStore)return null;let Y=await this.stateStore.getByHandle(TH,X);if(!Y)return null;let G=Y.state.ensureOpts;if(!G)return null;return await this.ensure(Y.id,G),this.records.get(X)??null}async requireRecord(X){let Y=await this.getRecord(X);if(Y)return Y;let G=await this.resurrectByHandle(X);if(G)return G;throw Error(`unknown sandbox handle ${X}`)}invalidateRecord(X){let Y=this.records.get(X);if(!Y)return;this.records.delete(X),this.closeForwarder(Y.daemonForward)}recordProxyDuration(X,Y,G,Q,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...RR0(G?.tenant??null),source:X,sandbox_handle:G?.handle??J??"",status_code:Y||0})}computeHandle(X,Y){return b3(X,Y,{hashLen:16})}composePreviewUrl(X){if(this.previewUrlPattern)return oN(this.previewUrlPattern,X.handle);return`http://127.0.0.1:${X.daemonForward.localPort}/`}toSandbox(X){return{handle:X.handle,workdir:X.workdir,previewUrl:this.composePreviewUrl(X)}}async persist(X,Y){if(!X)return;let G={adoptedSandboxName:Y.adoptedSandboxName,token:Y.token,workdir:Y.workdir,workload:Y.workload,daemonBootId:Y.daemonBootId,tenant:Y.tenant,...Y.ensureOpts?{ensureOpts:Y.ensureOpts}:{}};await X.put(Y.id,TH,{handle:Y.handle,state:G})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(X,Y,G=X){let Q=gc5(G,Y);return new Promise((J,$)=>{let Z=(W,K)=>{let H=l18.createServer((U)=>this.handleForwardedConnection(U,X,Y,G));H.once("error",(U)=>{if(U.code==="EADDRINUSE"&&K<bc5){try{H.close()}catch{}let B=SR0+(W-SR0+1)%m18;Z(B,K+1);return}$(U)}),H.listen(W,"127.0.0.1",()=>{let U=H.address();if(!U||typeof U==="string"){H.close(),$(Error("port-forward listener failed to bind"));return}J({server:H,localPort:U.port})})};Z(Q,0)})}handleForwardedConnection(X,Y,G,Q){let J=new Mc5,$=null,Z=!1,W=()=>{if(Z)return;if(Z=!0,J.destroy(),$)try{$.close()}catch{}if(!X.destroyed)X.destroy()};X.pipe(J),X.on("error",W),X.on("close",W),this.portForward.portForward(this.namespace,Y,[G],X,null,J).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if($=H,$.on("close",W),$.on("error",()=>{this.invalidateRecord(Q),W()}),Z)try{$.close()}catch{}}).catch((K)=>{console.warn(`[${qW}] port-forward to ${Y}:${G} failed: ${K instanceof Error?K.message:String(K)}`),this.invalidateRecord(Q),W()})}closeForwarder(X){X.server.close((Y)=>{if(Y)console.warn(`[${qW}] port-forward close on :${X.localPort} errored: ${Y instanceof Error?Y.message:String(Y)}`)})}close(){if(this.closed)return;this.closed=!0;for(let X of this.records.values())this.closeForwarder(X.daemonForward);this.records.clear()}}function yc5(X){return{active:X.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:X.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:X.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function hc5(){let X=new Va;return X.loadFromDefault(),X}function g18(X){return Boolean(X.status?.conditions?.some((Y)=>Y.type==="Ready"&&Y.status==="True"))}function xc5(X){let Y=X.spec?.env;if(!Y)return null;for(let G of Y)if(G.name==="DAEMON_TOKEN"&&G.value)return G.value;return null}function gc5(X,Y){let G=Ic5("sha256").update(`${X}:${Y}`).digest();return SR0+G.readUInt32BE(0)%m18}function VR0(X,Y){return new Response(JSON.stringify(Y),{status:X,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function u18(X){let Y=X.slice(0,lc5);return uc5.test(Y)?Y:""}function dc5(X){if(X===void 0)return null;let Y=X.trim();if(Y==="")return null;if(!mc5.test(Y))throw Error(`AgentSandboxRunner: envName=${JSON.stringify(Y)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return Y}function MR0(X,Y={}){let G={...Y};if(X){let Q=u18(X.orgId),J=u18(X.userId);if(Q)G[MU.orgId]=Q;if(J)G[MU.userId]=J}return G}function cc5(X){let Y=X.metadata?.labels;if(!Y)return null;let G=Y[MU.orgId],Q=Y[MU.userId];if(!G||!Q)return null;return{orgId:G,userId:Q}}function RR0(X){return{org_id:X?.orgId??"",user_id:X?.userId??"",runner_kind:TH}}function ic5(X){let Y={};if(X.repo)Y.repo=X.repo;if(X.workload)Y.workload=X.workload;if(X.env&&Object.keys(X.env).length>0)Y.env=X.env;if(X.tenant)Y.tenant=X.tenant;return Object.keys(Y).length>0?Y:null}function pc5(X,Y){try{return new URL(oN(X,Y)).hostname||null}catch{return null}}var TH="agent-sandbox",qW="AgentSandboxRunner",Rc5="agent-sandbox-system",Sc5="studio-sandbox",OA=9000,kc5=3000,jR0="/app",Cc5=32,vc5,_c5=900000,fc5,x18,SR0=40000,m18=1e4,bc5=256,MU,uc5,lc5=63,mc5;var d18=w(()=>{OR0();sV1();Ka();hu1();sQ1();h18();vc5=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),fc5=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],x18=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];MU={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},uc5=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;mc5=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var c18={};y6(c18,{waitForSandboxReady:()=>yu1,getSandboxClaim:()=>NA,getHttpRoute:()=>v18,deleteSandboxClaim:()=>BA,deleteHttpRoute:()=>bu1,createSandboxClaim:()=>XJ1,createHttpRoute:()=>fu1,SandboxTimeoutError:()=>Zl,SandboxError:()=>u7,KubeConfig:()=>Va,K8S_CONSTANTS:()=>eG,HTTPROUTE_CONSTANTS:()=>YJ1,AgentSandboxRunner:()=>kR0});var i18=w(()=>{OR0();sQ1();hu1();d18()});var yR0={};y6(yR0,{subscribeLifecycle:()=>bR0,getSharedRunnerIfInit:()=>_R0,getSharedRunner:()=>Wl,getRunnerByKind:()=>Ca,getOrInitSharedRunner:()=>GJ1,asDockerRunner:()=>fR0,__resetSharedLifecyclesForTesting:()=>Ji5});function t18(X,Y){let G=vR0[X];if(G)return Promise.resolve(G);let Q=CR0[X];if(Q)return Q;let J=Y().then(($)=>{return vR0[X]=$,$}).finally(()=>{delete CR0[X]});return CR0[X]=J,J}function rc5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return X&&X.trim()!==""?X:void 0}function ac5(){let X=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return X&&X.trim()!==""?X:void 0}function oc5(){let X=process.env.STUDIO_ENV;return X&&X.trim()!==""?X:void 0}function sc5(){let X=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return X&&X.trim()!==""?X:void 0}function ec5(){let X=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Y=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!X&&!Y)return;if(!X||!Y)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:X,namespace:Y}}async function r18(X,Y){let G=new jQ1(Y),Q=rc5();switch(X){case"host":{let{HostSandboxRunner:J}=await Promise.resolve().then(() => (LH(),SM)),{getSettings:$}=await Promise.resolve().then(() => (e5(),Vk0));return new J({homeDir:$().dataDir,stateStore:G,previewUrlPattern:Q})}case"docker":return new AU({stateStore:G,previewUrlPattern:Q});case"freestyle":{let{FreestyleSandboxRunner:J}=await Promise.resolve().then(() => (Xt6(),en6));return new J({stateStore:G})}case"agent-sandbox":{let{AgentSandboxRunner:J}=await Promise.resolve().then(() => (i18(),c18));return new J({stateStore:G,previewUrlPattern:Q,sandboxTemplateName:ac5(),envName:oc5(),previewGateway:ec5(),sentinelToken:sc5(),meter:cH})}default:throw Error(`Unknown runner kind: ${String(X)}`)}}function Wl(X){return Ca(X,wH())}function Ca(X,Y){return t18(Y,()=>r18(Y,X.db))}async function GJ1(){let X;try{X=wH()}catch(Y){return console.warn("[lifecycle] cannot resolve sandbox runner:",Y instanceof Error?Y.message:String(Y)),null}return t18(X,()=>r18(X,dY().db))}function _R0(){let X;try{X=wH()}catch{return null}return vR0[X]??null}function fR0(X){return X instanceof AU?X:null}function bR0(X,Y,G){let Q=zA.get(Y);if(Q){if(Q.terminated){if(Q.lastPhase)try{G(Q.lastPhase)}catch{}return{unsubscribe:Gi5}}if(Q.listeners.add(G),Q.lastPhase)try{G(Q.lastPhase)}catch{}return p18(Y,Q,G)}let J=new AbortController,$={lastPhase:null,terminated:!1,listeners:new Set([G]),abort:J};return zA.set(Y,$),Qi5(X,Y,$),p18(Y,$,G)}function Gi5(){}function p18(X,Y,G){return{unsubscribe(){if(zA.get(X)!==Y)return;if(Y.listeners.delete(G),Y.listeners.size===0)zA.delete(X),Y.abort.abort()}}}async function Qi5(X,Y,G){let Q=null;try{for await(let J of X.watchClaimLifecycle(Y,G.abort.signal)){if(G.abort.signal.aborted)break;G.lastPhase=J;let $=J.kind==="ready"||J.kind==="failed";if($)G.terminated=!0;let Z=Array.from(G.listeners);for(let W of Z)try{W(J)}catch{}if($)break}}catch(J){Q=J}finally{if(!G.terminated&&!G.abort.signal.aborted&&G.listeners.size>0){let J={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};G.lastPhase=J,G.terminated=!0;for(let $ of Array.from(G.listeners))try{$(J)}catch{}}if(zA.get(Y)===G)zA.delete(Y)}}function Ji5(){for(let X of zA.values())X.abort.abort();zA.clear()}var nc5,tc5,n18,vR0,CR0,Xi5,Yi5,zA;var QO=w(()=>{LH();MP();TW();mV0();nc5=Symbol.for("decocms.sandbox.lifecycle.runners"),tc5=Symbol.for("decocms.sandbox.lifecycle.inflight"),n18=globalThis,vR0=n18[nc5]??={},CR0=n18[tc5]??={};Xi5=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Yi5=globalThis,zA=Yi5[Xi5]??=new Map});async function a18(X,Y){B0(Y);let G=s1(Y),Q=$6(Y);if(!Q)throw Error("User ID required");let J=await Y.storage.virtualMcps.findById(X.virtualMcpId);if(!J||J.organization_id!==G.id)throw Error("Virtual MCP not found");let $=J.metadata??{},Z=Ha(sq($),Q,X.branch),W=wH();if(Z&&(Z.runnerKind??"freestyle")===W)return Z;await o18(Y,Z,W);let K=$.githubRepo??null,{entry:H}=await s18({ctx:Y,userId:Q,orgId:G.id,virtualMcpId:X.virtualMcpId,branch:X.branch,metadata:$,githubRepo:K,existing:Z});return H}async function o18(X,Y,G){if(!Y)return;let Q=Y.runnerKind??"freestyle";if(Q===G)return;if(Q==="freestyle")return;try{await(await Ca(X,Q)).delete(Y.vmId)}catch(J){console.error(`[VM_START] stale ${Q} ${Y.vmId}: ${J instanceof Error?J.message:String(J)}`)}}async function s18(X){let{ctx:Y,userId:G,orgId:Q,virtualMcpId:J,branch:$,metadata:Z,githubRepo:W,existing:K}=X;if(W&&!W.connectionId)throw Error("GitHub connection id missing on virtual MCP metadata");let{runtime:H,packageManager:U,port:B,packageManagerPath:N}=Jb6(Z),O;if(W){let{cloneUrl:R,gitUserName:C,gitUserEmail:_}=await Zb6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(!U){let v=await Hb6(W.connectionId,W.owner,W.name,Y.db,Y.vault);if(v)U=v.packageManager,H=IQ1[v.packageManager].runtime,B=v.devPort??B,await Zi5(Y,J,G,v.packageManager,v.devPort)}O={cloneUrl:R,userName:C,userEmail:_,branch:$,displayName:`${W.owner}/${W.name}`}}let z=H&&U?{runtime:H,packageManager:U,...B!==null?{devPort:Number(B)}:{},...N?{packageManagerPath:N}:{}}:void 0,D=oq({orgId:Q,virtualMcpId:J,branch:$}),E=await Wl(Y),P=await E.ensure({userId:G,projectRef:D},{repo:O,workload:z,tenant:{orgId:Q,userId:G}}),V=!!K&&K.vmId===P.handle&&K?.createdAt?K.createdAt:Date.now(),M={vmId:P.handle,previewUrl:P.previewUrl,runnerKind:E.kind,createdAt:V};await Gb6(Y.storage.virtualMcps,J,G,G,$,M);let j=!K||K.vmId!==P.handle;return{entry:M,isNewVm:j}}async function Zi5(X,Y,G,Q,J){let $=await X.storage.virtualMcps.findById(Y);if(!$)return;let Z=$.metadata??{};await X.storage.virtualMcps.update(Y,G,{metadata:{...Z,runtime:{selected:Q,port:J}}})}var hR0;var xR0=w(()=>{F0();LH();y0();lV0();$b6();Fb6();fT0();uV0();QO();hR0=l1({name:"VM_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID"),branch:F.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it.")}),outputSchema:F.object({previewUrl:F.string().nullable(),vmId:F.string(),branch:F.string(),isNewVm:F.boolean(),runnerKind:F.enum(["host","docker","freestyle","agent-sandbox"])}),handler:async(X,Y)=>{let G=X.branch??QV1(),{metadata:Q,userId:J,organization:$,entry:Z}=await $21({virtualMcpId:X.virtualMcpId,branch:G},Y),W=Q.githubRepo??null,K=wH();await o18(Y,Z,K);let{entry:H,isNewVm:U}=await s18({ctx:Y,userId:J,orgId:$.id,virtualMcpId:X.virtualMcpId,branch:G,metadata:Q,githubRepo:W,existing:Z});return{...H,branch:G,isNewVm:U,runnerKind:K}}})});var gR0;var e18=w(()=>{F0();y0();lV0();QO();gR0=l1({name:"VM_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({virtualMcpId:F.string().describe("Virtual MCP ID that owns this VM"),branch:F.string().min(1).describe("Branch whose vm should be deleted (vmMap[userId][branch])")}),outputSchema:F.object({success:F.boolean()}),handler:async(X,Y)=>{let G;try{G=await $21(X,Y)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Q,userId:J}=G;if(!Q)return{success:!0};await Qb6(Y.storage.virtualMcps,X.virtualMcpId,J,J,X.branch);let $=Q.runnerKind??"freestyle";return await(await Ca(Y,$)).delete(Q.vmId).catch((W)=>console.error(`[VM_DELETE] ${$} ${Q.vmId}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var X08=w(()=>{xR0();e18()});var Wi5="https://api.github.com",uR0;var Y08=w(()=>{F0();y0();uT1();QM();uR0=l1({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:F.object({connectionId:F.string().describe("ID of the mcp-github connection to use")}),outputSchema:F.object({installations:F.array(F.object({installationId:F.number(),login:F.string(),avatarUrl:F.string(),type:F.string()})),appSlug:F.string().optional()}),handler:async(X,Y)=>{await Y.access.check();let G=new G$(Y.db,Y.vault),Q=await G.get(X.connectionId);if(!Q)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=Q.accessToken;if(YY1(Q)&&G.isExpired(Q,gT1)){let U=await GY1(Q,G);if(!U)throw Error(O2);J=U,Q=await G.get(X.connectionId)??Q}let $=[],Z,W=1,K=100,H=async(U)=>fetch(`${Wi5}/user/installations?per_page=${K}&page=${W}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let U=await H(J);if(U.status===401){let N=await G.get(X.connectionId);if(!N||!YY1(N))throw Error(O2);let O=await GY1(N,G);if(!O)throw Error(O2);if(J=O,U=await H(J),U.status===401)throw Error(O2)}if(!U.ok)throw Error(`GitHub /user/installations failed: ${U.status}`);let B=await U.json();for(let N of B.installations){if(!Z)Z=N.app_slug??N.app?.slug;$.push({installationId:N.id,login:N.account.login,avatarUrl:N.account.avatar_url,type:N.account.type})}if(B.installations.length<K)break;W++}return{installations:$,...Z?{appSlug:Z}:{}}}})});var G08=w(()=>{Y08()});var XV1={};y6(XV1,{managementMCP:()=>ur,listManagementTools:()=>Ui5,ALL_TOOLS:()=>Q08});async function Ui5(X){let Y=await ur(X),[G,Q]=wX1.createLinkedPair();await Y.connect(Q);let J=new V7({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(G),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var Hi5,Fi5,Q08,ur=async(X)=>{let Y=null;if(X.organization){let Z=await X.storage.organizationSettings.get(X.organization.id),W=await X.storage.virtualMcps.list(X.organization.id),K=new Set(Z?.enabled_plugins??[]);for(let H of W){let U=H.metadata?.enabled_plugins;if(U&&Array.isArray(U))for(let B of U)K.add(B)}Y=K.size>0?[...K]:null}let G=x36(Q08,Y),Q=new Az({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let Z of G){let W=Z.inputSchema&&typeof Z.inputSchema==="object"&&"shape"in Z.inputSchema?Z.inputSchema:F.object({}),K=Z.outputSchema&&typeof Z.outputSchema==="object"&&"shape"in Z.outputSchema?Z.outputSchema:void 0,H=W.shape,U=K?.shape;Q.registerTool(Z.name,{description:Z.description??"",inputSchema:H,outputSchema:U,annotations:Z.annotations,_meta:Z._meta},async(B)=>{X.access.setToolName(Z.name);try{let N=await Z.execute(B,X);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let J=AV6();for(let Z of J)Q.registerPrompt(Z.name,{title:Z.title,description:Z.description},()=>({messages:[{role:"user",content:{type:"text",text:Z.text}}]}));if(X.organization?.id){let Z=await X.storage.brandContext.list(X.organization.id),W=new Set;for(let K of Z){let H=K.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),U=H?`brand-${H}`:`brand-${K.id}`;if(W.has(U))U=`${U}-${K.id.slice(0,8)}`;W.add(U);let B=[`# Brand: ${K.name}`,"",`**Domain:** ${K.domain}`,"","## Overview",K.overview];if(K.colors){let O=Object.entries(K.colors).filter(([,z])=>z);if(O.length>0){B.push("","## Colors");for(let[z,D]of O)B.push(`- **${z}:** ${D}`)}}if(K.fonts){let O=Object.entries(K.fonts).filter(([,z])=>z);if(O.length>0){B.push("","## Fonts");for(let[z,D]of O)B.push(`- ${D} (${z})`)}}if(K.logo)B.push("",`**Logo:** ${K.logo}`);if(K.favicon)B.push(`**Favicon:** ${K.favicon}`);if(K.ogImage)B.push(`**OG Image:** ${K.ogImage}`);if(K.images&&K.images.length>0){B.push("","## Images");for(let O of K.images){let z=Object.entries(O).map(([D,E])=>`${D}: ${E}`).join(", ");B.push(`- ${z}`)}}let N=B.join(`
-`);Q.prompt(U,`Brand context for ${K.name}`,()=>({messages:[{role:"user",content:{type:"text",text:N}}]}))}}let $=TV6();for(let Z of $)Q.resource(Z.name,Z.uri,{description:Z.description,mimeType:Z.mimeType??"text/markdown"},async(W)=>{return{contents:[{uri:typeof W==="string"?W:W.href,mimeType:Z.mimeType??"text/markdown",text:Z.text}]}});return Q};var hr=w(()=>{AA1();LB();B61();F0();QK6();JI6();KI6();LI6();SI6();_I6();Xj6();$j6();qj6();bj6();hj6();YV6();IV6();rV6();_f6();X08();G08();Hi5=[ZT0,$T0,WT0,KT0,HT0,FT0,UT0,BT0,NT0,OT0,zT0,DT0,LT0,ET0,PT0,qT0,AT0,TT0,IT0,jT0,VT0,MT0,RT0,GL0,bA0,yA0,hA0,xA0,gA0,nA0,rA0,aA0,oA0,sA0,WI6,GT0,QT0,JT0,ND0,zD0,DD0,OD0,uA0,lA0,mA0,dA0,cA0,iA0,pA0,sT0,bT0,yT0,hT0,xT0,gT0,uT0,ST0,kT0,CT0,vT0,_T0,lT0,mT0,dT0,cT0,iT0,rT0,aT0,oT0,eA0,XT0,YT0,eT0,XI0,YI0,GI0,QI0,JI0,ZI0,$I0,WI0,KI0,HI0,FI0,UI0,BI0,NI0,OI0,zI0,DI0,wI0,...vf6,hR0,gR0,uR0],Fi5=g36(),Q08=[...Hi5,...Fi5]});function Bi5(X){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:Y}=await Promise.resolve().then(() => (hr(),XV1));return Y.map((G)=>{return{name:G.name,inputSchema:F.toJSONSchema(G.inputSchema,{unrepresentable:"any"}),outputSchema:G.outputSchema?F.toJSONSchema(G.outputSchema,{unrepresentable:"any"}):void 0,description:G.description}})},data:AZ0(B3(),X)},{data:qZ0()},{data:PZ0(X)}]}async function J08(X,Y){try{let G=dY(),Q=h4(),J=new vV(Q.encryptionKey),$=new V51(G.db,J),Z=Bi5(X);await Promise.all(Z.map(async(W)=>{let K=null;if(W.permissions)K=(await L7.api.createApiKey({body:{name:`${W.data.app_name??crypto.randomUUID()}-mcp`,userId:Y,permissions:W.permissions,rateLimitEnabled:!1,metadata:{organization:{id:X},purpose:"default-org-connections"}}}))?.key;let H=await CP({id:"pending",title:W.data.title,connection_type:W.data.connection_type,connection_url:W.data.connection_url,connection_token:W.data.connection_token,connection_headers:W.data.connection_headers}).catch(()=>null),U=await W.getTools?.()??H?.tools??null,B=H?.scopes?.length?H.scopes:null,N=W.data.id?W.data.id.startsWith(`${X}_`)?W.data.id:`${X}_${W.data.id}`:void 0;await $.create({...W.data,id:N,tools:U,configuration_scopes:B,organization_id:X,created_by:Y,connection_token:W.data.connection_token??K})}));try{let W=new M51(G.db);await kQ6(X,Y,W)}catch(W){console.error("Failed to install studio pack agents:",W)}if(Q.aiGatewayEnabled&&A51.provisionKey)try{let W=await vP(Y),K=await A51.provisionKey(W,X);await new I51(G.db,J).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:K,organizationId:X,createdBy:Y})}catch(W){console.error("Failed to auto-provision Deco AI Gateway key:",W)}}catch(G){console.error("Error creating default MCP connections:",G)}}var Z08=w(()=>{ZX();bN0();LD();MP();Dq1();yN0();xN0();gN0();f51();CQ6();F0();e5();$M();bV()});function Ni5(X,Y){let G=X.email.split("@")[1]?.toLowerCase()??null;return{distinctId:X.id,properties:{$set:{email:X.email,name:X.name,email_verified:X.emailVerified},$set_once:{first_seen_at:Y.toISOString(),signup_email_domain:G}}}}function lR0(X){A6.identify(Ni5(X,new Date))}var $08=w(()=>{OY()});async function Di5(X){let{user:Y,token:G}=X;if(!G?.idToken)return;let Q;try{Q=d5(G.idToken)}catch{return}let{preferred_username:J,upn:$}=Q,Z=[J,$].filter((H)=>typeof H==="string"&&H.length>0&&H.toLowerCase()!==Y.email.toLowerCase()).map((H)=>H.toLowerCase());if(Z.length===0)return;let{db:W}=dY(),K=await W.selectFrom("user").selectAll().where("email","in",Z).where("id","!=",Y.id).executeTakeFirst();if(!K)return;try{await W.transaction().execute(async(H)=>{await p1`UPDATE "account" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await p1`UPDATE "session" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await p1`
+`);Q.prompt(U,`Brand context for ${K.name}`,()=>({messages:[{role:"user",content:{type:"text",text:N}}]}))}}let $=TV6();for(let Z of $)Q.resource(Z.name,Z.uri,{description:Z.description,mimeType:Z.mimeType??"text/markdown"},async(W)=>{return{contents:[{uri:typeof W==="string"?W:W.href,mimeType:Z.mimeType??"text/markdown",text:Z.text}]}});return Q};var hr=w(()=>{AA1();LB();B61();F0();QK6();JI6();KI6();LI6();SI6();_I6();Xj6();$j6();qj6();bj6();hj6();YV6();IV6();rV6();_f6();X08();G08();Hi5=[ZT0,$T0,WT0,KT0,HT0,FT0,UT0,BT0,NT0,OT0,zT0,DT0,LT0,ET0,PT0,qT0,AT0,TT0,IT0,jT0,VT0,MT0,RT0,GL0,bA0,yA0,hA0,xA0,gA0,nA0,rA0,aA0,oA0,sA0,WI6,GT0,QT0,JT0,ND0,zD0,DD0,OD0,uA0,lA0,mA0,dA0,cA0,iA0,pA0,sT0,bT0,yT0,hT0,xT0,gT0,uT0,ST0,kT0,CT0,vT0,_T0,lT0,mT0,dT0,cT0,iT0,rT0,aT0,oT0,eA0,XT0,YT0,eT0,XI0,YI0,GI0,QI0,JI0,ZI0,$I0,WI0,KI0,HI0,FI0,UI0,BI0,NI0,OI0,zI0,DI0,wI0,...vf6,hR0,gR0,uR0],Fi5=g36(),Q08=[...Hi5,...Fi5]});function Bi5(X){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:Y}=await Promise.resolve().then(() => (hr(),XV1));return Y.map((G)=>{return{name:G.name,inputSchema:F.toJSONSchema(G.inputSchema,{unrepresentable:"any"}),outputSchema:G.outputSchema?F.toJSONSchema(G.outputSchema,{unrepresentable:"any"}):void 0,description:G.description}})},data:AZ0(B3(),X)},{data:qZ0()},{data:PZ0(X)}]}async function J08(X,Y){try{let G=dY(),Q=h4(),J=new vV(Q.encryptionKey),$=new V51(G.db,J),Z=Bi5(X);await Promise.all(Z.map(async(W)=>{let K=null;if(W.permissions)K=(await L7.api.createApiKey({body:{name:`${W.data.app_name??crypto.randomUUID()}-mcp`,userId:Y,permissions:W.permissions,rateLimitEnabled:!1,metadata:{organization:{id:X},purpose:"default-org-connections"}}}))?.key;let H=await CP({id:"pending",title:W.data.title,connection_type:W.data.connection_type,connection_url:W.data.connection_url,connection_token:W.data.connection_token,connection_headers:W.data.connection_headers}).catch(()=>null),U=await W.getTools?.()??H?.tools??null,B=H?.scopes?.length?H.scopes:null,N=W.data.id?W.data.id.startsWith(`${X}_`)?W.data.id:`${X}_${W.data.id}`:void 0;await $.create({...W.data,id:N,tools:U,configuration_scopes:B,organization_id:X,created_by:Y,connection_token:W.data.connection_token??K})}));try{let W=new M51(G.db);await kQ6(X,Y,W)}catch(W){console.error("Failed to install studio pack agents:",W)}if(Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&A51.provisionKey)try{let W=await vP(Y),K=await A51.provisionKey(W,X);await new I51(G.db,J).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:K,organizationId:X,createdBy:Y})}catch(W){console.error("Failed to auto-provision Deco AI Gateway key:",W)}}catch(G){console.error("Error creating default MCP connections:",G)}}var Z08=w(()=>{ZX();bN0();LD();MP();Dq1();yN0();xN0();gN0();f51();CQ6();F0();e5();$M();bV()});function Ni5(X,Y){let G=X.email.split("@")[1]?.toLowerCase()??null;return{distinctId:X.id,properties:{$set:{email:X.email,name:X.name,email_verified:X.emailVerified},$set_once:{first_seen_at:Y.toISOString(),signup_email_domain:G}}}}function lR0(X){A6.identify(Ni5(X,new Date))}var $08=w(()=>{OY()});async function Di5(X){let{user:Y,token:G}=X;if(!G?.idToken)return;let Q;try{Q=d5(G.idToken)}catch{return}let{preferred_username:J,upn:$}=Q,Z=[J,$].filter((H)=>typeof H==="string"&&H.length>0&&H.toLowerCase()!==Y.email.toLowerCase()).map((H)=>H.toLowerCase());if(Z.length===0)return;let{db:W}=dY(),K=await W.selectFrom("user").selectAll().where("email","in",Z).where("id","!=",Y.id).executeTakeFirst();if(!K)return;try{await W.transaction().execute(async(H)=>{await p1`UPDATE "account" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await p1`UPDATE "session" SET "userId" = ${K.id} WHERE "userId" = ${Y.id}`.execute(H),await p1`
         UPDATE "member" SET "userId" = ${K.id}
         WHERE "userId" = ${Y.id}
           AND "organizationId" NOT IN (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "2.311.5",
+  "version": "2.311.7",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/ai-providers-Dvj--FTM.js

@@ -1 +0,0 @@
-import{e as t,j as i}from"./index-BPbpFSlG.js";import{O as m}from"./select-model-DPEgFP5P.js";import"./checkbox-BhLpSvVG.js";import"./Check-CmnOcISu.js";import"./input-DHBDt0A0.js";import"./dialog-CSDOHRuZ.js";import"./X-DosXDblw.js";import"./drawer-i2HsSBna.js";import"./tooltip-8EMcUk8q.js";import"./select-ThJxxmvQ.js";import"./ChevronDown-B7nkAKvX.js";import"./ChevronUp-COT1DfaR.js";import"./skeleton-BW69nAou.js";import"./Tool01-BMc0DiTH.js";import"./RefreshCcw01-cS3DHDDp.js";import"./SearchMd-CrQCxOMr.js";import"./Settings02-DVf2OlMW.js";import"./use-ai-providers-CJfgIRCZ.js";import"./constants-BxcPdAxA.js";import"./chat-context-BC1CXyf7.js";import"./use-virtual-mcp-CAY4xxsA.js";import"./use-collections-bP--NcMC.js";import"./use-decopilot-events-CJqb-CIN.js";import"./create-sse-subscription-CxkOgzKf.js";import"./use-tasks-sf9lm6fu.js";import"./use-organization-settings-DF1zVgfV.js";import"./ai-providers-logos-DD3qZ33J.js";import"./Zap-BIo7bCpk.js";import"./use-debounced-autosave-0DHMqbbb.js";import"./AlertCircle-CjTfXQMH.js";import"./CheckCircle-Lywb4tzc.js";import"./Trash01-6VDjweik.js";import"./index-CVT_xMzU.js";import"./settings-section-CE6DXKE_.js";import"./card-2PzQvDZe.js";import"./ArrowUpRight-07AMyW3q.js";import"./switch-2kbNkhgy.js";import"./toggle-group-CGlJJKpo.js";import"./avatar-C8DSVjWY.js";import"./User01-C8lenn3T.js";import"./alert-dialog-74AkvGEe.js";import"./formatDistanceToNow-Cb2QZZJn.js";import"./differenceInSeconds-NQ4PDo0z.js";import"./unwrap-tool-result-BYXdCQMg.js";function V(){const o=t.c(1);let r;return o[0]===Symbol.for("react.memo_cache_sentinel")?(r=i.jsx(m,{}),o[0]=r):r=o[0],r}export{V as default};

package/dist/client/assets/registry-DZhiFceQ.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/registry-layout-DAUnauvK.js","assets/index-BPbpFSlG.js","assets/index-CpHJcJk3.css","assets/ArrowNarrowLeft-SJEHnXyc.js","assets/CheckCircle-Lywb4tzc.js","assets/Container-D1pwjZQv.js","assets/Settings02-DVf2OlMW.js","assets/XCircle-ClvYl5pR.js","assets/constants-BxcPdAxA.js","assets/useInfiniteQuery-DpFgBC5z.js","assets/infiniteQueryObserver-CXf2zWh1.js","assets/badge-DHtX06_M.js","assets/input-DHBDt0A0.js","assets/dropdown-menu-CuTxWawv.js","assets/Check-CmnOcISu.js","assets/ChevronRight-CFgoiwVv.js","assets/DotsVertical-CiKG-O-v.js","assets/table-pY_1blbB.js","assets/toggle-group-CGlJJKpo.js","assets/use-view-mode-D3O388Wv.js","assets/tooltip-8EMcUk8q.js","assets/SearchMd-CrQCxOMr.js","assets/dialog-CSDOHRuZ.js","assets/X-DosXDblw.js","assets/AlertCircle-CjTfXQMH.js","assets/alert-dialog-74AkvGEe.js","assets/card-2PzQvDZe.js","assets/Trash01-6VDjweik.js","assets/label-D08h5k1R.js","assets/select-ThJxxmvQ.js","assets/ChevronDown-B7nkAKvX.js","assets/ChevronUp-COT1DfaR.js","assets/switch-2kbNkhgy.js","assets/textarea-yE-qQiGr.js","assets/RefreshCcw01-cS3DHDDp.js","assets/checkbox-BhLpSvVG.js","assets/LinkExternal01-B5ftsff4.js","assets/use-copy-CbGC0huz.js","assets/Plus-BB2q_olj.js","assets/Play-DP3It0wz.js"])))=>i.map(i=>d[i]);
-import{e as a,j as t,r,l as i,_ as o}from"./index-BPbpFSlG.js";const n=r.lazy(()=>o(()=>import("./registry-layout-DAUnauvK.js"),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39])));function c(){const s=a.c(1);let e;return s[0]===Symbol.for("react.memo_cache_sentinel")?(e=t.jsx(r.Suspense,{fallback:t.jsx("div",{className:"flex-1 flex items-center justify-center",children:t.jsx(i,{size:20,className:"animate-spin text-muted-foreground"})}),children:t.jsx(n,{})}),s[0]=e):e=s[0],e}export{c as default};

package/dist/client/assets/store-registry-Ca7gEG02.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/registry-layout-DAUnauvK.js","assets/index-BPbpFSlG.js","assets/index-CpHJcJk3.css","assets/ArrowNarrowLeft-SJEHnXyc.js","assets/CheckCircle-Lywb4tzc.js","assets/Container-D1pwjZQv.js","assets/Settings02-DVf2OlMW.js","assets/XCircle-ClvYl5pR.js","assets/constants-BxcPdAxA.js","assets/useInfiniteQuery-DpFgBC5z.js","assets/infiniteQueryObserver-CXf2zWh1.js","assets/badge-DHtX06_M.js","assets/input-DHBDt0A0.js","assets/dropdown-menu-CuTxWawv.js","assets/Check-CmnOcISu.js","assets/ChevronRight-CFgoiwVv.js","assets/DotsVertical-CiKG-O-v.js","assets/table-pY_1blbB.js","assets/toggle-group-CGlJJKpo.js","assets/use-view-mode-D3O388Wv.js","assets/tooltip-8EMcUk8q.js","assets/SearchMd-CrQCxOMr.js","assets/dialog-CSDOHRuZ.js","assets/X-DosXDblw.js","assets/AlertCircle-CjTfXQMH.js","assets/alert-dialog-74AkvGEe.js","assets/card-2PzQvDZe.js","assets/Trash01-6VDjweik.js","assets/label-D08h5k1R.js","assets/select-ThJxxmvQ.js","assets/ChevronDown-B7nkAKvX.js","assets/ChevronUp-COT1DfaR.js","assets/switch-2kbNkhgy.js","assets/textarea-yE-qQiGr.js","assets/RefreshCcw01-cS3DHDDp.js","assets/checkbox-BhLpSvVG.js","assets/LinkExternal01-B5ftsff4.js","assets/use-copy-CbGC0huz.js","assets/Plus-BB2q_olj.js","assets/Play-DP3It0wz.js"])))=>i.map(i=>d[i]);
-import{e as n,f as c,g as m,j as r,l as f,r as l,_ as u}from"./index-BPbpFSlG.js";const _=l.lazy(()=>u(()=>import("./registry-layout-DAUnauvK.js"),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39])));function x(){const e=n.c(5),o=c();let t;e[0]===Symbol.for("react.memo_cache_sentinel")?(t={from:"/shell/$org"},e[0]=t):t=e[0];const{org:i}=m(t);let s;e[1]===Symbol.for("react.memo_cache_sentinel")?(s=r.jsx("div",{className:"h-full flex items-center justify-center",children:r.jsx(f,{size:20,className:"animate-spin text-muted-foreground"})}),e[1]=s):s=e[1];let a;return e[2]!==o||e[3]!==i?(a=r.jsx(l.Suspense,{fallback:s,children:r.jsx(_,{onBack:()=>o({to:"/$org/settings/store",params:{org:i}})})}),e[2]=o,e[3]=i,e[4]=a):a=e[4],a}export{x as default};

package/dist/client/assets/useInfiniteQuery-DpFgBC5z.js

@@ -1 +0,0 @@
-import{I as u}from"./infiniteQueryObserver-CXf2zWh1.js";import{c2 as i}from"./index-BPbpFSlG.js";function t(e,r){return i(e,u,r)}export{t as u};

package/dist/client/assets/useSuspenseInfiniteQuery-B_gLWLYH.js

@@ -1 +0,0 @@
-import{I as s}from"./infiniteQueryObserver-CXf2zWh1.js";import{c2 as u,c3 as n}from"./index-BPbpFSlG.js";function a(r,e){return u({...r,enabled:!0,suspense:!0,throwOnError:n},s,e)}export{a as u};

package/dist/client/assets/workflow-detail-tYYnfOHI.js

@@ -1 +0,0 @@
-import{e as s,g as l,j as o,l as a,E as n,r as c}from"./index-BPbpFSlG.js";import{a as f}from"./index-DQBpcchF.js";import"./index-D_WrlK5r.js";import"./constants-BxcPdAxA.js";import"./collections-CeyUXk8d.js";import"./index-CxxsJumH.js";import"./use-virtual-mcp-CAY4xxsA.js";import"./use-collections-bP--NcMC.js";import"./monaco-editor-DZ5QI8uz.js";import"./index-2dbmNgG2.js";import"./accordion-DclhREAs.js";import"./agent-icon-CVuf051c.js";import"./AlertCircle-CjTfXQMH.js";import"./Tool01-BMc0DiTH.js";import"./Archive-CaJ5kGW4.js";import"./XClose-CzeywUWk.js";import"./RefreshCcw01-cS3DHDDp.js";import"./ArrowNarrowLeft-SJEHnXyc.js";import"./XCircle-ClvYl5pR.js";import"./ArrowUpRight-07AMyW3q.js";import"./ZapSquare-DBCGSeVa.js";import"./Users03-CIbaYGvp.js";import"./CheckCircle-Lywb4tzc.js";import"./Check-CmnOcISu.js";import"./ChevronDown-B7nkAKvX.js";import"./ChevronRight-CFgoiwVv.js";import"./ChevronUp-COT1DfaR.js";import"./DotsVertical-CiKG-O-v.js";import"./Container-D1pwjZQv.js";import"./Star01-4_ptKeQ0.js";import"./Palette-VwQOwYSo.js";import"./SearchMd-CrQCxOMr.js";import"./index-CVT_xMzU.js";import"./tooltip-8EMcUk8q.js";import"./X-DosXDblw.js";import"./LinkExternal01-B5ftsff4.js";import"./Lock01-BRRKEYOm.js";import"./Sun-DmD9Q3PB.js";import"./Play-DP3It0wz.js";import"./Plus-BB2q_olj.js";import"./Settings02-DVf2OlMW.js";import"./Shield01-B3ECj0f_.js";import"./Trash01-6VDjweik.js";import"./User01-C8lenn3T.js";import"./Zap-BIo7bCpk.js";import"./badge-DHtX06_M.js";import"./select-ThJxxmvQ.js";import"./view-mode-toggle-B4e_lOZL.js";import"./layout-B1PdCwnm.js";import"./use-connection-Bszp6a5W.js";import"./use-mcp-tools-IbqZtDzy.js";import"./dialog-CSDOHRuZ.js";import"./index-DUpS8oet.js";import"./dropdown-menu-CuTxWawv.js";import"./integration-icon-BsCzD6pa.js";import"./scroll-area-PHdLgpTR.js";import"./index-CRIGn0SA.js";import"./empty-state-Pw6pEnBg.js";import"./create-sse-subscription-CxkOgzKf.js";import"./input-DHBDt0A0.js";function Et(){const t=s.c(4);let r;t[0]===Symbol.for("react.memo_cache_sentinel")?(r={from:"/shell/$org/settings/workflows/$itemId"},t[0]=r):r=t[0];const{itemId:e}=l(r);let i;t[1]===Symbol.for("react.memo_cache_sentinel")?(i=o.jsx("div",{className:"flex h-full items-center justify-center",children:o.jsx(a,{size:32,className:"animate-spin text-muted-foreground"})}),t[1]=i):i=t[1];const p=decodeURIComponent(e);let m;return t[2]!==p?(m=o.jsx(n,{children:o.jsx(c.Suspense,{fallback:i,children:o.jsx(f,{itemId:p})})}),t[2]=p,t[3]=m):m=t[3],m}export{Et as default};